CVE-2020-15636

The CVE-2020-15636 vulnerability affects NETGEAR routers: R6400, R6700, R7000, R7850, R7900, R8000, RS400, XR300 with firmware 1.0.4.84_10.0.58. The issue resides in the check_ra service, where a crafted raePolicyVersion in RAE_Policy.json can overflow a fixed-length stack-based buffer, allowing ...

CVE-2020-15635

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.8410.0.58 routers with firmware 1.0.4.8410.0.58. Authentication is not required to exploit this vulnerability. The specific flaw exists within the acsd service, which...

CVE-2020-15629

Foxit Studio Photo 3.6.6.922 is affected by a TIF file parsing vulnerability described as a buffer overflow/out-of-bounds write. The issue arises from improper validation of user-supplied data in TIFF handling and can enable remote code execution in the context of the current process. Exploitatio...

CVE-2020-15634

The CVE-2020-15634 issue concerns NETGEAR R6700 routers. The root cause is improper validation of a user-supplied string used as a format specifier during string table file uploads in the web server (httpd). This enables remote code execution by network-adjacent attackers without authentication, ...

CVE-2020-15630

Foxit Studio Photo 3.6.6.922 (and affected earlier versions) is affected by a PNG parsing vulnerability that leads to a read past the end of an allocated structure due to improper validation of user-supplied data. This out-of-bounds read can disclose sensitive information and, per the CVE, can be...

CVE-2020-15629

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Race condition

TOCTOU Race Condition vulnerability in apport allows a local attacker to escalate privileges and execute arbitrary code. An attacker may exit the crashed process and exploit PID recycling to spawn a root process with the same PID as the crashed process, which can then be used to escalate...

CVE-2020-15702 TOCTOU in apport

TOCTOU Race Condition vulnerability in apport allows a local attacker to escalate privileges and execute arbitrary code. An attacker may exit the crashed process and exploit PID recycling to spawn a root process with the same PID as the crashed process, which can then be used to escalate...

CVE-2020-15702

CVE-2020-15702 describes a TOCTOU race condition in the Apport component of Ubuntu. The vulnerability allows a local attacker to escalate privileges and potentially execute arbitrary code by exploiting PID recycling after a crash, enabling a root process to inherit the crashed process’ PID. Affec...

Netgear Won't Patch 45 Router Models Vulnerable to Serious Flaw

UPDATE Netgear will not patch 45 router models that are vulnerable to a high-severity remote code execution flaw, the router company revealed last week. However, the company says that routers that won’t receive updates are outdated or have reached EOL End of Life. The remote code execution...

CVE-2020-15418

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.0.0.75020200415. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SSRSReport class. Due to the improper restriction of XML Extern...

CVE-2020-15417

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.8410.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of string table file uploads. A crafted...

CVE-2020-10929

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.8410.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of string table file uploads. The issue...

CVE-2020-10930

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR R6700 V1.0.4.8410.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of URLs. The issue results from th...

CVE-2020-10923

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.8410.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UPnP service, which listens on TCP port 5000. A...

CVE-2020-10927

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.8410.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the encryption of firmware update images. The issue...

CVE-2020-10925

This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of NETGEAR R6700 V1.0.4.8410.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the downloading of files vi...

Design/Logic Flaw

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.8410.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of firmware updates. The issue results fro...

Stack overflow

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.8410.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of string table file uploads. A crafted...

Stack overflow

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.8410.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by...