SaltStack Salt REST API Arbitrary Command Execution Exploit

This Metasploit module exploits an authentication bypass and command injection in SaltStack Salt's REST API to execute commands as the root user. The following versions have received a patch: 2015.8.10, 2015.8.13, 2016.3.4, 2016.3.6, 2016.3.8, 2016.11.3, 2016.11.6, 2016.11.10, 2017.7.4, 2017.7.8,...

CVE-2020-4649

creationtimestamp| type| source ---|---|--- 2020-11-03 16:40:21+00:00| seen| https://t.me/cibsecurity/15805...

CVE-2020-15973

creationtimestamp| type| source ---|---|--- 2020-11-03 07:39:57+00:00| seen| https://t.me/cibsecurity/15796...

CVE-2020-16001

creationtimestamp| type| source ---|---|--- 2020-11-03 07:39:56+00:00| seen| https://t.me/cibsecurity/15795...

CVE-2020-7758

creationtimestamp| type| source ---|---|--- 2020-11-03 00:45:09+00:00| seen| https://t.me/cibsecurity/15788...

CVE-2020-27982

creationtimestamp| type| source ---|---|--- 2020-11-03 00:39:07+00:00| seen| https://t.me/cibsecurity/15787...

GLSA-202011-03 : KPMCore: Root privilege escalation

The remote host is affected by the vulnerability described in GLSA-202011-03 KPMCore: Root privilege escalation Improper checks on the D-Bus request received resulted in improper protection for /etc/fstab. Impact : An attacker could esclate privileges to root by exploiting this vulnerability...

[ASA-202011-2] chromium: multiple issues

Arch Linux Security Advisory ASA-202011-2 ========================================= Severity: Critical Date : 2020-11-03 CVE-ID : CVE-2020-16004 CVE-2020-16005 CVE-2020-16006 CVE-2020-16007 CVE-2020-16008 CVE-2020-16009 Package : chromium Type : multiple issues Remote : Yes Link :...

CVE-2020-24352

creationtimestamp| type| source ---|---|--- 2020-10-16 12:42:04+00:00| seen| https://t.me/cibsecurity/15312 2026-03-19 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/...

classbento.co.th Cross Site Scripting vulnerability OBB-1405126

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

CVE-2020-25776

creationtimestamp| type| source ---|---|--- 2020-10-03 02:54:30+00:00| seen| https://t.me/cibsecurity/15038...

CVE-2020-26526

creationtimestamp| type| source ---|---|--- 2020-10-03 00:54:26+00:00| seen| https://t.me/cibsecurity/15037...

CVE-2020-15231

creationtimestamp| type| source ---|---|--- 2020-10-03 00:54:26+00:00| seen| https://t.me/cibsecurity/15036...

CVE-2020-16212

In Patient Information Center iX PICiX Versions B.02, C.02, C.03, the product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource. The application on the surveillance station operates in kiosk mode, which is vulnerable to local...

CVE-2020-16224

In Patient Information Center iX PICiX Versions C.02, C.03, the software parses a formatted message or structure but does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data, causing the application on the surveillance station to...

CVE-2020-16218

In Patient Information Center iX PICiX Versions B.02, C.02, C.03, the software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is then used as a webpage and served to other users. Successful exploitation could lead to unauthorized access t...

Design/Logic Flaw

In Patient Information Center iX PICiX Version B.02, C.02, C.03, and PerformanceBridge Focal Point Version A.01, when an actor claims to have a given identity, the software does not prove or insufficiently proves the claim is correct...

CVE-2020-16224 Philips Patient Monitoring Devices Improper Handling of Length Parameter Inconsistency

In Patient Information Center iX PICiX Versions C.02, C.03, the software parses a formatted message or structure but does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data, causing the application on the surveillance station to...

PT-2020-14811 · Philips · Patient Information Center Ix

Name of the Vulnerable Software and Affected Versions: Patient Information Center iX PICiX versions B.02, C.02, C.03 Description: The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource. The application on the surveillance...

PT-2020-14813 · Philips · Patient Information Center Ix

Name of the Vulnerable Software and Affected Versions: Patient Information Center iX PICiX versions B.02, C.02, C.03 Description: The software saves user-provided information into a comma-separated value CSV file, but it does not neutralize or incorrectly neutralizes special elements that could b...