October 13, 2020—KB4580345 (Monthly Rollup)

None None...

CVE-2020-15802

A flaw was found in the bluetooth specification that would allow an attacker within bluetooth radio range to abuse a protocol flaw which could allow key-overwrite in services. Mitigation As the bluetooth module will be auto-loaded when required, its use can be disabled by preventing the module fr...

Design/Logic Flaw

A vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 on Microsoft Windows may allow an attacker to manipulate a particular product folder to disable the security temporarily, abuse a specific Windows function and attain privilege escalation. An attacker must first...

CVE-2020-16138: Undefined Security Weakness

A denial-of-service issue in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers to remotely disable the device until it is power cycled. Note: We cannot prove this vulnerability exists. Out of an abundance of caution, this CVE is being assigned to better serve our...

PT-2020-13530 · Magento · Form Builder +1

Name of the Vulnerable Software and Affected Versions: Form Builder version 2.1.0 for Magento Description: The issue concerns multiple XSS problems that can be exploited against Magento 2 admin accounts. This can be achieved via the Current url or email field, or the User-Agent HTTP header...

CVE-2020-10276

The password for the safety PLC is the default and thus easy to find in manuals, etc.. This allows a manipulated program to be uploaded to the safety PLC, effectively disabling the emergency stop in case an object is too close to the robot. Navigation and any other components dependent on the las...

CVE-2020-10059

The UpdateHub module disables DTLS peer checking, which allows for a man in the middle attack. This is mitigated by firmware images requiring valid signatures. However, there is no benefit to using DTLS without the peer checking. See NCC-ZEP-018 This issue affects: zephyrproject-rtos zephyr versi...

CVE-2020-3329

Cisco IMC Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data are affected by a role-based access control vulnerability. Root cause: incorrect allocation of the enable/disable action button in the RBAC code, allowing a read-only authenticated attacker to update other users...

SAE IT-systems FW-50 Remote Telemetry Unit (RTU)

1. EXECUTIVE SUMMARY CVSS v3 9.1 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: SAE IT-systems Equipment: FW-50 Remote Telemetry Unit RTU Vulnerabilities: Cross-site Scripting, Path Traversal 2. RISK EVALUATION Successful exploitation of these vulnerabilities may allow an...

Code injection

An issue was discovered on Samsung mobile devices with M6.0 software. An attacker can disable all Sound functionality by broadcasting an unprotected intent. The Samsung IDs are SVE-2016-7179 and SVE-2016-7182 November 2016...

CVE-2019-20604

An issue was discovered on Samsung mobile devices with O8.x software. Attackers can disable Gallery permanently. The Samsung ID is SVE-2019-14031 May 2019...

CVE-2019-20604

An issue was discovered on Samsung mobile devices with O8.x software. Attackers can disable Gallery permanently. The Samsung ID is SVE-2019-14031 May 2019...

CVE-2019-20608: Undefined Security Weakness

An issue was discovered on Samsung mobile devices with N7.x, O8.x, and P9.0 software. An attacker can use Emergency mode to disable features. The Samsung IDs are SVE-2018-13164, SVE-2018-13165 April 2019...

CVE-2020-7253

Improper access control vulnerability in masvc.exe in McAfee Agent MA prior to 5.6.4 allows local users with administrator privileges to disable self-protection via a McAfee supplied command-line utility...

CVE-2020-7251 ESConfig Tool able to edit configuration for newer version

Improper access control vulnerability in Configuration Tool in McAfee Mcafee Endpoint Security ENS Prior to 10.6.1 February 2020 Update allows local users to disable security features via unauthorised use of the configuration tool from older versions of ENS...

XXE in OpenID client application - CVE-2019-20104

The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perform a Denial of Service attack via an XML Entity Expansion vulnerability. This issue was addressed by disabling the OpenID client application in Crowd. Please ...

Xiaomi Cameras Connected to Google Nest Expose Video Feeds From Others

Internet-connected devices have been one of the most remarkable developments that have happened to humankind in the last decade. Although this development is a good thing, it also stipulates a high security and privacy risk to personal information. In one such recent privacy mishap, smart IP...

Reliable Controls MACH-ProWebCom/Sys CVE-2019-18249 Cross Site Scripting Vulnerability

Description Reliable Controls MACH-ProWebCom/Sys are prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the...

CVE-2019-13755

Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to disable extensions via a crafted HTML page...

Authorities Break Up Imminent Monitor Spyware Organization

The developers behind a commodity remote-access tool RAT that allows full control of a victim’s computer has been taken down by Australian and global authorities. The Imminent Monitor RAT IM-RAT first appeared in 2012, the work of a developer going by the handle of “Shockwave,” according to...