Security Bulletin: Vulnerability in Docker affects Cloud Pak Sytem (CVE-2020-13401)

Summary Vulnerability identified within Docker shipped as pType component with Cloud Pak System Software. IBM Cloud Pak System Software addressed this vulnerability. Vulnerability Details CVEID: CVE-2020-13401 DESCRIPTION: Docker Docker CE is vulnerable to a man-in-the-middle attack, caused by...

Apache Calcite Clickjacking Vulnerability

Apache Calcite is a dynamic data management framework that has many of the features of a typical database management system, such as SQL parsing, SQL validation, SQL query optimization, SQL generation, and data connection queries. clickjacking vulnerability exists in versions of Apache Calcite...

CVE-2020-15589

A design issue was discovered in GetInternetRequestHandle, InternetSendRequestEx and InternetSendRequestByBitrate in the client side of Zoho ManageEngine Desktop Central 10.0.552.W and Remote Access Plus before 10.1.2119.1. By exploiting this issue, an attacker-controlled server can force the...

Remote code execution

A design issue was discovered in GetInternetRequestHandle, InternetSendRequestEx and InternetSendRequestByBitrate in the client side of Zoho ManageEngine Desktop Central 10.0.552.W and Remote Access Plus before 10.1.2119.1. By exploiting this issue, an attacker-controlled server can force the...

CVE-2020-15589

A design issue was discovered in GetInternetRequestHandle, InternetSendRequestEx and InternetSendRequestByBitrate in the client side of Zoho ManageEngine Desktop Central 10.0.552.W and Remote Access Plus before 10.1.2119.1. By exploiting this issue, an attacker-controlled server can force the...

CVE-2020-15589

The CVE-2020-15589 entry affects Zoho ManageEngine Desktop Central (client side) 10.0.552.W and Remote Access Plus prior to 10.1.2119.1. A design issue in GetInternetRequestHandle, InternetSendRequestEx and InternetSendRequestByBitrate can be abused by an attacker-controlled server to force the c...

EulerOS 2.0 SP3 : mutt (EulerOS-SA-2020-2109)

According to the versions of the mutt package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Mutt before 1.14.3 allows an IMAP fcc/postpone man-in-the-middle attack via a PREAUTH response.CVE-2020-14093 - Mutt before 1.14.4 and NeoMutt befo...

CVE-2016-11086

lib/oauth/consumer.rb in the oauth-ruby gem through 0.5.4 for Ruby does not verify server X.509 certificates if a certificate bundle cannot be found, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information...

Arbitrary Code Execution

github.com/helm/helm is vulnerable to arbitrary code execution. Duplicate plugin entries allows an attacker to compromise a plugin's install hooks, via a man-in-the-middle attack, and possibly execute arbitrary code on the host OS...

Input validation

Improper certificate validation for certain connections in the Bosch Smart Home System App for iOS prior to version 9.17.1 potentially allows to intercept video contents by performing a man-in-the-middle attack...

CVE-2020-6781

CVE-2020-6781 affects the Bosch Smart Home System App for iOS prior to version 9.17.1, where improper certificate validation in certain connections could allow an attacker to perform a man-in-the-middle attack and intercept video contents. Root cause: insufficient validation of TLS certificates i...

PT-2020-19224

Name of the Vulnerable Software and Affected Versions Bosch Smart Home System App for iOS versions prior to 9.17.1 Description The issue concerns improper certificate validation for certain connections, potentially allowing interception of video contents through a man-in-the-middle attack...

CVE-2020-6781: Improper Certificate Validation

Improper certificate validation for certain connections in the Bosch Smart Home System App for iOS prior to version 9.17.1 potentially allows to intercept video contents by performing a man-in-the-middle attack...

Privilege escalation

An elevation of privilege vulnerability exists when Microsoft Windows processes group policy updates. An attacker who successfully exploited this vulnerability could potentially escalate permissions or perform additional privileged actions on the target machine. To exploit this vulnerability, an...

CVE-2020-15802

CVE-2020-15802 concerns Bluetooth Cross-Transport Key Derivation (BLURtooth) affecting devices that support Bluetooth before 5.1. The root cause is Cross Transport Key Derivation in Bluetooth Core Specification v4.2/v5.0, which may permit an unauthenticated user to establish bonding on one transp...

CVE-2020-1013: Undefined Security Weakness

An elevation of privilege vulnerability exists when Microsoft Windows processes group policy updates. An attacker who successfully exploited this vulnerability could potentially escalate permissions or perform additional privileged actions on the target machine. To exploit this vulnerability, an...

CVE-2020-1596: Use of a Broken or Risky Cryptographic Algorithm

A information disclosure vulnerability exists when TLS components use weak hash algorithms. An attacker who successfully exploited this vulnerability could obtain information to further compromise a users's encrypted transmission channel. To exploit the vulnerability, an attacker would have to...

New Unpatched Bluetooth Flaw Lets Hackers Easily Target Nearby Devices

Bluetooth SIG—an organization that oversees the development of Bluetooth standards—today issued a statement informing users and vendors of a newly reported unpatched vulnerability that potentially affects hundreds of millions of devices worldwide. Discovered independently by two separate teams of...

Security Bulletin: A vulnerability in IBM Java SDK affects Rational Software Architect for WebSphere Software (CVE-2014-4263)

Summary The JSSE component's Diffie-Hellman key exchange implementation is vulnerable to a man-in-the-middle attack. The fix adds a new check to prevent the attack. Vulnerability Details | Subscribe to My Notifications to be notified of important product support alerts like this. Follow this link...

Microsoft Windows/Windows Server Elevation of Privilege Vulnerability (CNVD-2021-68748)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation USA, Microsoft Windows is an operating system for personal devices, and Microsoft Windows Server is a server operating system. Microsoft Windows/Windows Server has an elevation of privilege vulnerability whe...