CVE-2020-8558

The Kubelet and kube-proxy components in versions 1.1.0-1.16.10, 1.17.0-1.17.6, and 1.18.0-1.18.3 were found to contain a security issue which allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network namespace. Such a service is generally...

CVE-2020-8558

The Kubelet and kube-proxy components in versions 1.1.0-1.16.10, 1.17.0-1.17.6, and 1.18.0-1.18.3 were found to contain a security issue which allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network namespace. Such a service is generally...

Design/Logic Flaw

The Kubelet and kube-proxy components in versions 1.1.0-1.16.10, 1.17.0-1.17.6, and 1.18.0-1.18.3 were found to contain a security issue which allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network namespace. Such a service is generally...

CVE-2020-8558 Kubernetes node setting allows for neighboring hosts to bypass localhost boundary

The Kubelet and kube-proxy components in versions 1.1.0-1.16.10, 1.17.0-1.17.6, and 1.18.0-1.18.3 were found to contain a security issue which allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network namespace. Such a service is generally...

CVE-2020-8558

The Kubelet and kube-proxy components in versions 1.1.0-1.16.10, 1.17.0-1.17.6, and 1.18.0-1.18.3 were found to contain a security issue which allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network namespace. Such a service is generally...

Unauthorized Access Vulnerability in Netcentric Cloud Devices of Shenzhen Netcentric Technology Co.

Shenzhen Netcenter Technology Co., Ltd, dedicated to the global shared computing and blockchain field, amplifies everyone's power through technological innovation. Shenzhen Netcentric Technology Co., Ltd Netcentric cloud devices have unauthorized access vulnerability, attackers can use the...

Improper Authentication

The Kubelet and kube-proxy components were found to contain a security issue which allows adjacent hosts to reach TCP and UDP services bound to running on the node or in the node's network namespace. Such a service is generally thought to be reachable only by other processes on the same host, but...

CVE-2020-12774

D-Link DSL-7740C does not properly validate user input, which allows an authenticated LAN user to inject arbitrary command...

CVE-2020-12774 D-Link DSL-7740C - Command Injection

D-Link DSL-7740C does not properly validate user input, which allows an authenticated LAN user to inject arbitrary command...

openSUSE Security Update : mumble (openSUSE-2020-1016)

This update for mumble fixes the following issues : mumble was updated 1.3.2 : - client: Fixed overlay not starting Update to upstream version 1.3.1 - Security - Fixed: Potential exploit in the OCB2 encryption 4227 boo1174041 - ICE - Fixed: Added missing UserKDFIterations field to UserInfo =...

openSUSE: Security Advisory for mumble (openSUSE-SU-2020:1016-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

IBM DataPower Gateway Security Bypass

According to its self-reported version, the IBM DataPower Gateway running on the remote host is affected by a security bypass vulnerability due to a default account that is present if the IPMI LAN channel is enabled. A remote attacker could use this account to gain unauthorised access to the BMC....

Cisco Wireless LAN Controller Software Cross-Site Request Forgery (cisco-sa-20190417-wlc-csrf)

According to its self-reported version, a Cross-site request forgery XSRF vulnerability exists in Cisco Wireless LAN Controller due to insufficient XSRF protections for the web-based management interface. An unauthenticated, remote attacker can exploit this, by convincing a user to click a...

F5 Networks BIG-IP : BIG-IP APM Edge Client vulnerability (K97733133)

When a user connects to a VPN using BIG-IP Edge Client over an unsecure network, BIG-IP Edge Client responds to authentication requests over HTTP while sending probes for captive portal detection. CVE-2020-5893 Impact An attacker can use a man-in-the-middle MITM attack by deploying a...

CVE-2019-15311

An issue was discovered on Zolo Halo devices via the Linkplay firmware. There is Zolo Halo LAN remote code execution. The Zolo Halo Bluetooth speaker had a GoAhead web server listening on the port 80. The /httpapi.asp endpoint of the GoAhead web server was also vulnerable to multiple command...

CVE-2019-15311

CVE-2019-15311 affects Zolo Halo devices via the Linkplay firmware. The vulnerability resides in the GoAhead web server running on port 80, with the /httpapi.asp endpoint exposing multiple command-execution flaws that enable LAN remote code execution. Multiple connected sources corroborate a GoAh...

CVE-2019-15311

An issue was discovered on Zolo Halo devices via the Linkplay firmware. There is Zolo Halo LAN remote code execution. The Zolo Halo Bluetooth speaker had a GoAhead web server listening on the port 80. The /httpapi.asp endpoint of the GoAhead web server was also vulnerable to multiple command...

Netgear R6700v3 Unauthenticated LAN Admin Password Reset

This module targets ZDI-20-704 aka CVE-2020-10924, a buffer overflow vulnerability in the UPNP daemon /usr/sbin/upnpd, on Netgear R6700v3 routers running firmware versions from V1.0.2.62 up to but not including V1.0.4.94, to reset the password for the 'admin' user back to its factory default of...

NETGEAR R6700v3 Password Reset / Remote Code Execution Exploit

This document describes a stack overflow vulnerability that was found in October, 2019 and presented in the Pwn2Own Mobile 2019 competition in November 2019. The vulnerability is present in the UPNP daemon /usr/sbin/upnpd, running on NETGEAR R6700v3 router with firmware versions V1.0.4.8210.0.57...

The vulnerability of the Videolabs libmicrodns 0.1.0 message parser allows a malicious actor to cause a service failure by exploiting a resource consumption issue in the VideoLAN VLC media player.

The vulnerability of the Videolabs libmicrodns 0.1.0 message parser, when used with the VideoLAN VLC media player, is related to an uncontrolled resource consumption during the analysis of mDNS messages. Exploiting this vulnerability could allow a malicious actor to cause service failures remotel...