Survey of Supply Chain Attacks

The Atlantic Council has a released a report that looks at the history of computer supply chain attacks. Key trends from their summary: 1. Deep Impact from State Actors: There were at least 27 different state attacks against the software supply chain including from Russia, China, North Korea, and...

SUSE-SU-2020:2055-1 Security update for python-Django

This update for python-Django fixes the following issues: - Fixed potential XSS in admin ForeignKeyRawIdWidget bsc1172166, CVE-2020-13596...

Munkireport Software Update SQL Injection Vulnerability

Munkireport is a reporting tool for the Munki software management program.Software Update is one of the software update modules. An SQL injection vulnerability exists in the softwareupdatecontroller.php file in MunkiReport for Software Update versions prior to 1.6. The vulnerability can be...

PT-2020-14728 · Lua +1 · Lua +1

Name of the Vulnerable Software and Affected Versions: Lua versions prior to 5.4.1 Description: The issue is related to a segmentation fault in the changedline function in ldebug.c, which can be triggered when luaG traceexec is called. This occurs because the code incorrectly assumes that the old...

CVE-2020-7520

A CWE-601: URL Redirection to Untrusted Site 'Open Redirect' vulnerability exists in Schneider Electric Software Update SESU, V2.4.0 and prior, which could cause execution of malicious code on the victim's machine. In order to exploit this vulnerability, an attacker requires privileged access on...

CVE-2020-7520

A CWE-601: URL Redirection to Untrusted Site 'Open Redirect' vulnerability exists in Schneider Electric Software Update SESU, V2.4.0 and prior, which could cause execution of malicious code on the victim's machine. In order to exploit this vulnerability, an attacker requires privileged access on...

CVE-2020-7520

Schneider Electric Software Update (SESU)

CVE-2020-15887

A SQL injection vulnerability in softwareupdatecontroller.php in the Software Update module before 1.6 for MunkiReport allows attackers to execute arbitrary SQL commands via the last URL parameter of the /module/softwareupdate/gettabdata/ endpoint...

CVE-2020-15887

A SQL injection vulnerability in softwareupdatecontroller.php in the Software Update module before 1.6 for MunkiReport allows attackers to execute arbitrary SQL commands via the last URL parameter of the /module/softwareupdate/gettabdata/ endpoint...

CVE-2020-15887

A SQL injection vulnerability in softwareupdatecontroller.php in the Software Update module before 1.6 for MunkiReport allows attackers to execute arbitrary SQL commands via the last URL parameter of the /module/softwareupdate/gettabdata/ endpoint...

CVE-2020-15887

CVE-2020-15887 affects MunkiReport’s Software Update module (versions before 1.6). The vulnerability is a SQL injection in softwareupdate_controller.php, exploitable via the last URL parameter of the /module/softwareupdate/get_tab_data/ endpoint, allowing arbitrary SQL commands. The provided docu...

U.S. Dept Of Defense: Path traversal on https://███ allows arbitrary file read (CVE-2020-3452)

Summary: According to Cisco: A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and read sensitive files on a targete...

ALEA-2020:3054 new module: eclipse:rhel8

Eclipse is an integrated development environment IDE. This enhancement update adds the eclipse:rhel8 module to AlmaLinux The eclipse:rhel8 module provides Eclipse version 4.15, which is based on the Eclipse Foundation's 2020-03 release train. BZ1786637 For detailed information on changes in this...

PT-2020-14665 · Liferay · Liferay Dxp +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions prior to 7.3.0 Liferay DXP 7.0 versions prior to fix pack 90 Liferay DXP 7.1 versions prior to fix pack 17 Liferay DXP 7.2 versions prior to fix pack 5 Description: The issue allows man-in-the-middle attackers to execu...

OPENSUSE-SU-2020:0978-1 Security update for LibVNCServer

This update for LibVNCServer fixes the following issues: - CVE-2017-18922: Fixed an issue which could have allowed to an attacker to pre-auth overwrite a function pointer which subsequently used leading to potential remote code execution bsc1173477. This update was imported from the...

OPENSUSE-SU-2020:0976-1 Security update for openldap2

This update for openldap2 fixes the following issues: - CVE-2020-8023: Fixed a potential local privilege escalation from ldap to root when OPENLDAPCONFIGBACKEND='ldap' was used bsc1172698. - Changed DBCONFIG to root:ldap permissions bsc1172704. This update was imported from the SUSE:SLE-15:Update...

Security Advisory - Windows DNS Server Remote Code Execution Vulnerability

Microsoft's security update in July 2020 addresses the CVE-2020-1350 vulnerability. To exploit the vulnerability, an unauthenticated attacker could send specially crafted requests to a Windows DNS server. An attacker who successfully exploited the vulnerability could run arbitrary code remotely...

Cisco SD-WAN vManage Software XML External Entity Vulnerability

A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected system. The vulnerability is due to improper handling of XML External Entity XXE entries when parsing certain XML...

Cisco SD-WAN Solution Software Privilege Escalation Vulnerability

A vulnerability in Cisco SD-WAN Solution Software could allow an authenticated, local attacker to elevate privileges to Administrator on the underlying operating system. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted...

Cisco SD-WAN vManage Software Remote Code Execution Vulnerability

A vulnerability in Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to execute code with root privileges on an affected system. The vulnerability is due to insufficient input sanitization during user authentication processing. An attacker could exploit this vulnerabilit...