CVE-2020-15236

CVE-2020-15236 affects Wiki.js prior to 2.5.151, enabling directory traversal when a storage module with local asset cache (e.g., Local File System or Git) is active and URL traversal isn’t blocked. The issue allowed reading arbitrary filesystem files via crafted URLs. The fix (commit 084dcd69d15...

CVE-2020-15236 Directory Traversal in Wiki.js

In Wiki.js before version 2.5.151, directory traversal outside of Wiki.js context is possible when a storage module with local asset cache fetching is enabled. A malicious user can potentially read any file on the file system by crafting a special URL that allows for directory traversal. This is...

WordPress WP Shieldon – WordPress Firewall plugin <= 1.6.3 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability found by Johto Robbie in WordPress WP Shieldon – WordPress Firewall plugin versions = 1.6.3. Solution 2021-01-26 - we were unable to find a patched version of this plugin. WordPress.org notification: "This plugin has been closed as of January 19, 2021 and is...

Detecting HTTP Request Smuggling with Qualys WAS

HTTP Request Smuggling HRS is a web application vulnerability that enables an attacker to craft a single request that hides a second request within the body of the first request. HRS enables the following types of attack: Web cache poisoning Web cache deception Session hijacking Cross-site...

HP Device Manager Cavalcade of Critical CVEs (CVE-2020-6925:6927): What You Need to Know

HP released a security bulletin on Sept. 25, 2020, disclosing a set of vulnerabilities in HP Device Manager that—when some are chained together—can result in a remote attacker gaining SYSTEM privileges on the target node. Note: A backdoor database user exists in the PostgreSQL database used by HP...

CVE-2020-5132

SonicWall SSL-VPN products and SonicWall firewall SSL-VPN feature misconfiguration leads to possible DNS flaw known as domain name collision vulnerability. When the users publicly display their organization’s internal domain names in the SSL-VPN authentication page, an attacker with knowledge of...

The Network Perimeter: This Time, It’s Personal

In the rear-view mirror of history, the state of cybersecurity will not take top billing away from the COVID-19 pandemic. However, the one has been significantly affected by the other, and only time will tell what the full fallout will be. The first six months of 2020 saw significant developments...

LinuxConf Buffer Overflow Vulnerability

LinuxConf is prone to a buffer overflow vulnerability. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you ca...

CVE-2020-3480

Multiple vulnerabilities in the Zone-Based Firewall feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload or stop forwarding traffic through the firewall. The vulnerabilities are due to incomplete handling of Layer 4 packets through the...

CVE-2020-3421

Multiple vulnerabilities in the Zone-Based Firewall feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload or stop forwarding traffic through the firewall. The vulnerabilities are due to incomplete handling of Layer 4 packets through the...

CVE-2020-3421

Multiple vulnerabilities in the Zone-Based Firewall feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload or stop forwarding traffic through the firewall. The vulnerabilities are due to incomplete handling of Layer 4 packets through the...

Design/Logic Flaw

Multiple vulnerabilities in the Zone-Based Firewall feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload or stop forwarding traffic through the firewall. The vulnerabilities are due to incomplete handling of Layer 4 packets through the...

Design/Logic Flaw

Multiple vulnerabilities in the Zone-Based Firewall feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload or stop forwarding traffic through the firewall. The vulnerabilities are due to incomplete handling of Layer 4 packets through the...

CVE-2020-3421 Cisco IOS XE Software Zone-Based Firewall Denial of Service Vulnerabilities

Multiple vulnerabilities in the Zone-Based Firewall feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload or stop forwarding traffic through the firewall. The vulnerabilities are due to incomplete handling of Layer 4 packets through the...

CVE-2020-3421

The CVE-2020-3421 entry concerns Cisco IOS XE Software Zone-Based Firewall vulnerabilities. Affected component: Zone-Based Firewall handling of Layer 4 traffic on Cisco IOS XE. Root cause: incomplete handling of Layer 4 packets through the device, enabling an unauthenticated, remote attacker to c...

CVE-2020-3421 Cisco IOS XE Software Zone-Based Firewall Denial of Service Vulnerabilities

Multiple vulnerabilities in the Zone-Based Firewall feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload or stop forwarding traffic through the firewall. The vulnerabilities are due to incomplete handling of Layer 4 packets through the...

CVE-2020-3480 Cisco IOS XE Software Zone-Based Firewall Denial of Service Vulnerabilities

Multiple vulnerabilities in the Zone-Based Firewall feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload or stop forwarding traffic through the firewall. The vulnerabilities are due to incomplete handling of Layer 4 packets through the...

CVE-2020-3480

CVE-2020-3480 corresponds to multiple DoS vulnerabilities in Cisco IOS XE Zone-Based Firewall. The flaws arise from incomplete handling of Layer 4 packets, enabling an unauthenticated, remote attacker to trigger a device reload or to stop forwarding traffic through the firewall by sending a speci...

CVE-2020-3480 Cisco IOS XE Software Zone-Based Firewall Denial of Service Vulnerabilities

Multiple vulnerabilities in the Zone-Based Firewall feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload or stop forwarding traffic through the firewall. The vulnerabilities are due to incomplete handling of Layer 4 packets through the...

Cisco IOS XE Software Zone-Based Firewall Denial of Service Vulnerabilities

Multiple vulnerabilities in the Zone-Based Firewall feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload or stop forwarding traffic through the firewall. The vulnerabilities are due to incomplete handling of Layer 4 packets through the...