CVE-2020-7357

Cayin CMS suffers from an authenticated OS semi-blind command injection vulnerability using default credentials. This can be exploited to inject and execute arbitrary shell commands as the root user through the 'NTPServerIP' HTTP POST parameter in system.cgi page. This issue affects several...

CVE-2020-7357

CVE-2020-7357 relates to Cayin CMS where an authenticated OS semi-blind command injection is possible via the NTP_Server_IP/NTP IP parameter in system.cgi. The issue requires authentication (default credentials) and can allow execution of arbitrary shell commands as root. Affected are multiple Ca...

CVE-2020-7357 Cayin CMS Command Injection

Cayin CMS suffers from an authenticated OS semi-blind command injection vulnerability using default credentials. This can be exploited to inject and execute arbitrary shell commands as the root user through the 'NTPServerIP' HTTP POST parameter in system.cgi page. This issue affects several...

CVE-2020-4534

CVE-2020-4534 (WebSphere Application Server) is confirmed in connected IBM bulletins. Affected: WebSphere Application Server traditional versions 7.0, 8.0, 8.5, and 9.0. Description: local authenticated attackers can escalate privileges by exploiting improper handling of UNC paths when scheduling...

Atlassian Jira < 7.6.17 / 7.7.x < 7.13.9 / 8.0.x < 8.4.2 Information Disclosure

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 7.6.17, or 7.7.x prior to 7.13.9, or version 8.0.x prior to 8.4.2. It is, therefore, affected by a Information Disclosure vulnerability. - A remote attackers to view sensitive...

IBM MQ Appliance Denial of Service Vulnerability (CNVD-2020-50796)

The IBM MQ Appliance is an all-in-one appliance for rapid deployment of enterprise-class messaging middleware from IBM USA. A denial of service vulnerability exists in IBM MQ Appliance version 8.0, 9.1 LTS version and 9.1 CD version, which can be exploited by an attacker to cause a denial of...

Ubuntu: Security Advisory (USN-4441-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: IBM MQ Appliance is vulnerable to a buffer overflow vulnerability (CVE-2020-4465)

Summary IBM MQ Appliance has resolved a buffer overflow vulnerability. Vulnerability Details CVEID: CVE-2020-4465 DESCRIPTION: IBM MQ, IBM MQ Appliance, and IBM MQ for HPE NonStop are vulnerable to a buffer overflow vulnerability due to an error within the channel processing code. A remote attack...

Security Bulletin: Multiple Security Vulnerabilities in IBM MQ Affect IBM Sterling B2B Integrator

Summary IBM Sterilng B2B Integrator has addressed multiple security vulnerabilities in IBM MQ Vulnerability Details CVEID: CVE-2019-4619 DESCRIPTION: IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD could allow a local attacker to obtain sensitive information by inclusion o...

Security Bulletin: IBM MQ Appliance affected by an OpenSSL vulnerability (CVE-2019-1551)

Summary IBM MQ Appliance has addressed the following OpenSSL vulnerability. Vulnerability Details CVEID: CVE-2019-1551 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an overflow in the x6464 Montgomery squaring procedure used in exponentiation with...

Design/Logic Flaw

In onCommand of CompanionDeviceManagerService.java, there is a possible permissions bypass due to a missing permission check. This could lead to local escalation of privilege allowing background data usage or launching from the background, with no additional execution privileges needed. User...

Type confusion

In FastKeyAccumulator::GetKeysSlow of keys.cc, there is a possible out of bounds write due to type confusion. This could lead to remote code execution when processing a proxy configuration with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

Design/Logic Flaw

In the permission declaration for com.google.android.providers.gsf.permission.WRITEGSERVICES in AndroidManifest.xml, there is a possible permissions bypass. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for...

CVE-2020-0227

In onCommand of CompanionDeviceManagerService.java, there is a possible permissions bypass due to a missing permission check. This could lead to local escalation of privilege allowing background data usage or launching from the background, with no additional execution privileges needed. User...

MySQL Enterprise Monitor 4.0.x < 4.0.12.5346 / 8.0.x < 8.0.20.1237 (Jul 2020 CPU)

According to its self-reported version, the MySQL Enterprise Monitor application running on the remote host is 4.0.x prior to 4.0.12.5346 or 8.0.x prior to 8.0.20.1237. It is, therefore, affected by a remote code execution vulnerability. An unauthenticated, remote attacker can exploit this to...

MySQL Enterprise Monitor 4.0.x < 4.0.13.5349 / 8.0.x < 8.0.21.1240 (Jul 2020 CPU)

According to its self-reported version, the MySQL Enterprise Monitor application running on the remote host is 4.0.x prior to 4.0.13.5349 or 8.0.x prior to 8.0.21.1240. It is, therefore, affected by multiple vulnerabilities: - A buffer overflow condition exists in the Montgomery squaring procedur...

MySQL 8.0.x < 8.0.21 Multiple Vulnerabilities (Jul 2020 CPU)

The version of MySQL running on the remote host is 8.0.x prior to and including 8.0.20. It is, therefore, affected by multiple vulnerabilities, including the following, as noted in the July 2020 Critical Patch Update advisory: - Vulnerability in the MySQL Server product of Oracle MySQL component:...

UBUNTU-CVE-2020-14539

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 5.6.48 and prior, 5.7.30 and prior and 8.0.20 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to...

Release Information for Veeam Management Pack for Microsoft System Center 9

This version has been superseded by Veeam Management Pack for Microsoft System Center version 9a. Requirements Please confirm that you are running version 8.0 build 8.0.0.2218 or later prior to upgrading. You can check this in the Operations Manager console under Administration, Management Packs...

SUSE SLES12 Security Update : java-1_8_0-ibm (SUSE-SU-2020:1685-1)

This update for java-180-ibm fixes the following issues : java-180-ibm was updated to Java 8.0 Service Refresh 6 Fix Pack 10 bsc1172277,bsc1169511,bsc1160968 CVE-2020-2654: Fixed an issue which could have resulted in unauthorized ability to cause a partial denial of service CVE-2020-2754: Forward...