October 13, 2020—KB4580345 (Monthly Rollup)

None None...

Server side request forgery (ssrf)

An SSRF issue was discovered in Zoho Application Control Plus before version 10.0.511. The mail gateway configuration feature allows an attacker to perform a scan in order to discover open ports on a machine as well as available machines on the network segment on which the instance of the product...

CVE-2020-15594: Server-Side Request Forgery (SSRF)

An SSRF issue was discovered in Zoho Application Control Plus before version 10.0.511. The mail gateway configuration feature allows an attacker to perform a scan in order to discover open ports on a machine as well as available machines on the network segment on which the instance of the product...

PT-2020-22033

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type of "Use-of-uninitialized-value". The crash state includes functions such as gs scan token, interp, and gs call interp...

PT-2020-22015

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type of "Use-of-uninitialized-value". The crash state involves functions such as gs scan token, tokenexec continue, and...

PT-2020-22025

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type of "Use-of-uninitialized-value". The crash state involves functions such as s A85D process, gs scan token, and interp...

Ubuntu 16.04 LTS : Gnuplot vulnerabilities (USN-4541-1)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4541-1 advisory. Tim Blazytko, Cornelius Aschermann, Sergej Schumilo and Nils Bars discovered that Gnuplot did not properly validate string sizes in the...

Unimap - Scan Only Once By IP Address And Reduce Scan Times With Nmap For Large Amounts Of Data

Scan only once by IP address and reduce scan times with Nmap for large amounts of data. Unimap is an abbreviation of "Unique Nmap Scan ". The tool can run in Linux, OSX, Windows or Android Termux without problems. Why? If you have plans to run an Nmap to a whole organization you need to consideer...

php: Heap buffer over-read in exif_scan_thumbnail()

When PHP EXIF extension is parsing EXIF information from an image, e.g. via exifreaddata function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information...

September 8, 2020—KB4577053 (Security-only update)

None None...

PT-2020-21275

Name of the Vulnerable Software and Affected Versions smartsearchwp versions all Description The issue concerns malicious code intended to steal credentials from websites by traversing DOM elements to find fields such as username and password and uploading them to a remote server. It also has the...

devel_core (>=0.0.1, <=0.0.8) potentially affected by unknown CVE via requets (0.0.1-security)

requets NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on requets and may be impacted: - develcore =0.0.1, =0.0.8 Source cves: unknown CVE Source advisory: OSV:GHSA-F3PC-C2GF-HVGW...

Apple’s notarization process fails to protect

In macOS Mojave, Apple introduced the concept of notarization, a process that developers can go through to ensure that their software is malware-free and must go through for their software to run on macOS Catalina. This is meant to be another layer in Apples protection against malware...

Scan-For-Webcams - Scan For Webcams In The Internet

Automatically scan for publically accessible webcams around the internet Usage python MJPG.py : for public MJPG streamers around the internet python webcamXP.py : for public webcamXP streamers around the internet The program will output a list of links with the format of ipaddress:port If your...

3architecture (>=1.0.0, <=1.7.0), @1amageek/tradable (0.9.0) +1596 more potentially affected by CVE-2020-7768 via grpc (>=1.0.0, <=1.24.3)

grpc NPM version =1.0.0, =1.0.0, =1.0.24, =0.0.2, =1.1.6, =0.0.1, =0.1.0, =1.2.1, =0.0.0-7, =1.0.0, =1.1.0 - @ampretia/composer-opus 0.2.0 - @andregarvin/cuneiform 0.0.1 and more Source cves: CVE-2020-7768 Source advisory: SNYK:JS-GRPC-598671...

GHSA-9M4X-8W29-R78G Server-Side Request Forgery in @uppy/companion

The @uppy/companion npm package before versions 1.13.2 and 2.0.0-alpha.5 is vulnerable to a Server-Side Request Forgery SSRF vulnerability, which allows an attacker to scan local or external networks or otherwise interact with internal systems...

August 11, 2020—KB4571730 (Monthly Rollup)

None None...

Security and Quality Rollup for .NET Framework 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows 7 SP1 and Windows Server 2008 R2 SP1 (KB4570506)

Security and Quality Rollup for .NET Framework 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows 7 SP1 and Windows Server 2008 R2 SP1 KB4570506 Applies to: Microsoft .NET Framework 3.5.1 Microsoft .NET Framework 4.5.2 Microsoft .NET Framework 4.6 Microsoft .NET Framework 4.6.1...

CVE-2020-14296: Server-Side Request Forgery (SSRF)

Red Hat CloudForms 4.7 and 5 was vulnerable to Server-Side Request Forgery SSRF flaw. With the access to add Ansible Tower provider, an attacker could scan and attack systems from the internal network which are not normally accessible...

PT-2020-3571

Name of the Vulnerable Software and Affected Versions Red Hat CloudForms versions 4.7 through 5 Description The issue is related to a Server-Side Request Forgery SSRF flaw. It allows an attacker, with access to add an Ansible Tower provider, to scan and attack systems from the internal network th...