Security Bulletin: Multiple vulnerabilities in IBM MQ Appliance (CVE-2020-4025 and CVE-2020-4203)

Summary IBM MQ Appliance has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2020-4205 DESCRIPTION: IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.8 could allow an authenticated user to bypass security restrictions, and continue to access the server even after...

Cisco, Zoom and Others Must Bolster Security, Say Privacy Chiefs

Global privacy commissioners issued a joint public decry against leading video conferencing companies such as Cisco Systems, Microsoft and Zoom to demand the companies beef up their security and privacy strategies. The critique was delivered via an open letter published by data protection and...

McAfee Total Protection Privilege Escalation

The vulnerability of the McAfee Total Protection antivirus protection lies in its lack of access control mechanisms. Exploiting this vulnerability allows attackers to enhance their privileges by manipulating symbolic links or executing malicious scripts or programs...

CVE-2020-14485

OpenClinic GA versions 5.09.02 and 5.89.05b may allow an attacker to bypass client-side access controls or use a crafted request to initiate a session with limited functionality, which may allow execution of admin functions such as SQL queries...

CVE-2020-14485

OpenClinic GA versions 5.09.02 and 5.89.05b may allow an attacker to bypass client-side access controls or use a crafted request to initiate a session with limited functionality, which may allow execution of admin functions such as SQL queries...

CVE-2020-14485

OpenClinic GA CVE-2020-14485 affects OpenClinic GA versions 5.09.02 and 5.89.05b. The issue is an authentication bypass using an alternate path or channel that may allow a session with limited functionality and execution of admin functions such as SQL queries. ICS advisories indicate this vulnera...

CVE-2020-14485: Authentication Bypass Using an Alternate Path or Channel

OpenClinic GA versions 5.09.02 and 5.89.05b may allow an attacker to bypass client-side access controls or use a crafted request to initiate a session with limited functionality, which may allow execution of admin functions such as SQL queries...

Microsoft Windows Mobile Device Management Diagnostics elevation of privilege vulnerability (CNVD-2020-52925)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation.Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. An elevation of privilege vulnerability exists in Microsoft Windows Mobile Device Manageme...

OWOX, Inc.: Unrestricted File Upload in Chat Window

Summary: The application allows the attacker to upload dangerous file types that can be automatically processed within the product's environment. Steps To Reproduce: - Hit the browser and navigate to https://bi.owox.com and sign in. - Open The Chat window. - Upload any .rb or .php file . - Click ...

PT-2020-3372

Name of the Vulnerable Software and Affected Versions Oracle Security Service versions 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0 Description The issue is related to the SSL API component of Oracle Security Service, which has inadequate access controls. This allows an unauthenticated attacker with networ...

PT-2020-3318

Name of the Vulnerable Software and Affected Versions Oracle Insurance Accounting Analyzer versions 8.0.6 through 8.0.9 Description The issue is related to insufficient access controls in the User Interface component of the Oracle Insurance Accounting Analyzer product. It allows a low-privileged...

PT-2020-3341

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite versions 12.1.3 and 12.2.3 through 12.2.9 Description The issue is related to insufficient access controls in the Preferences component of Oracle CRM Technical Foundation, allowing a low-privileged attacker with network...

PT-2020-3385

Name of the Vulnerable Software and Affected Versions Oracle Coherence versions 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 Description The issue is related to insufficient access controls in the CacheStore component of Oracle Coherence, allowing a remote attacker to cause a denial of...

PT-2020-3320

Name of the Vulnerable Software and Affected Versions Oracle Financial Services Liquidity Risk Management version 8.0.6 Description The issue is related to insufficient access controls in the User Interface component of the Oracle Financial Services Liquidity Risk Management product. This allows ...

PT-2020-3449

Name of the Vulnerable Software and Affected Versions PeopleSoft Enterprise PeopleTools versions 8.56 through 8.58 Description The issue is related to insufficient access controls in the Query component of Oracle PeopleSoft Enterprise PeopleTools. This can be exploited by a remote attacker to gai...

PT-2020-18804 · F5 · Big-Ip

Name of the Vulnerable Software and Affected Versions: BIG-IP versions 11.6.1 through 11.6.5.2 BIG-IP versions 12.1.0 through 12.1.5.2 BIG-IP versions 13.1.0 through 13.1.3.3 Description: The issue arises from the BIG-IP system's failure to properly enforce access controls for the scp.blacklist...

A zero-day guide for 2020: Recent attacks and advanced preventive techniques

Zero-day vulnerabilities enable threat actors to take advantage of security blindspots. Typically, a zero-day attack involves the identification of zero-day vulnerabilities, creating relevant exploits, identifying vulnerable systems, and planning the attack. The next steps are infiltration and...

CVE-2020-3360

A vulnerability in the Web Access feature of Cisco IP Phones Series 7800 and Series 8800 could allow an unauthenticated, remote attacker to view sensitive information on an affected device. The vulnerability is due to improper access controls on the web-based management interface of an affected...

CVE-2020-3360 Cisco IP Phones Series 7800 and Series 8800 Call Log Information Disclosure Vulnerability

A vulnerability in the Web Access feature of Cisco IP Phones Series 7800 and Series 8800 could allow an unauthenticated, remote attacker to view sensitive information on an affected device. The vulnerability is due to improper access controls on the web-based management interface of an affected...

CVE-2020-3360 Cisco IP Phones Series 7800 and Series 8800 Call Log Information Disclosure Vulnerability

A vulnerability in the Web Access feature of Cisco IP Phones Series 7800 and Series 8800 could allow an unauthenticated, remote attacker to view sensitive information on an affected device. The vulnerability is due to improper access controls on the web-based management interface of an affected...