Kiali Trust Management Issues Vulnerabilities

Kiali is an open source, visual management tool for the Istio microservices architecture. A trust management issue vulnerability exists in the default configuration file in versions of Kiali prior to 1.15.1. The vulnerability stems from the fact that the file comes with a hard-coded encryption ke...

Ransomware Maze

ARCHIVED STORY Ransomware Maze Alexandre Mundo · MAR 26, 2020 Overview The Maze ransomware, previously known in the community as “ChaCha ransomware”, was discovered on May the 29th 2019 by Jerome Segura1. The main goal of the ransomware is to crypt all files that it can in an infected system and...

CVE-2020-10884

This vulnerability allows network-adjacent attackers execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the tdpServer service, which listens on UDP...

CVE-2020-10884

This vulnerability allows network-adjacent attackers execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the tdpServer service, which listens on UDP...

CVE-2020-10884

This CVE concerns TP-Link Archer A7 AC1750 routers running firmware 190726. Affected component is the tdpServer daemon, which listens on UDP port 20002; the issue stems from a hard-coded encryption key, enabling network-adjacent attackers to execute arbitrary code with root privileges in vulnerab...

PT-2020-2707 · Istio · Kiali

Name of the Vulnerable Software and Affected Versions: Kiali versions prior to 1.15.1 Description: The issue is related to a hard-coded cryptographic key in the default configuration file of Kiali, which is part of the Istio service mesh. This flaw can be exploited by a remote attacker to create...

The vulnerability of the CommandLineService component of the Foglight Evolve platform, which stems from the use of hard-coded user credentials “__service__ user”, allows attackers to execute arbitrary code.

The vulnerability of the CommandLineService component of the Foglight Evolve platform is related to the use of hard-coded user credentials “service user”. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

(Pwn2Own) TP-Link Archer A7 tdpServer Use of Hard-coded Cryptographic Key Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers execute arbitrary code on affected installations of TP-Link Archer A7 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the tdpServer service, which listens on UDP port 20002 by defaul...

The vulnerability of the Visual Studio Extension Installer Service, a development tool for software, allows a malicious actor to trigger a service failure.

The vulnerability of the Visual Studio Extension Installer Service, a component of the Visual Studio software development toolset, is related to improper handling of hard links. Exploiting this vulnerability can allow an attacker to trigger a service failure through a specially created applicatio...

The vulnerability of the Windows Tile Object Service in Windows operating systems allows a hacker to induce a service failure.

The vulnerability of the Windows Tile Object Service in operating systems is related to errors in handling hard links. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created application...

CVE-2020-6979

In Moxa EDS-G516E Series firmware, Version 5.2 or lower, the affected products use a hard-coded cryptographic key, increasing the possibility that confidential data can be recovered...

CVE-2020-6979

CVE-2020-6979 affects Moxa EDS-G516E (and EDS-510E per advisories) with firmware version 5.2 or lower, where a hard-coded cryptographic key is used, increasing the risk that confidential data can be recovered. Affected components are the cryptographic handling paths implementing the hard-coded ke...

CVE-2020-6985

In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, these devices use a hard-coded service code for access to the console...

CVE-2020-6985

In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, these devices use a hard-coded service code for access to the console...

CVE-2020-6985

In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, these devices use a hard-coded service code for access to the console...

CVE-2020-6983

In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, the affected products use a hard-coded cryptographic key, which increases the possibility that confidential data can be recovered...

CVE-2020-6985

In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, these devices use a hard-coded service code for access to the console...

CVE-2020-6985

CVE-2020-6985 affects Moxa PT-7528 and PT-7828 Ethernet switches: firmware versions PT-7528 ≤ 4.0 and PT-7828 ≤ 3.9 expose a hard-coded service code for console access. The Red Hat and NVD entries, plus the ICS advisory, confirm a remote-exploitation risk with high-impact vectors (remote, no user...

CVE-2020-6983

In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, the affected products use a hard-coded cryptographic key, which increases the possibility that confidential data can be recovered...

[SECURITY] Fedora 31 Update: timeshift-20.03-1.fc31

Timeshift for Linux is an application that provides functionality similar to the System Restore feature in Windows and the Time Machine tool in Mac OS. Timeshift protects your system by taking incremental snapshots of the file system at regular intervals. These snapshots can be restored at a late...