CVE-2020-35708

CVE-2020-35708 affects phpList 3.5.9. The vulnerability is a SQL injection exploitable by admins who submit a crafted fourth line of a file via the Config - Import Administrators page. Documented impact is partial data confidentiality/integrity/availability per CVSS, with base scores: CVSS2 v2.0 ...

PT-2020-17397 · Phplist · Phplist

Name of the Vulnerable Software and Affected Versions: phpList version 3.5.9 Description: The issue allows SQL injection by admins who provide a crafted fourth line of a file to the "Config - Import Administrators" page. Recommendations: For phpList version 3.5.9, consider restricting access to t...

PhpList SQL注入漏洞

phpList is an open source newsletter and email marketing software from phpList UK. A SQL injection vulnerability exists in phpList 3.5.9. The vulnerability can be exploited to inject SQL queries via the attribute on line 4 of the "Config - Import Administrators" page...

CVE-2020-35657

Jaws through 1.8.0 allows remote authenticated administrators to execute arbitrary code via crafted use of UploadTheme to upload a theme ZIP archive containing a .php file that is able to execute OS commands. NOTE: this is unrelated to the JAWS aka Job Access With Speech product...

Design/Logic Flaw

Jaws through 1.8.0 allows remote authenticated administrators to execute arbitrary code via crafted use of UploadTheme to upload a theme ZIP archive containing a .php file that is able to execute OS commands. NOTE: this is unrelated to the JAWS aka Job Access With Speech product...

Code injection

Jaws through 1.8.0 allows remote authenticated administrators to execute arbitrary code via crafted use of admin.php?reqGadget=Components&reqAction=InstallGadget&comp=FileBrowser and admin.php?reqGadget=FileBrowser&reqAction=Files to upload a .php file. NOTE: this is unrelated to the JAWS aka Job...

McAfee VirusScan Enterprise < 8.8 Patch 16 Access Control Bypass Vulnerability (SB10338)

The version of McAfee VirusScan Enterprise VSE installed on the remote Windows host is prior to 8.8 Patch 16. It is, therefore, affected by an access control bypass vulnerability which allows local administrators the ability to bypass local security protections by carefully manipulating the code...

Auto-Update Fails with Citrix Workspace App 2012 for Windows

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. Automatic updates from Citrix Workspace app 2012 for Windows fails with the error "Could not load fi...

Mozilla Releases Security Updates for Firefox, Firefox ESR, and Thunderbird

Mozilla has released security updates to address vulnerabilities in Firefox, Firefox ESR, and Thunderbird. An attacker could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the Mozilla Security Advisories for Firefox...

UBUNTU-CVE-2020-29480

An issue was discovered in Xen through 4.14.x. Neither xenstore implementation does any permission checks when reporting a xenstore watch event. A guest administrator can watch the root xenstored node, which will cause notifications for every created, modified, and deleted key. A guest...

CVE-2020-29480

An issue was discovered in Xen through 4.14.x. Neither xenstore implementation does any permission checks when reporting a xenstore watch event. A guest administrator can watch the root xenstored node, which will cause notifications for every created, modified, and deleted key. A guest...

Apple Releases Security Updates for Multiple Products

Apple has released security updates to address vulnerabilities in multiple products. An attacker could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the Apple security pages for the following products and apply the...

Fedora: Security Advisory for pam (FEDORA-2020-bd83344365)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Adobe Releases Security Updates for Acrobat and Reader

Adobe has released security updates to address a vulnerability in Acrobat and Reader. An attacker could exploit this vulnerability to obtain sensitive information. The Cybersecurity and Infrastructure Security Agency CISA encourages users and administrators to review Adobe Security Bulletin...

Authorization

SAP Solution Manager 7.2 User Experience Monitoring, version - 7.2, does not perform necessary authorization checks for an authenticated user. Due to inadequate access control, a network attacker authenticated as a regular user can use operations which should be restricted to administrators. Thes...

Authentication flaw

SAP NetWeaver AS JAVA P2P Cluster Communication, versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows arbitrary connections from processes because of missing authentication check, that are outside the cluster and even outside the network segment dedicated for the internal cluster communication. ...

CVE-2020-26830

SAP Solution Manager 7.2 User Experience Monitoring, version - 7.2, does not perform necessary authorization checks for an authenticated user. Due to inadequate access control, a network attacker authenticated as a regular user can use operations which should be restricted to administrators. Thes...

CVE-2020-7337

Incorrect Permission Assignment for Critical Resource vulnerability in McAfee VirusScan Enterprise VSE prior to 8.8 Patch 16 allows local administrators to bypass local security protection through VSE not correctly integrating with Windows Defender Application Control via careful manipulation of...

Mcafee McAfee VirusScan Enterprise Permission License and Access Control Issues Vulnerability

Mcafee VirusScan Enterprise VSE is a suite of antivirus software from the American company Mcafee. The software provides a full range of security protection, scans memory for malicious code and optimizes updates for remote systems. A security vulnerability exists in McAfee VirusScan Enterprise 8....

Microsoft Releases December 2020 Security Updates

Microsoft has released updates to address vulnerabilities in Microsoft software. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. The Cybersecurity and Infrastructure Security Agency CISA encourages users and administrators to review Microsoft’s...