CVE-2021-34682

Receita Federal IRPF 2021 1.7 allows a man-in-the-middle attack against the update feature...

Design/Logic Flaw

Receita Federal IRPF 2021 1.7 allows a man-in-the-middle attack against the update feature...

CVE-2021-34682

CVE-2021-34682 refers to the Receita Federal IRPF 2021 v1.7, where the update feature is susceptible to a man-in-the-middle attack due to a lack of proper authentication. The vulnerability concerns the update mechanism itself and is described consistently across multiple sources (NVD/CNVD/Red Hat...

CVE-2021-34682

Receita Federal IRPF 2021 1.7 allows a man-in-the-middle attack against the update feature...

PT-2021-20641

Name of the Vulnerable Software and Affected Versions: Receita Federal IRPF 2021 version 1.7 Description: The issue allows a man-in-the-middle attack against the update feature. Recommendations: For version 1.7, consider restricting access to the update feature until a patch is available. At the...

CVE-2021-34682: Undefined Security Weakness

Receita Federal IRPF 2021 1.7 allows a man-in-the-middle attack against the update feature...

Raining SYSTEM Shells with Citrix Workspace app

TL;DR Citrix Workspace is vulnerable to a remote command execution attack running under the context of the SYSTEM account. By sending a crafted message over a named pipe and spoofing the client process ID, the Citrix Workspace Updater Service can be tricked into executing an arbitrary process und...

CVE-2020-3342 Cisco Webex Meetings Desktop App for Mac Update Feature Code Execution Vulnerability

A vulnerability in the software update feature of Cisco Webex Meetings Desktop App for Mac could allow an unauthenticated, remote attacker to execute arbitrary code on an affected system. The vulnerability is due to improper validation of cryptographic protections on files that are downloaded by...

Cisco Webex Meetings Desktop App Trust Management Issue Vulnerability

Cisco Webex Meetings Desktop App is a video conferencing control application for use in desktop environments from Cisco USA. A trust management issue vulnerability exists in the software update feature in the Cisco Webex Meetings Desktop App prior to version 39.5.11 Mac, which arises from the...

Cisco Releases Multiple Security Updates

Cisco has released security updates to address vulnerabilities affecting multiple products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. For updates addressing lower severity vulnerabilities, see the Cisco Security Advisories page. The...

CVE-2020-12852

The update feature for Pydio Cells 2.0.4 allows an administrator user to set a custom update URL and the public RSA key used to validate the downloaded update package. The update process involves downloading the updated binary file from a URL indicated in the update server response, validating it...

CVE-2020-12852

The update feature for Pydio Cells 2.0.4 allows an administrator user to set a custom update URL and the public RSA key used to validate the downloaded update package. The update process involves downloading the updated binary file from a URL indicated in the update server response, validating it...

Design/Logic Flaw

The update feature for Pydio Cells 2.0.4 allows an administrator user to set a custom update URL and the public RSA key used to validate the downloaded update package. The update process involves downloading the updated binary file from a URL indicated in the update server response, validating it...

CVE-2020-12852

Summary: CVE-2020-12852 concerns Pydio Cells 2.0.4. The update feature lets an administrator set a custom update URL and a public RSA key used to validate the downloaded update package. The update process downloads a binary from the server response, validates its checksum and signature, and repla...

PT-2020-13297

Name of the Vulnerable Software and Affected Versions Pydio Cells version 2.0.4 Description The update feature in Pydio Cells allows an administrator user to set a custom update URL and the public RSA key used to validate the downloaded update package. The update process involves downloading the...

CVE-2014-4860

Multiple integer overflows in the Pre-EFI Initialization PEI boot phase in the Capsule Update feature in the UEFI implementation in EDK2 allow physically proximate attackers to bypass intended access restrictions by providing crafted data that is not properly handled during the coalescing phase...

CVE-2014-4859

Integer overflow in the Drive Execution Environment DXE phase in the Capsule Update feature in the UEFI implementation in EDK2 allows physically proximate attackers to bypass intended access restrictions via crafted data...

CVE-2019-1861

A vulnerability in the software update feature of Cisco Industrial Network Director could allow an authenticated, remote attacker to execute arbitrary code. The vulnerability is due to improper validation of files uploaded to the affected application. An attacker could exploit this vulnerability ...

CVE-2019-1861: Improper Input Validation

A vulnerability in the software update feature of Cisco Industrial Network Director could allow an authenticated, remote attacker to execute arbitrary code. The vulnerability is due to improper validation of files uploaded to the affected application. An attacker could exploit this vulnerability ...

Cybercriminals Have a Heyday with WinRAR Bug in Fresh Campaigns

A recently discovered vulnerability in the WinRAR file archival utility has been exploited in a slew of new campaigns, including one with a never-before-seen payload. The flurry of activity shows no sign of waning as cybercriminals continue to find success exploiting the bug. The campaigns take...