CVE-2020-13359

The Terraform API in GitLab CE/EE 12.10+ exposed the object storage signed URL on the delete operation allowing a malicious project maintainer to overwrite the Terraform state, bypassing audit and other business controls. Affected versions are =12.10, =13.4, =13.5, 13.5.2...

CVE-2020-13359

The Terraform API in GitLab CE/EE 12.10+ exposed the object storage signed URL on the delete operation allowing a malicious project maintainer to overwrite the Terraform state, bypassing audit and other business controls. Affected versions are =12.10, =13.4, =13.5, 13.5.2...

CVE-2020-13359

Removed by vendor...

CVE-2020-3482

A vulnerability in the Traversal Using Relays around NAT TURN server component of Cisco Expressway software could allow an unauthenticated, remote attacker to bypass security controls and send network traffic to restricted destinations. The vulnerability is due to improper validation of specific...

CVE-2020-16022

Insufficient policy enforcement in networking in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially bypass firewall controls via a crafted HTML page...

CVE-2020-3482 Cisco Expressway Software Unauthorized Access Information Disclosure Vulnerability

A vulnerability in the Traversal Using Relays around NAT TURN server component of Cisco Expressway software could allow an unauthenticated, remote attacker to bypass security controls and send network traffic to restricted destinations. The vulnerability is due to improper validation of specific...

Zoom Takes on Zoom-Bombers Following FTC Settlement

Zoom has once again upped its security controls to prevent “Zoom-bombing” and other cyberattacks on meetings. The news comes less than a week after Zoom settled with the Federal Trade Commission over false encryption claims. Two of the new features allow moderators to act as “club bouncers,” givi...

Johnson Controls Sensormatic Electronics American Dynamics victor Web Client

1. EXECUTIVE SUMMARY CVSS v3 7.1 ATTENTION: Exploitable remotely Vendor: Sensormatic Electronics, LLC; a subsidiary of Johnson Controls Equipment: American Dynamics victor Web Client, Software House C•CURE Web Client Vulnerability: Improper Authorization 2. RISK EVALUATION Successful exploitation...

Saia Burgess Controls PCD Controller Hard-coded Password Vulnerability

OVERVIEW Independent researcher Artyom Kurbatov has identified a hard-coded password vulnerability in Saia Burgess Controls’s family of PCD controllers. Saia Burgess Controls has produced a new firmware version to mitigate this vulnerability. Artyom Kurbatov has tested the new firmware version to...

CVE-2020-12331

Improper access controls in Intel UniteR Cloud Service client before version 4.2.12212 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2020-12331

Intel Unite Cloud Service client vulnerability CVE-2020-12331 involves improper access controls that may allow an authenticated user to escalate privileges via local access in client versions prior to 4.2.12212. Multiple connected sources corroborate the issue and identify the affected product as...

BD Alaris 8015 PC Unit and BD Alaris Systems Manager

1. EXECUTIVE SUMMARY CVSS v3 6.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Becton, Dickinson and Company BD Equipment: BD Alaris 8015 PC Unit and BD Alaris Systems Manager Vulnerability: Improper Authentication 2. RISK EVALUATION Successful exploitation of this...

Intel Unite® Cloud Service Client Advisory

Summary: A potential security vulnerability in the Intel Unite® Cloud Service client may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details CVEID: CVE-2020-12331 Description: Improper access controls in Intel UniteR...

PT-2020-4607 · Microsoft · Windows Update Medic Service +1

Name of the Vulnerable Software and Affected Versions: Windows Update Medic Service affected versions not specified Description: The issue is related to insufficient access restrictions in the Windows Update Medic Service component of the Windows operating system. This can be exploited to allow a...

OpenSSL < 0.9.2b Session Reuse / ACL Bypass Vulnerability

OpenSSL allow remote attackers to reuse SSL sessions and bypass access controls. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This progra...

CloudBees Jenkins Ansible Privilege Permission and Access Control Issues Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . Jenkins Ansible plug-in 1.0 a...

How to Use Apple, Google, and Microsoft's Parental Controls

Each of the big three offers a wealth of options to limit screen time, find lost devices, and more...

CVE-2020-3600

A vulnerability in Cisco SD-WAN Software could allow an authenticated, local attacker to elevate privileges to root on the underlying operating system. The vulnerability is due to insufficient security controls on the CLI. An attacker could exploit this vulnerability by using an affected CLI...

Security feature bypass

A vulnerability in Cisco SD-WAN Software could allow an authenticated, local attacker to elevate privileges to root on the underlying operating system. The vulnerability is due to insufficient security controls on the CLI. An attacker could exploit this vulnerability by using an affected CLI...

CVE-2020-3600 Cisco SD-WAN Software Privilege Escalation Vulnerability

A vulnerability in Cisco SD-WAN Software could allow an authenticated, local attacker to elevate privileges to root on the underlying operating system. The vulnerability is due to insufficient security controls on the CLI. An attacker could exploit this vulnerability by using an affected CLI...