September 8, 2020—KB4577049 (OS Build 10240.18696)

None None...

Microsoft .NET Core 安全漏洞

Microsoft.NET Core provides a fast, modular platform for creating server applications that run on Windows, Linux and macOS. A remote code execution vulnerability exists in Microsoft .NET Core. An attacker could exploit the vulnerability to execute code on the target server...

Microsoft Warns of Windows Win32k Privilege Escalation

Microsoft has released a security advisory to address an escalation of privileges vulnerability, CVE-2021-1732, in Microsoft Win32k. A local attacker can exploit this vulnerability to take control of an affected system. This vulnerability was detected in exploits in the wild. CISA encourages user...

Intel Graphics Drivers 缓冲区错误漏洞

Intel is an American company that develops CPUs and is the world's largest manufacturer of personal computer parts and CPUs. Multiple Intel® Server elevation of privilege vulnerability can be exploited by an attacker to escalate privileges via local access...

NoxPlayer Android Emulator Supply-Chain Attack

It seems to be the season of sophisticated supply-chain attacks. This one is in the NoxPlayer Android emulator: ESET says that based on evidence its researchers gathered, a threat actor compromised one of the companys official API api.bignox.com and file-hosting servers res06.bignox.com. Using th...

The vulnerability of Microsoft Word, Microsoft Office products, Microsoft Office Online Server, Microsoft Office Web Apps, Microsoft 365 Apps, Microsoft SharePoint Server, and Microsoft SharePoint Enterprise Server arises from insufficient input data validation, allowing attackers to execute arbitrary code.

The vulnerability of Microsoft Word, the Microsoft Office products, Microsoft Office Online Server, Microsoft Office Web Apps, Microsoft 365 Apps, Microsoft SharePoint Server, and Microsoft SharePoint Enterprise Server is related to insufficient validation of input data. Exploiting this...

Design/Logic Flaw

CMCAgent in NCR Command Center Agent 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter within an XML document sent to port 8089 that enables the remote, unauthenticated execution of an arbitrary command as SYSTEM, as exploited in the wild in 2020 and/or 2021. NOTE: th...

CVE-2021-3122

CVE-2021-3122 affects NCR Command Center Agent 16.3 on Aloha POS/BOH servers. The CMCAgent processes a runCommand parameter inside an XML document sent to port 8089, enabling remote unauthenticated execution of arbitrary commands as SYSTEM. Exploitation in the wild reported in 2020–2021. Vendor n...

CVE-2021-3122

CMCAgent in NCR Command Center Agent 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter within an XML document sent to port 8089 that enables the remote, unauthenticated execution of an arbitrary command as SYSTEM, as exploited in the wild in 2020 and/or 2021. NOTE: th...

Cybercriminals Now Using Plex Media Servers to Amplify DDoS Attacks

A new distributed denial-of-service attack DDoS vector has ensnared Plex Media Server systems to amplify malicious traffic against targets to take them offline. "Plex's startup processes unintentionally expose a Plex UPnP-enabled service registration responder to the general Internet, where it ca...

[SECURITY] Fedora 33 Update: monitorix-3.13.1-1.fc33

Monitorix is a free, open source and lightweight system monitoring tool designed to monitor as many services and system resources as possible. It h as been created to be used under production Linux/UNIX servers, but due to its simplicity and small size may also be used on embedded devices as well...

[SECURITY] Fedora 32 Update: monitorix-3.13.1-1.fc32

Monitorix is a free, open source and lightweight system monitoring tool designed to monitor as many services and system resources as possible. It h as been created to be used under production Linux/UNIX servers, but due to its simplicity and small size may also be used on embedded devices as well...

A directory traversal vulnerability exists in the Cesanta Mongoose server.

Cesanta Mongoose is a suite of embedded servers from Cesanta, Ireland. A directory traversal vulnerability exists in the Cesanta Mongoose server, which can be exploited by an attacker to obtain directory information...

A New Linux Malware Targeting High-Performance Computing Clusters

High-performance computing clusters belonging to university networks as well as servers associated with government agencies, endpoint security vendors, and internet service providers have been targeted by a newly discovered backdoor that gives attackers the ability to execute arbitrary commands o...

dnsmasq: multiple queries forwarded for the same name makes forging replies easier for an off-path attacker

A flaw was found in dnsmasq. When receiving a query, dnsmasq does not check for an existing pending request for the same name and forwards a new request. By default, a maximum of 150 pending queries can be sent to upstream servers, so there can be at most 150 queries for the same name. This flaw...

CVE-2021-21293

blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. All servers running blaze-core before version 0.14.15 are affected by a vulnerability in which unbounded connection acceptance leads to file handle exhaustion. Blaze, accepts connections unconditionally on a...

CVE-2019-25018

In the rcp client in MIT krb5-appl through 1.0.3, malicious servers could bypass intended access restrictions via the filename of . or an empty filename, similar to CVE-2018-20685 and CVE-2019-7282. The impact is modifying the permissions of the target directory on the client side. NOTE: MIT...

'/web-inf/' Information Disclosure Vulnerability (HTTP)

Various application or web servers / products are prone to an information disclosure vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

PT-2021-14395 · Unknown +1 · Blaze-Core +5

Name of the Vulnerable Software and Affected Versions: blaze-core versions prior to 0.14.15 http4s-blaze-server versions prior to 0.21.17 Description: The issue is caused by unbounded connection acceptance in blaze-core, leading to file handle exhaustion. This can amplify degradation in services...

Apache HTTP Server 1.2.2 - 1.3.24 / 2.0 - 2.0.36 DoS Vulnerability - Linux

Apache HTTP Server is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...