PT-2020-4703

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox versions prior to 6.1.16 Description The issue is related to insufficient input validation in the Core component of Oracle VM VirtualBox, allowing a highly privileged attacker with logon to the infrastructure to compromise...

PT-2020-3773

Name of the Vulnerable Software and Affected Versions: Cisco Virtual Wide Area Application Services vWAAS with Cisco Enterprise NFV Infrastructure Software NFVIS-bundled images for Cisco ENCS 5400-W Series and CSP 5000-W Series appliances affected versions not specified Description: A vulnerabili...

Using Disinformation to Cause a Blackout

Interesting paper: "How weaponizing disinformation can bring down a city's power grid": Abstract: Social media has made it possible to manipulate the masses via disinformation and fake news at an unprecedented scale. This is particularly alarming from a security perspective, as humans have proven...

Infrastructure Component Privilege Escalation

The vulnerability of Oracle Financial Services Analytical Applications Infrastructure’s component is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow an attacker operating remotely to modify, add, or delete data, or to gain...

Infrastructure Component Unauthorized Access Data Modification

The vulnerability of Oracle Financial Services Analytical Applications Infrastructure’s component is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information or to modify, add, or...

Infrastructure Component Unauthorized Access

The vulnerability of the Infrastructure component of the Oracle Financial Services Analytical Applications Infrastructure software relates to insufficient validation of input data. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected...

Infrastructure Component Unauthorized Access

The vulnerability of Oracle Financial Services Analytical Applications Infrastructure’s component is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected information...

Infrastructure Component Data Modification

The vulnerability of the Infrastructure component of the Oracle Financial Services Analytical Applications Infrastructure software relates to insufficient validation of input data. Exploiting this vulnerability can allow an attacker operating remotely to gain access to the ability to modify, add,...

Infrastructure Cross-site Scenario Attack

The vulnerability of Oracle Financial Services Analytical Applications Infrastructure’s component is related to the lack of protective measures for the website structure. Exploiting this vulnerability could allow a malicious actor to perform a cross-site scenario attack remotely...

CVE-2020-14324

A high severity vulnerability was found in all active versions of Red Hat CloudForms before 5.11.7.0. The out of band OS command injection vulnerability can be exploited by authenticated attacker while setuping conversion host through Infrastructure Migration Solution. This flaw allows attacker t...

CVE-2020-14324

A high severity vulnerability was found in all active versions of Red Hat CloudForms before 5.11.7.0. The out of band OS command injection vulnerability can be exploited by authenticated attacker while setuping conversion host through Infrastructure Migration Solution. This flaw allows attacker t...

Command injection

A high severity vulnerability was found in all active versions of Red Hat CloudForms before 5.11.7.0. The out of band OS command injection vulnerability can be exploited by authenticated attacker while setuping conversion host through Infrastructure Migration Solution. This flaw allows attacker t...

CVE-2020-14324

CVE-2020-14324 affects Red Hat CloudForms (cfme) and is described as an Out-of-band OS Command Injection via the conversion host during Infrastructure Migration. Impact: authenticated attacker can execute arbitrary commands on the CloudForms server. Affected software includes CloudForms before 5....

CVE-2020-14324

A high severity vulnerability was found in all active versions of Red Hat CloudForms before 5.11.7.0. The out of band OS command injection vulnerability can be exploited by authenticated attacker while setuping conversion host through Infrastructure Migration Solution. This flaw allows attacker t...

August 11, 2020—KB4571746 (Security-only update)

None None...

CVE-2020-14324: Improper Neutralization of Special Elements used in an OS Command

A high severity vulnerability was found in all active versions of Red Hat CloudForms before 5.11.7.0. The out of band OS command injection vulnerability can be exploited by authenticated attacker while setuping conversion host through Infrastructure Migration Solution. This flaw allows attacker t...

Google Releases Security Updates for Chrome

Google has released Chrome version 84.0.4147.125 for Windows, Mac, and Linux. This version addresses vulnerabilities that an attacker could exploit to take control of an affected system. The Cybersecurity and Infrastructure Security Agency CISA encourages users and administrators to review the...

Yokogawa CENTUM (Update A)

1. EXECUTIVE SUMMARY CVSS v3 8.1 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Yokogawa Equipment: CENTUM Vulnerabilities: Improper Authentication, Path Traversal 2. UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled ICSA-20-224-01...

Siemens SIMATIC, SIMOTICS (Update A)

1. EXECUTIVE SUMMARY CVSS v3 3.1 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: SIMATIC, SIMOTICS Vulnerability: TOCTOU Race Condition 2. UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled ICSA-20-224-05 Siemens SIMATIC,...

ca-certificates bug fix and enhancement update

An update is available for ca-certificates. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The ca-certificates package contains a set of Certificate Authority C...