PT-2020-6369

Name of the Vulnerable Software and Affected Versions Modicon M221 versions all Modicon M100 affected versions not specified Modicon M200 affected versions not specified Description The issue is related to the exposure of sensitive information. It could allow a remote attacker to gain unauthorize...

gnome-software and fwupd security, bug fix, and enhancement update

appstream-data 8-20200724 - Regenerate the RHEL metadata to include the EPEL apps too - Resolves: 1844488 8-20200630 - Regenerate the RHEL metadata - Resolves: 1844488 fwupd 1.4.2-4.0.1 - Build with the updated Oracle certificate - Use oraclesecureboot301 as certdir Orabug: 29881368 - Use new...

CVE-2020-28196

MIT Kerberos 5 aka krb5 before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1encode.c support for BER indefinite lengths lacks a recursion limit...

squid: Out of bounds read in Proxy-Authorization header causes DoS

An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7. When Squid is configured to use Basic Authentication, the Proxy-Authorization header is parsed via uudecode. uudecode determines how many bytes will be decoded by iterating over the input and checki...

envoy:network_readfilter_fuzz_test: Bad-cast to std::__1::basic_filebuf<char, std::__1::char_traits<char>> from invalid vptr in std::__1::basic_ifstream<char, std::__1::char_traits<char> >::basic_ifstream

Project: https://github.com/envoyproxy/envoy.git Detailed Report: https://oss-fuzz.com/testcase?key=6564648574517248 Project: envoy Fuzzing Engine: libFuzzer Fuzz Target: networkreadfilterfuzztest Job Type: libfuzzerubsanenvoy Platform Id: linux Crash Type: Bad-cast Crash Address: 0x7ffc1be403b0...

PT-2020-22043

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap buffer overflow read issue is identified, potentially causing a crash. The crash occurs in the asn1 get next function, which is called by x509 parse...

PT-2020-22048

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-buffer-overflow read error. The crash state indicates involvement of the x509 parse ext basic constraints, x509 parse...

CVE-2020-19672

Niushop B2B2C Multi-business basic version V1.11, can bypass the administrator to obtain the background upload interface, through parameter upload, bypass the getimagesize function, upload php file, getshell...

CVE-2020-19670

Technical details are not publicly available in the provided connected documents for CVE-2020-19670 (Niushop 1.11 authentication bypass). Monitor for updates; no concrete root-cause, affected components, or remediation details are present in the supplied sources.

PT-2020-15200

Name of the Vulnerable Software and Affected Versions Niushop B2B2C Multi-business basic version V1.11 Description The issue allows an attacker to bypass administrator access and obtain the background upload interface. By manipulating the upload parameter, it is possible to bypass the getimagesiz...

PT-2020-15199

Name of the Vulnerable Software and Affected Versions Niushop B2B2C Multi-Business Basic Edition version V1.11 Description The issue allows authentication to be bypassed, enabling administrators to reset any passwords without proper authorization. Recommendations For Niushop B2B2C Multi-Business...

CVE-2020-19670: Missing Authentication for Critical Function

In Niushop B2B2C Multi-Business Basic Edition V1.11, authentication can be bypassed, causing administrators to reset any passwords...

PT-2020-22005

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions. Description A heap-buffer-overflow read issue is reported, potentially causing a crash. The crash details indicate an issue with fmt::v6::basic string view and...

Apache Atlas Cross-Site Scripting Vulnerability (CNVD-2020-52613)

Apache Atlas is a scalable set of core infrastructure governance services that enable organizations to efficiently meet compliance requirements in Hadoop and allow integration with the entire enterprise data ecosystem. A cross-site scripting vulnerability exists in the basic search functionality ...

Zeppelin Ransomware Returns with New Trojan on Board

The Zeppelin ransomware has sailed back into relevance, after a hiatus of several months. A wave of attacks were spotted in August by Juniper Threatlab researchers, making use of a new trojan downloader. These, like an initial Zeppelin wave observed in late 2019, start with phishing emails with...

basic-read-config (>=1.0.2, <=1.0.3), blockchain-profile (>=0.1.0, <=0.3.2) +8 more potentially affected by unknown CVE via merge-objects (1.0.5)

merge-objects NPM version 1.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on merge-objects and may be impacted: - basic-read-config =1.0.2, =0.1.0, =0.0.5, =0.3.0, =0.0.1, =1.1.4, =1.4.0, =0.1.0, =0.0.1, =0.5.3 Source cves: unknown CVE Source...

Revamped Qbot Trojan Packs New Punch: Hijacks Email Threads

Attacks attributed to the Qbot trojan, known as the “Swiss Army knife” of malware, are on the uptick with a reported 100,000 recent infections, according to researchers. Qbot, an ever-evolving information-stealing trojan that’s been around since 2008, has shifted tactics again and adopted a bevy ...

Server secret was included in static assets and served to clients

Impact Server JWT signing secret was included in static assets and served to clients. This ALLOWS Flood's builtin authentication to be bypassed. Given Flood is granted access to rTorrent's SCGI interface which is unprotected and ALLOWS arbitrary code execution and usually wide-ranging privileges ...

CVE-2020-5922

In BIG-IP versions 15.0.0-15.1.0.4, 14.1.0-14.1.2.6, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2, iControl REST does not implement Cross Site Request Forgery protections for users which make use of Basic Authentication in a web browser...

CVE-2020-5922

In BIG-IP versions 15.0.0-15.1.0.4, 14.1.0-14.1.2.6, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.2, iControl REST does not implement Cross Site Request Forgery protections for users which make use of Basic Authentication in a web browser...