CVE-2020-6284

SAP NetWeaver Knowledge Management, versions - 7.30, 7.31, 7.40, 7.50, allows the automatic execution of script content in a stored file due to inadequate filtering with the accessing user's privileges. If the accessing user has administrative privileges, then the execution of the script content...

MSHTML Engine Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the way that the MSHTML engine improperly validates input. An attacker could execute arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the...

grub2: Crafted grub.cfg file can lead to arbitrary code execution during boot process

A flaw was found in grub2, prior to version 2.06. An attacker may use the GRUB 2 flaw to hijack and tamper the GRUB verification process. This flaw also allows the bypass of Secure Boot protections. In order to load an untrusted or modified kernel, an attacker would first need to establish access...

Adversarial use of current events as lures

By Nick Biasini. The goal of malicious activity is to compromise the system to install some unauthorized software. Increasingly that goal is tied to one thing: the user. Over the past several years, we as an industry improved exploit mitigation and the value of working exploits has increased...

Google Chrome WebView Security Bypass Vulnerability (CNVD-2020-49887)

Google Chrome is a Web browser from Google, and WebView is a Webkit-based control for displaying Web pages. A security vulnerability exists in WebView in Google Chrome versions prior to 84.0.4147.105. The vulnerability can be exploited by an attacker to compromise a system with the help of a...

Design/Logic Flaw

An issue was discovered in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD Indoor/Outdoor Mini IP Bullet Camera HD438. An attacker with physical access to the UART interface could access additional diagnostic and configuration functionalities as well as t...

CVE-2020-11623

An issue was discovered in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD Indoor/Outdoor Mini IP Bullet Camera HD438. An attacker with physical access to the UART interface could access additional diagnostic and configuration functionalities as well as t...

Microsoft Windows Kernel Buffer Overflow Vulnerability (CNVD-2020-45310)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation.Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. Windows Kernel is one of the Windows system kernels. A buffer error vulnerability exists i...

Microsoft Windows Kernel Information Disclosure Vulnerability (CNVD-2020-43109)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation.Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. An information disclosure vulnerability exists in the Microsoft Windows Kernel, which aris...

CVE-2020-14705

Vulnerability in the Oracle GoldenGate product of Oracle GoldenGate component: Process Management. The supported version that is affected is Prior to 19.1.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the...

CVE-2020-14677

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Orac...

New Highly-Critical SAP Bug Could Let Attackers Take Over Corporate Servers

SAP has patched a critical vulnerability impacting the LM Configuration Wizard component in NetWeaver Application Server AS Java platform, allowing an unauthenticated attacker to take control of SAP applications. The bug, dubbed RECON and tracked as CVE-2020-6287, is rated with a maximum CVSS sco...

Windows Agent Activation Runtime Information Disclosure Vulnerability

An information disclosure vulnerability exists when the Windows Agent Activation Runtime AarSvc fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system. To exploit this vulnerability, an...

Security Update for Microsoft Visual Studio Code (CVE-2020-1416)

The version of Microsoft Visual Studio Code installed on the remote Windows host is prior to 1.47.1. It is, therefore, affected by the following vulnerability: - An elevation of privilege vulnerability exists in Visual Studio and Visual Studio Code when they load software dependencies. A local...

U.S. Dept Of Defense: SharePoint Web Services Exposed to Anonymous Access

Summary: Any unauthenticated/anonymous users are able to access the SharePoint Web Services .wsdl files for the ██████████ website. Description: The SharePoint installation for this particular site allows any user to access the spdisco.aspx on the web server which discloses the location of of all...

Microsoft SMBv3 Information Disclosure Vulnerability

Microsoft SMBv3 is a support firmware from Microsoft USA that provides SMB functionality for devices. An information leakage vulnerability exists in the way certain requests are handled in the Microsoft SMBv3 version 3.1.1 protocol. An attacker could exploit this vulnerability by tricking a user...

Microsoft Internet Explorer Information Disclosure Vulnerability (CNVD-2021-24960)

Microsoft Internet Explorer IE is a Web browser that comes with the Windows operating system from the American company Microsoft. An information disclosure vulnerability exists in Microsoft Internet Explorer versions 9 and 11, which arises from the program not properly handling objects in memory...

Microsoft Windows Error Reporting Information Disclosure Vulnerability (CNVD-2021-27708)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation.Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. Windows Error Reporting WER is one of the error reporting components. An information...

Microsoft Windows Information Disclosure Vulnerability (CNVD-2021-27709)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation.Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. An information disclosure vulnerability exists in Microsoft Windows, which arises when a...

Media Foundation Information Disclosure Vulnerability

An information disclosure vulnerability exists when Media Foundation improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system. To exploit this vulnerability, an attacker would have to log onto ...