Improper Access Control Vulnerability in RICOH printers

Overview Multiple RICOH printers contain Improper Access Control CWE-284. RICOH COMPANY, LTD. reported this vulnerability to IPA to notify users of its solution through JVN. JPCERT/CC and RICOH COMPANY, LTD. coordinated under the Information Security Early Warning Partnership. Impact A user who c...

ksh security update

20120801-140.0.1 - disable ASTnospawnveg for taskset workaround orabug 26754277 Red Hat Bug: 1295563 20120801-140 - Do not evaluate arithmetic expressions from environment variables at startup Resolves: 1790543...

PT-2020-7855 · Red Hat · Red Hat Enterprise Virtualization Hypervisor +1

Name of the Vulnerable Software and Affected Versions: Red Hat Enterprise Virtualization Hypervisor aka RHEV-H versions 6-6.x through 6-6.7-20151117.0 Red Hat Enterprise Virtualization Hypervisor aka RHEV-H versions 7-7.x through 7-7.2-20151119.0 Red Hat Enterprise Virtualization versions prior t...

Vulnerability fixed in Apache Tomcat

A malicious party can exploit the vulnerability to obtain information from the system. The vulnerability was caused because the AJP protocol was incorrectly was implemented incorrectly. A malicious party could possibly read files a malicious request to read files from the webroot directory. The A...

PT-2020-20566 · Proftpd +2 · Proftpd +2

Name of the Vulnerable Software and Affected Versions: ProFTPD version 1.3.7 Description: The issue is an out-of-bounds OOB read vulnerability in the mod cap module via the cap to text function in cap text.c. Recommendations: For ProFTPD version 1.3.7, consider disabling the mod cap module until ...

PT-2020-6890 · Abb · Abb Esoms

Name of the Vulnerable Software and Affected Versions: ABB eSOMS versions 4.0 to 6.0.3 Description: The issue is related to the use of medium strength ciphers in ABB eSOMS, which could allow an attacker to eavesdrop and/or intercept connections. This could potentially lead to the disclosure of...

PHP 7.0 < 7.4 (Unix) - debug_backtrace disable_functions Bypass Exploit

a; $backtrace = new Exception-getTrace; ; if!isset$backtrace1'args' PHP = 7.4 $backtrace = debugbacktrace; class Helper public $a, $b, $c, $d; function str2ptr&$str, $p = 0, $s = 8 $address = 0; for$j = $s-1; $j = 0; $j-- $address = 8; return $out; function write&$str, $p, $v, $n = 8 $i = 0; for$...

PT-2020-20383 · Proglottis +3 · Proglottis Go Wrapper +3

Name of the Vulnerable Software and Affected Versions: proglottis Go wrapper versions prior to 0.1.1 Description: The issue is related to a use-after-free problem, which can cause a crash or potentially allow code execution during GPG signature verification. This is due to improper memory...

PT-2020-9918 · Apache · Apache Dubbo

Name of the Vulnerable Software and Affected Versions: Apache Dubbo versions 2.5.x Apache Dubbo versions 2.6.0 through 2.6.7 Apache Dubbo versions 2.7.0 through 2.7.4 Description: Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a PO...

PT-2020-11391 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions 8.0 through 10 Description: The issue is related to a possible out of bounds write due to an incorrect bounds calculation in the Bluetooth stack, which could lead to remote code execution over Bluetooth with no additional...

Vulnerabilities fixed in Cisco products

Vulnerabilities have been fixed in Cisco products. The vulnerabilities are all in the Cisco Discovery Protocol CDP. The vulnerabilities allow an unauthenticated malicious person using a rogue CDP packet to establish a Denial-of-Service and potentially execute arbitrary code execution. Because CDP...

PT-2020-20253

Name of the Vulnerable Software and Affected Versions EyesOfNetwork version 5.3 EyesOfNetwork API version 2.4.2 Description An issue was discovered that allows an unauthenticated attacker to perform various tasks, including authentication bypass via the username field. This is due to SQL injectio...

The vulnerability of the web protection component of Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, and Kaspersky Security Cloud allows a malicious actor to disable certain security functions of the product, such as private browsing and antivirus protection.

The vulnerability of the web protection component of Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, and Kaspersky Security Cloud lies in insufficient validation of input data. Exploiting this vulnerability c...

PT-2020-1744 · Cisco · Cisco Small Business Switches

Name of the Vulnerable Software and Affected Versions: Cisco Small Business Switches versions 200, 250, 300, 350, 350X, 500, 550X Description: The issue is related to inadequate data processing in the web interface of the affected devices, which could allow a remote attacker to gain unauthorized...

PT-2020-7359

Name of the Vulnerable Software and Affected Versions: D-Link IP Cameras DCS-3411/3430 version 1.02 D-Link IP Cameras DCS-5605/5635 version 1.01 D-Link IP Cameras DCS-1100L/1130L version 1.04 D-Link IP Cameras DCS-1100/1130 version 1.03 D-Link IP Cameras DCS-1100/1130 version 1.04 US D-Link IP...

CVE-2019-19894

In IXP EasyInstall 6.2.13723, the vulnerability allows a local attacker to disable User Account Control (UAC) on a client system by abusing the Agent Service and renaming/replacing %SYSTEMDRIVE%\IXP\DATA\IXPAS.IXP. An authenticated attacker (non-admin) can disable UAC for other users, which may i...

CVE-2019-19894

In IXP EasyInstall 6.2.13723, it is possible to temporarily disable UAC by using the Agent Service on a client system. An authenticated attacker non-admin can disable UAC for other users by renaming and replacing %SYSTEMDRIVE%\IXP\DATA\IXPAS.IXP...

PT-2020-9881 · Fasttrack · Fasttrack Admin By Request

Name of the Vulnerable Software and Affected Versions: FastTrack Admin By Request version 6.1.0.0 Description: The issue concerns the elevation of privileges to Administrator level. Normally, group policies restrict this ability to a select range of users. However, when a user without direct acce...

PT-2020-19480 · Simplejobscript.Com · Sjs

Name of the Vulnerable Software and Affected Versions: Simplejobscript.com SJS versions prior to 1.65 Description: An issue was discovered in Simplejobscript.com SJS. There is unauthenticated SQL injection via the search engine, specifically through the landing location parameter in the...

PT-2020-15302 · Jenkins · Jenkins Gitlab Hook Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Gitlab Hook Plugin versions 1.4.2 and earlier Description: The issue is related to a reflected XSS vulnerability. It occurs because project names in the "build now" endpoint are not properly escaped, allowing for potential exploitatio...