Design/Logic Flaw

A vulnerability was found when an attacker, while communicating with the ClearPass management interface, is able to intercept and change parameters in the HTTP packets resulting in the compromise of some of ClearPass' service accounts. Resolution: Fixed in 6.7.10, 6.8.1, 6.9.0 and higher...

CVE-2020-7113

The CVE-2020-7113 entry describes a vulnerability in Aruba Networks ClearPass (management interface) where an attacker can intercept and modify HTTP parameters, leading to compromise of some ClearPass service accounts. Affected versions include ClearPass Policy Manager prior to the fixed releases...

Microsoft Windows Media Foundation Buffer Overflow Vulnerability (CNVD-2020-26243)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation.Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. Media Foundation is one of the multimedia application libraries. A buffer overflow...

Microsoft SharePoint Remote Code Execution Vulnerability (CNVD-2020-24134)

Microsoft SharePoint is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A remote code executi...

Microsoft SharePoint Remote Code Execution Vulnerability (CNVD-2020-24062)

Microsoft SharePoint is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A remote code executi...

Microsoft SharePoint Remote Code Execution Vulnerability (CNVD-2020-24060)

Microsoft SharePoint is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A remote code executi...

Microsoft SharePoint Remote Code Execution Vulnerability (CNVD-2020-23438)

Microsoft SharePoint is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A remote code executi...

Microsoft SharePoint Remote Code Execution Vulnerability (CNVD-2020-23436)

Microsoft SharePoint is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A remote code executi...

CVE-2020-2864

Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite component: Accounts. Supported versions that are affected are 12.1.3 and 12.2.5-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iSupplier...

CVE-2020-2864

Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite component: Accounts. Supported versions that are affected are 12.1.3 and 12.2.5-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iSupplier...

Watch: Flaw exploited to post fake COVID-19 clips from TikTok accounts

By Deeba Ahmed In their demonstration, researchers showed how they published fake COVID-19 videos from WHO and TikTok's official accounts. This is a post from HackRead.com Read the original post: Watch: Flaw exploited to post fake COVID-19 clips from TikTok accounts...

4 million Quidd user accounts dumped on hacker forum for download

By Waqas 4 million Quidd user accounts dumped on hacker forum for download - The hacker forum is letting anyone download the data. This is a post from HackRead.com Read the original post: 4 million Quidd user accounts dumped on hacker forum for download...

SweetPotato – Service to SYSTEM

I've had a keen interest in the original RottenPotato and JuicyPotato exploits that utilize DCOM and NTLM reflection to perform privilege escalation to SYSTEM from service accounts. The applications behave by leveraging the SeImpersontePrivilege and MITM to perform privilege escalation when a hig...

Information Disclosure

directory server is vulnerable to information disclosure. Directory Server setup scripts created cache files, containing passwords for the Directory and Administration Server administrative accounts, with weak file permissions. A local user could use this flaw to obtain authentication credentials...

CentOS 7 : GNOME (RHSA-2020:1021)

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1021 advisory. - It was discovered that the gnome-shell lock screen since version 3.15.91 did not properly restrict all contextual actions. An attacker with physical access to...

Description of Update Rollup 5 for System Center 2012 R2 Operations Manager

Description of Update Rollup 5 for System Center 2012 R2 Operations Manager Introduction This article describes the issues that are fixed in Update Rollup 5 for Microsoft System Center 2012 R2 Operations Manager. This article also contains the installation instructions for Update Rollup 5 for...

Samsung Mobile Device Input Validation Error Vulnerability (CNVD-2020-34727)

Android is a free and open source operating system from Google based on the Linux kernel without GNU components. An input validation error vulnerability exists in Samsung mobile devices, which can be exploited by an attacker to create other user accounts in a tablet and access user data in extern...

Unspecified Vulnerability in Mozilla Firefox (CNVD-2020-26228)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. An unspecified vulnerability exists in Mozilla Firefox. An attacker can exploit this vulnerability to obtain an authorization code and gain access to user accounts...

Advantech WebAccess/NMS UsersInputAction Missing Authentication for Critical Function Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of Advantech WebAccess/NMS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of calls to the usersInputAction.action endpoint. Authentication i...

CVE-2020-11543

OpsRamp Gateway before 7.0.0 has a backdoor account vadmin with the password 9vt@f3Vt that allows root SSH access to the server. This issue has been resolved in OpsRamp Gateway firmware version 7.0.0 where an administrator and a system user accounts are the only available user accounts for the...