11548 matches found
Gitpaste-12 Worm Widens Set of Exploits in New Attacks
The Gitpaste-12 worm has returned in new attacks targeting web applications, IP cameras and routers, this time with an expanded set of exploits for initially compromising devices. First discovered in a round of late-October attacks that targeted Linux-based servers and internet-of-things IoT...
CVE-2020-35234
The easy-wp-smtp plugin before 1.4.4 for WordPress allows Administrator account takeover, as exploited in the wild in December 2020. If an attacker can list the wp-content/plugins/easy-wp-smtp/ directory, then they can discover a log file such as debuglog.txt that contains all password-reset link...
CVE-2020-35234
The easy-wp-smtp plugin before 1.4.4 for WordPress allows Administrator account takeover, as exploited in the wild in December 2020. If an attacker can list the wp-content/plugins/easy-wp-smtp/ directory, then they can discover a log file such as debuglog.txt that contains all password-reset link...
PT-2020-16003
Name of the Vulnerable Software and Affected Versions Medtronic MyCareLink Smart 25000 all versions Description The issue allows an attacker who gains authentication to run a debug command, which is sent to the reader, causing a heap overflow in the MCL Smart Reader stack. This heap overflow...
VulnCheck KEV: CVE-2020-35234
The easy-wp-smtp plugin before 1.4.4 for WordPress allows Administrator account takeover, as exploited in the wild in December 2020. If an attacker can list the wp-content/plugins/easy-wp-smtp/ directory, then they can discover a log file such as debuglog.txt that contains all password-reset link...
SUSE-SU-2020:3749-1 Security update for gcc7
This update for gcc7 fixes the following issues: - CVE-2020-13844: Added mitigation for aarch64 Straight Line Speculation issue bsc1172798 - Enable fortran for the nvptx offload compiler. - Update README.First-for.SuSE.packagers - avoid assembler errors with AVX512 gather and scatter instructions...
Medtronic MyCareLink Smart Model 25000 Patient Reader Buffer Error Vulnerability
The Medtronic MyCareLink Smart Model 25000 Patient Reader is a reader used in the healthcare industry to visually interact with medical devices from Medtronic, Inc. The Medtronic MyCareLink Smart Model 25000 Patient Reader suffers from a buffer error vulnerability that stems from the susceptibili...
NewStart CGSL CORE 5.04 / MAIN 5.04 : docker-ce Multiple Vulnerabilities (NS-SA-2020-0082)
The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has docker-ce packages installed that are affected by multiple vulnerabilities: - Lack of content verification in Docker-CE Also known as Moby versions 1.12.6-0, 1.10.3, 17.03.0, 17.03.1, 17.03.2, 17.06.0, 17.06.1, 17.06.2,...
PT-2020-14872
Name of the Vulnerable Software and Affected Versions GNU Binutils version 2.34 Description A Null Pointer Dereference issue exists in the Binary File Descriptor BFD library, as distributed in GNU Binutils, in the debug get real type function, as demonstrated in objdump, that can cause a denial o...
Easy WP SMTP < 1.4.3 - Debug Log Disclosure
The plugin has an optional debug log file generated with a random name, located in the plugin folder and which contains all email messages sent. However, this folder does not have any index page, allowing access to log file on servers with the directory listing enabled or misconfigured. This coul...
WordPress Easy WP SMTP Password Reset
Wordpress plugin Easy WP SMTP versions use auxiliary/scanner/http/wp/easywpsmtp msf undefinedeasywpsmtp show actions ...actions... msf undefinedeasywpsmtp set ACTION msf undefinedeasywpsmtp show options ...show and set options... msf undefinedeasywpsmtp run This module requires Metasploit:...
binutils -- excessive debug section size can cause excessive memory consumption in bfd's dwarf2.c read_section()
Hao Wang reports: There's a flaw in the BFD library of binutils in versions before 2.36. An attacker who supplies a crafted file to an application linked with BFD, and using the DWARF functionality, could cause an impact to system availability by way of excessive memory consumption...
CVE-2020-29060
An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, FD1104B, FD1104S, FD1104SN, FD1108S, FD1204S-R2, FD1204SN, FD1204SN-R2, FD1208S-R2, FD1216S-R1, FD1608GS, FD1608SN, FD1616GS, FD1616SN, and FD8000 devices...
CVE-2020-29060: Use of Hard-coded Credentials
An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, FD1104B, FD1104S, FD1104SN, FD1108S, FD1204S-R2, FD1204SN, FD1204SN-R2, FD1208S-R2, FD1216S-R1, FD1608GS, FD1608SN, FD1616GS, FD1616SN, and FD8000 devices...
Amazon Linux 2 : httpd (ALAS-2020-1490)
The version of httpd installed on the remote host is prior to 2.4.46-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1490 advisory. Apache HTTP server 2.4.32 to 2.4.44 modproxyuwsgi info disclosure and possible RCE A flaw was found in Apache httpd in...
CVE-2020-25746
QED ResourceXpress Qubi3 devices before 1.40.9 could allow a local attacker with physical access to the device to obtain sensitive information via the debug interface keystrokes over a USB cable, aka wireless password visibility...
CVE-2020-25746
QED ResourceXpress Qubi3 devices before 1.40.9 could allow a local attacker with physical access to the device to obtain sensitive information via the debug interface keystrokes over a USB cable, aka wireless password visibility...
Default credentials
QED ResourceXpress Qubi3 devices before 1.40.9 could allow a local attacker with physical access to the device to obtain sensitive information via the debug interface keystrokes over a USB cable, aka wireless password visibility...
CVE-2020-25746
QED ResourceXpress Qubi3 devices before 1.40.9 could allow a local attacker with physical access to the device to obtain sensitive information via the debug interface keystrokes over a USB cable, aka wireless password visibility...
CVE-2020-25746
CVE-2020-25746 affects QED ResourceXpress Qubi3 devices before version 1.40.9. The issue allows a local attacker with physical access to the device to obtain sensitive information through the debug interface (USB keystrokes), effectively exposing wireless passwords and compromising confidentialit...