CVE-2019-20807: Improper Neutralization of Special Elements used in an OS Command

In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands via scripting interfaces e.g., Python, Ruby, or Lua...

New Android Flaw Affecting Over 1 Billion Phones Let Attackers Hijack Apps

Remember Strandhogg? A security vulnerability affecting Android that malicious apps can exploit to masquerade as any other app installed on a targeted device to display fake interfaces to the users, tricking them into giving away sensitive information. Late last year, at the time of its public...

SQL Injection Vulnerability in Shield Spirit Commodity Promotion System

Shield Spirit commodity promotion system can be applied to multiple types of public number, personal or business subscription number and service number can be used, easy to docking all kinds of public number, through the WeChat public number of the relevant interfaces configured to come into effe...

SQL Injection Vulnerability in Shield Spirit Commodity Promotion System (CNVD-2020-33194)

Shield Spirit commodity promotion system can be applied to multiple types of public number, personal or business subscription number and service number can be used, easy to docking all kinds of public number, through the WeChat public number of the relevant interfaces configured to come into effe...

CVE-2020-3956

VMware Cloud Director 10.0.x before 10.0.0.2, 9.7.0.x before 9.7.0.5, 9.5.0.x before 9.5.0.6, and 9.1.0.x before 9.1.0.4 do not properly handle input leading to a code injection vulnerability. An authenticated actor may be able to send malicious traffic to VMware Cloud Director which may lead to...

The vulnerability of the web interface of Cisco Adaptive Security Appliance (ASA) and Configure Firepower Threat Defense (FTD) allows attackers to gain unauthorized access to protected information.

The vulnerability of the web interface of Cisco Adaptive Security Appliance ASA and Configure Firepower Threat Defense FTD lies in memory object processing errors. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...

CVE-2020-2017

A DOM-Based Cross Site Scripting Vulnerability exists in PAN-OS and Panorama Management Web Interfaces. A remote attacker able to convince an authenticated administrator to click on a crafted link to PAN-OS and Panorama Web Interfaces could execute arbitrary JavaScript code in the administrator's...

PAN-OS: Nginx integer overflow may lead to information leak

Nginx web-server included with PAN-OS is vulnerable to an integer overflow vulnerability that can leak potentially a cache file header if a response was returned from cache. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions...

PAN-OS: DOM-Based cross site scripting vulnerability in management web interface

A DOM-Based Cross Site Scripting Vulnerability exists in PAN-OS and Panorama Management Web Interfaces. A remote attacker able to convince an authenticated administrator to click on a crafted link to PAN-OS and Panorama Web Interfaces could execute arbitrary JavaScript code in the administrator's...

PT-2020-15243

Name of the Vulnerable Software and Affected Versions PAN-OS versions prior to 7.1.26 PAN-OS versions prior to 8.1.13 PAN-OS versions prior to 9.0.6 PAN-OS 8.0 all versions Description A DOM-Based Cross Site Scripting issue exists in PAN-OS and Panorama Management Web Interfaces. A remote attacke...

iproute2 resource management error vulnerability

iproute2 is a utility program for controlling and monitoring routes, network interfaces, tunnels, etc. in the Linux kernel. A resource management error vulnerability exists in the 'getnetnsidfromname' function of the ip/ipnetns.c file in iproute2 versions prior to 5.1.0. The vulnerability arises...

CVE-2020-12142 IPSec UDP key material can be retrieved from EdgeConnect by a user with admin credentials

IPSec UDP key material can be retrieved from machine-to-machine interfaces and human-accessible interfaces by a user with admin credentials. Such a user, with the required system knowledge, could use this material to decrypt in-flight communication. 2. The vulnerability requires administrative...

CVE-2020-5881

On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, and 13.1.0-13.1.3.3, when the BIG-IP Virtual Edition VE is configured with VLAN groups and there are devices configured with OSPF connected to it, the Network Device Abstraction Layer NDAL Interfaces can lock up and in turn disrupting the communicatio...

Code injection

On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, and 13.1.0-13.1.3.3, when the BIG-IP Virtual Edition VE is configured with VLAN groups and there are devices configured with OSPF connected to it, the Network Device Abstraction Layer NDAL Interfaces can lock up and in turn disrupting the communicatio...

CVE-2020-5881

On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, and 13.1.0-13.1.3.3, when the BIG-IP Virtual Edition VE is configured with VLAN groups and there are devices configured with OSPF connected to it, the Network Device Abstraction Layer NDAL Interfaces can lock up and in turn disrupting the communicatio...

F5 Networks BIG-IP : BIG-IP VE interface vulnerability (K03386032)

When the BIG-IP Virtual Edition VE is configured with VLAN groups and there are devices configured with OSPF connected to it, the Network Device Abstraction Layer NDAL Interfaces can lock up and in turn disruptingthe communication between the mcpd and tmm processesCVE-2020-5881. Impact This issue...

PT-2020-18782

Name of the Vulnerable Software and Affected Versions BIG-IP Virtual Edition VE versions 13.1.0 through 13.1.3.3 BIG-IP Virtual Edition VE versions 14.1.0 through 14.1.2.3 BIG-IP Virtual Edition VE versions 15.0.0 through 15.1.0.1 Description When the BIG-IP Virtual Edition VE is configured with...

CVE-2020-12266

An issue was discovered where there are multiple externally accessible pages that do not require any sort of authentication, and store system information for internal usage. The devices automatically query these pages to update dashboards and other statistics, but the pages can be accessed...

Eight Common OT / Industrial Firewall Mistakes

Most industrial sites deploy firewalls as the first line of defense for their Operations Technology OT / industrial networks. However, configuring and managing these firewalls is a complex undertaking. Configuration and other mistakes are easy to make. This article explores eight common mistakes...

CVE-2020-5350

Dell EMC Integrated Data Protection Appliance versions 2.0, 2.1, 2.2, 2.3, 2.4 contain a command injection vulnerability in the ACM component. A remote authenticated malicious user with root privileges could inject parameters in the ACM component APIs that could lead to manipulation of passwords...