CVE-2020-12495

The CVE-2020-12495 entry concerns Endress+Hauser Ecograph T (Neutral/Private Label) devices (RSG35, ORSG35) with firmware

CVE-2020-12496: Exposure of Sensitive Information to an Unauthorized Actor

Endress+Hauser Ecograph T Neutral/Private Label RSG35, ORSG35 and Memograph M Neutral/Private Label RSG45, ORSG45 with Firmware version V2.0.0 and above is prone to exposure of sensitive information to an unauthorized actor. The firmware release has a dynamic token for each request submitted to t...

CVE-2020-12495: Improper Privilege Management

Endress+Hauser Ecograph T Neutral/Private Label RSG35, ORSG35 with Firmware version prior to V2.0.0 is prone to improper privilege management. The affected device has a web-based user interface with a role-based access system. Users with different roles have different write and read privileges. T...

Endress+hauser Ecograph Information Disclosure Vulnerability

The Endress+hauser Ecograph is a data logger from Endress+Hauser Switzerland. It is used to record and visualize all process sequences safely and completely. An information disclosure vulnerability exists in Endress+hauser Ecograph T version V2.0.0 and later versions, which stems from the easy...

PT-2020-13143

Name of the Vulnerable Software and Affected Versions Endress+Hauser Ecograph T Neutral/Private Label RSG35, ORSG35 versions V2.0.0 and above Endress+Hauser Memograph M Neutral/Private Label RSG45, ORSG45 versions V2.0.0 and above Description The issue concerns exposure of sensitive information t...

PT-2020-13142

Name of the Vulnerable Software and Affected Versions Endress+Hauser Ecograph T Neutral/Private Label RSG35, ORSG35 versions prior to V2.0.0 Description The affected device has a web-based user interface with a role-based access system, where users with different roles have different write and re...

Don’t Put It on the Internet: Tesla Backup Gateway Edition

Derek Abdine, formerly Director of Rapid7 Labs, now CTO at Censys, contributed this blog post. This blog post aims to increase user awareness of the privacy and security risks of connecting devices to the internet. In this edition, we address Tesla Backup Gateways and identify some key areas wher...

RUSTSEC-2020-0119 ReadTicket and WriteTicket should only be sendable when T is Send

Affected versions of this crate unconditionally implemented Send for ReadTicket & WriteTicket. This allows to send non-Send T to other threads. This can allows creating data races by cloning types with internal mutability and sending them to other threads as T of ReadTicket/WriteTicket. Such data...

RUSTSEC-2020-0135 Slock<T> allows sending non-Send types across thread boundaries

Slock unconditionally implements Send/Sync. Affected versions of this crate allows sending non-Send types to other threads, which can lead to data races and memory corruption due to the data race...

PT-2020-17556

Name of the Vulnerable Software and Affected Versions try-mutex crate versions prior to 0.3.0 Description An issue in the try-mutex crate allows cross-thread sending of a non-Send type, which can cause a data race. This occurs because affected versions of the crate unconditionally implemented the...

PT-2020-17636

Name of the Vulnerable Software and Affected Versions slock crate through 2020-11-17 Description The issue concerns the slock crate, where Slock unconditionally implements Send and Sync. This allows sending non-Send types to other threads, which can lead to data races and memory corruption due to...

PT-2020-17634

Name of the Vulnerable Software and Affected Versions scottqueue crate through 2020-11-15 Description An issue in the scottqueue crate allows unconditional implementations of Send and Sync for Queue, which can lead to creating data races to a T: !Sync and sending T: !Send to other threads. This...

PT-2020-17615

Name of the Vulnerable Software and Affected Versions unicycle crate versions prior to 0.7.1 Description The issue allows sending non-Send types to other threads and concurrently accessing non-Sync types from multiple threads. This can result in a data race and memory corruption when types that...

PT-2020-17626

Name of the Vulnerable Software and Affected Versions signal-simple crate versions through 2020-11-15 Description An issue was discovered in the signal-simple crate where there are unconditional implementations of Send and Sync for SyncChannel. This allows users to create undefined behavior in sa...

PT-2020-17637

Name of the Vulnerable Software and Affected Versions toolshed crate through 2020-11-15 for Rust Description The issue concerns the CopyCell type in the toolshed crate, which lacks bounds on the contained type for the Send trait. This means that even though not all Copyable types are thread-safe,...

RUSTSEC-2020-0134 `LockWeak<T>` allows to create data race to `T`.

In the affected versions of this crate, LockWeak unconditionally implemented Send with no trait bounds on T. LockWeak doesn't own T and only provides &T. This allows concurrent access to a non-Sync T, which can cause undefined behavior like data races...

`LockWeak<T>` allows to create data race to `T`.

In the affected versions of this crate, LockWeak unconditionally implemented Send with no trait bounds on T. LockWeak doesn't own T and only provides &T. This allows concurrent access to a non-Sync T, which can cause undefined behavior like data races...

PT-2020-17632

Name of the Vulnerable Software and Affected Versions rcu cell crate through 2020-11-14 Description The issue allows users to send T: !Send to other threads while T is enclosed within RcuCell, and allows users to concurrently access T: !Sync by using the APIs of RcuCell that provide access to &T...

PT-2020-17635

Name of the Vulnerable Software and Affected Versions parc crate through 2020-11-14 Description An issue in the parc crate allows concurrent access to a non-Sync T, which can cause undefined behavior like data races. This is due to LockWeak unconditionally implementing Send without trait bounds o...

The vulnerability of the Core server component of Oracle WebLogic Server allows a hacker to execute arbitrary code.

The vulnerability of the Core server component of Oracle WebLogic Server is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using IIOP and T3 protocols from a remote location...