The vulnerability in the web-based administration interface of the PAN-OS operating system allows a hacker to gain access to the device.

The vulnerability of the PAN-OS operating system’s administrative web interface is related to deficiencies in the authentication process. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to the device...

CVE-2020-3125

A vulnerability in the Kerberos authentication feature of Cisco Adaptive Security Appliance ASA Software could allow an unauthenticated, remote attacker to impersonate the Kerberos key distribution center KDC and bypass authentication on an affected device that is configured to perform Kerberos...

File Explorer v1.4 iOS - Multiple Persistent Vulnerabilities

Document Title: =============== File Explorer v1.4 iOS - Multiple Persistent Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2219 Release Date: ============= 2020-05-03 Vulnerability Laboratory ID VL-ID:...

EulerOS Virtualization for ARM 64 3.0.2.0 : glusterfs (EulerOS-SA-2020-1525)

According to the versions of the glusterfs packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - A flaw was found in RPC request using gfs3renamereq in glusterfs server. An authenticated attacker could use this...

Security Bulletin: Sensitive Information Disclosed in Logs (CVE-2019-4286)

Summary IBM Maximo Anywhere discloses sensitive information such as usernames, passwords, session token and other cookies in device/console logs. Vulnerability Details CVEID: CVE-2019-4286 DESCRIPTION: IBM Maximo Anywhere could disclose highly senstiive user information to an authenticated user...

Multiple NETGEAR Products Trust Management Issue Vulnerability (CNVD-2020-27207)

NETGEAR D6200 and others are products of NETGEAR Corporation.NETGEAR D6200 is a wireless modem.NETGEAR WNR2020 is a wireless router.NETGEAR PR2000 is a wireless router.NETGEAR WNR2020 is a wireless router.NETGEAR WNR2020 is a wireless router.NETGEAR WNR2020 is a wireless router.NETGEAR WNR2020 is...

Microsoft YourPhone Application for Android Authentication Bypass Vulnerability

An authentication bypass vulnerability exists in Microsoft YourPhoneCompanion application for Android, in the way the application processes notifications generated by work profiles. This could allow an unauthenticated attacker to view notifications. This requires an attacker to have access to the...

CVE-2020-1842

Huawei HEGE-560 version 1.0.1.20SP2; OSCA-550 and OSCA-550A version 1.0.0.71SP1; and OSCA-550AX and OSCA-550X version 1.0.0.71SP2 have an insufficient authentication vulnerability. An attacker can access the device physically and perform specific operations to exploit this vulnerability. Successf...

Zero Trust Access: Santa Claus Wasn't the Only One Working Christmas Eve

The days from Christmas Eve to New Year's Day are filled with celebrations. Many companies shut down and encourage their employees to take vacations. However, a sample of data comparing an average work week around the holiday, shows the idea of "downtime" isn't exactly accurate. In fact, many use...

The vulnerability of the Norton App Lock tool, related to insecure management of privileges, allows a violator to gain unauthorized access to the device.

The vulnerability of the Norton App Lock utility is related to insecure management of privileges. Exploiting this vulnerability could allow a malicious individual to gain unauthorized access to the device...

DEBIAN-CVE-2019-19332

An out-of-bounds memory write issue was found in the Linux Kernel, version 3.13 through 5.4, in the way the Linux kernel's KVM hypervisor handled the 'KVMGETEMULATEDCPUID' ioctl2 request to get CPUID features emulated by the KVM hypervisor. A user or process able to access the '/dev/kvm' device...

CVE-2019-19579

An issue was discovered in Xen through 4.12.x allowing attackers to gain host OS privileges via DMA in a situation where an untrusted domain has access to a physical device and assignable-add is not used, because of an incomplete fix for CVE-2019-18424. XSA-302 relies on the use of libxl's...

ALPINE-CVE-2019-19579

An issue was discovered in Xen through 4.12.x allowing attackers to gain host OS privileges via DMA in a situation where an untrusted domain has access to a physical device and assignable-add is not used, because of an incomplete fix for CVE-2019-18424. XSA-302 relies on the use of libxl's...

Two-Factor Authentication Bypass

wagtail-2fa is vulnerable 2fa bypass. An attacker with knowledge of another user's Wagtail login credentials is able to bypass the 2FA verification by modifying the URL, and subsequently add a new device and gain full access to the CMS...

CVE-2019-6665

On BIG-IP ASM 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, and 13.1.0-13.1.3.1, BIG-IQ 6.0.0 and 5.2.0-5.4.0, iWorkflow 2.3.0, and Enterprise Manager 3.1.1, an attacker with access to the device communication between the BIG-IP ASM Central Policy Builder and the BIG-IQ/Enterprise Manager/F5...

CVE-2019-18675

The Linux kernel through 5.3.13 has a startoffset+size Integer Overflow in cpia2remapbuffer in drivers/media/usb/cpia2/cpia2core.c because cpia2 has its own mmap implementation. This allows local users with /dev/video0 access to obtain read and write permissions on kernel physical pages, which ca...

Design/Logic Flaw

The Lava Z61 Android device with a build fingerprint of LAVA/Z612GB/Z612GB:8.1.0/O11019/1533889281:user/release-keys contains a pre-installed app with a package name of com.android.lava.powersave app versionCode=400, versionName=v4.0.27 that allows any app co-located on the device to...

UBUNTU-CVE-2019-18683

An issue was discovered in drivers/media/platform/vivid in the Linux kernel through 5.3.8. It is exploitable for privilege escalation on some Linux distributions where local users have /dev/video0 access, but only if the driver happens to be loaded. There are multiple race conditions during...

Advantech WISE-PaaS/RMM Unauthorized Access Vulnerability

Advantech WISE-PaaS/RMM is a remote monitoring and management platform for IoT devices. An unauthorized access vulnerability exists in Advantech WISE-PaaS/RMM, which can be exploited by an attacker to submit a special request for unauthorized access to a device...

Improve security with a Zero Trust access model

Zero Trust is a security model that I believe can begin to turn the tide in the cybersecurity battles. Traditional perimeter-based network security has proved insufficient because it assumes that if a user is inside the corporate perimeter, they can be trusted. We’ve learned that this isn't true...