Multiple Themes - Unauthenticated Function Injection

Jerome Bruandet, from nintechnet, discovered numerous themes affected by Unauthenticated Function Injection issues, due to the lack of capability and CSRF nonce checks in AJAX actions. The naturemag-lite theme partially fixed the issues in v1.0.5, however it has been removed from the WordPress...

Debian DLA-2371-1 : wordpress security update

Multiple vulnerabilities were discovered in Wordpress, a popular content management framework. CVE-2019-17670 WordPress has a Server Side Request Forgery SSRF vulnerability because Windows paths are mishandled during certain validation of relative URLs. CVE-2020-4047 Authenticated users with uplo...

Security Only Update for .NET Framework 4.8 for Windows 7 SP1 and Windows Server 2008 R2 SP1 (KB4576490)

Security Only Update for .NET Framework 4.8 for Windows 7 SP1 and Windows Server 2008 R2 SP1 KB4576490 Notice Revised 2/2/2022 On February 2nd, 2022, guidance was added to this article regarding how to install security-only updates after some changes were made to the ESU program. See the Known...

Code injection

This affects the package MintegralAdSDK from 0.0.0. The SDK distributed by the company contains malicious functionality that tracks any URL opened by the app and reports it back to the company, along with performing advertisement attribution fraud. Mintegral can remotely activate hooks on the...

CVE-2020-7705

This affects the package MintegralAdSDK from 0.0.0. The SDK distributed by the company contains malicious functionality that tracks any URL opened by the app and reports it back to the company, along with performing advertisement attribution fraud. Mintegral can remotely activate hooks on the...

CVE-2020-7705 Malicious Package

This affects the package MintegralAdSDK from 0.0.0. The SDK distributed by the company contains malicious functionality that tracks any URL opened by the app and reports it back to the company, along with performing advertisement attribution fraud. Mintegral can remotely activate hooks on the...

CVE-2020-7705

The CVE-2020-7705 entry concerns MintegralAdSDK (iOS) with malicious functionality that tracks every opened URL and reports it to an external server, performing ad-attribution fraud even if ads are not served. It can remotely activate hooks on UIKit components (UIApplication, openURL, SKStoreProd...

August 11, 2020—KB4571719 (Security-only update)

None None...

CVE-2020-15708

Ubuntu's packaging of libvirt in 20.04 LTS created a control socket with world read and write permissions. An attacker could use this to overwrite arbitrary files or execute arbitrary code...

The vulnerability of the LoRaWAN LoRaMac-Node implementation lies in the copying from the buffer without checking the size of the input data, allowing a intruder to trigger a service failure.

The vulnerability of the LoRaWAN LoRaMac-Node implementation lies in the copying of data from the buffer without checking the size of the input data. Exploiting this vulnerability could allow a malicious actor to cause failures in the operation of end devices during wireless activation OTAA,...

Microsoft Windows Agent Activation Runtime Information Disclosure Vulnerability

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation.Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. An information disclosure vulnerability exists in the Microsoft Windows Agent Activation...

The vulnerability of the Agent Activation Runtime service in the Windows operating system allows a perpetrator to disclose protected information.

The vulnerability of the Agent Activation Runtime service in the Windows operating system exists due to object handling errors in memory. Exploiting this vulnerability can allow an attacker to disclose sensitive information through a specially created application...

Nord Security: Getting SmartDNS for free from - join.nordvpn.com

The reporter identified an issue within our backend system which performs validation of the active services. There was a misconfiguration related to caching and time period calculation. This lead to SmartDNS service being active for a longer period of time than it should have been, compared with...

CVE-2020-1391

An information disclosure vulnerability exists when the Windows Agent Activation Runtime AarSvc fails to properly handle objects in memory, aka 'Windows Agent Activation Runtime Information Disclosure Vulnerability'...

CVE-2020-1391

An information disclosure vulnerability exists when the Windows Agent Activation Runtime AarSvc fails to properly handle objects in memory, aka 'Windows Agent Activation Runtime Information Disclosure Vulnerability'...

Information disclosure

An information disclosure vulnerability exists when the Windows Agent Activation Runtime AarSvc fails to properly handle objects in memory, aka 'Windows Agent Activation Runtime Information Disclosure Vulnerability'...

CVE-2020-1391

CVE-2020-1391 is a Windows information-disclosure issue in the Windows Agent Activation Runtime (AarSvc). The vulnerability arises because AarSvc fails to properly handle objects in memory, enabling an attacker who can log on to run a crafted app that could disclose information to further comprom...

Windows Agent Activation Runtime Information Disclosure Vulnerability

An information disclosure vulnerability exists when the Windows Agent Activation Runtime AarSvc fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system. To exploit this vulnerability, an...

July 14, 2020—KB4565539 (Security-only update)

None None...

PT-2020-3104

Name of the Vulnerable Software and Affected Versions Windows Agent Activation Runtime AarSvc affected versions not specified Description An information disclosure issue exists due to improper handling of objects in memory. This could allow an attacker to disclose protected information using a...