CVE-2020-7565

A CWE-326: Inadequate Encryption Strength vulnerability exists in Modicon M221 all references, all versions that could allow the attacker to break the encryption key when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller...

CVE-2020-7565

A CWE-326: Inadequate Encryption Strength vulnerability exists in Modicon M221 all references, all versions that could allow the attacker to break the encryption key when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller...

Schneider Electric Modicon M221 Information Disclosure Vulnerability

The Schneider Electric Modicon M221 is a programmable logic controller from Schneider Electric, France. The Modicon M221 suffers from an information disclosure vulnerability that originates from the presence of a sensitive information exposure to an unauthorized Actor vulnerability that can be...

Schneider Electric Modicon M221 Security Breach

The Schneider Electric Modicon M221 is a programmable logic controller from Schneider Electric, France. The Modicon M221 suffers from a security vulnerability that stems from a sensitive data vulnerability encryption gap that can be exploited by an attacker to find a password hash after capturing...

Intel(R) Processors Elevation of Privilege Vulnerability

Intel Microprocessors are microprocessor CPU products from the American company Intel. Intel Processors suffers from an elevation of privilege vulnerability that stems from the fact that the use of potentially dangerous functionality in the Intel BIOS platform sample code could allow an...

Zunyi Xintengda Information Technology Co., Ltd. Bole Card Issuing System Basic Edition Arbitrary File Upload Vulnerability

Zunyi Xintengda Information Technology Co., Ltd. is a professional e-commerce operation and network marketing services company. Zunyi Xintengda Information Technology Co., Ltd. Bole hair card system basic version of arbitrary file upload vulnerability, an attacker can use the vulnerability on the...

PT-2020-6348

Name of the Vulnerable Software and Affected Versions Modicon M221 all versions Modicon M100 affected versions not specified Modicon M200 affected versions not specified Description A CWE-326: Inadequate Encryption Strength issue exists that could allow an attacker to break the encryption key whe...

gnome-software and fwupd security, bug fix, and enhancement update

appstream-data 8-20200724 - Regenerate the RHEL metadata to include the EPEL apps too - Resolves: 1844488 8-20200630 - Regenerate the RHEL metadata - Resolves: 1844488 fwupd 1.4.2-4.0.1 - Build with the updated Oracle certificate - Use oraclesecureboot301 as certdir Orabug: 29881368 - Use new...

CVE-2020-28196

MIT Kerberos 5 aka krb5 before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1encode.c support for BER indefinite lengths lacks a recursion limit...

squid: Out of bounds read in Proxy-Authorization header causes DoS

An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7. When Squid is configured to use Basic Authentication, the Proxy-Authorization header is parsed via uudecode. uudecode determines how many bytes will be decoded by iterating over the input and checki...

CVE-2020-19672

Niushop B2B2C Multi-business basic version V1.11, can bypass the administrator to obtain the background upload interface, through parameter upload, bypass the getimagesize function, upload php file, getshell...

CVE-2020-19670

Technical details are not publicly available in the provided connected documents for CVE-2020-19670 (Niushop 1.11 authentication bypass). Monitor for updates; no concrete root-cause, affected components, or remediation details are present in the supplied sources.

Apache Atlas Cross-Site Scripting Vulnerability (CNVD-2020-52613)

Apache Atlas is a scalable set of core infrastructure governance services that enable organizations to efficiently meet compliance requirements in Hadoop and allow integration with the entire enterprise data ecosystem. A cross-site scripting vulnerability exists in the basic search functionality ...

Zeppelin Ransomware Returns with New Trojan on Board

The Zeppelin ransomware has sailed back into relevance, after a hiatus of several months. A wave of attacks were spotted in August by Juniper Threatlab researchers, making use of a new trojan downloader. These, like an initial Zeppelin wave observed in late 2019, start with phishing emails with...

basic-read-config (>=1.0.2, <=1.0.3), blockchain-profile (>=0.1.0, <=0.3.2) +8 more potentially affected by unknown CVE via merge-objects (1.0.5)

merge-objects NPM version 1.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on merge-objects and may be impacted: - basic-read-config =1.0.2, =0.1.0, =0.0.5, =0.3.0, =0.0.1, =1.1.4, =1.4.0, =0.1.0, =0.0.1, =0.5.3 Source cves: unknown CVE Source...

Revamped Qbot Trojan Packs New Punch: Hijacks Email Threads

Attacks attributed to the Qbot trojan, known as the “Swiss Army knife” of malware, are on the uptick with a reported 100,000 recent infections, according to researchers. Qbot, an ever-evolving information-stealing trojan that’s been around since 2008, has shifted tactics again and adopted a bevy ...

Server secret was included in static assets and served to clients

Impact Server JWT signing secret was included in static assets and served to clients. This ALLOWS Flood's builtin authentication to be bypassed. Given Flood is granted access to rTorrent's SCGI interface which is unprotected and ALLOWS arbitrary code execution and usually wide-ranging privileges ...

CVE-2020-5922

In BIG-IP versions 15.0.0-15.1.0.4, 14.1.0-14.1.2.6, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2, iControl REST does not implement Cross Site Request Forgery protections for users which make use of Basic Authentication in a web browser...

CVE-2020-5922

In BIG-IP versions 15.0.0-15.1.0.4, 14.1.0-14.1.2.6, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2, iControl REST does not implement Cross Site Request Forgery protections for users which make use of Basic Authentication in a web browser...

Cross site scripting

In BIG-IP versions 15.0.0-15.1.0.4, 14.1.0-14.1.2.6, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2, iControl REST does not implement Cross Site Request Forgery protections for users which make use of Basic Authentication in a web browser...