3S CoDeSys (Update A)

1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low skill level to exploit/public exploits are available Vendor: 3S-Smart Software Solutions Equipment: CoDeSys Vulnerabilities: Improper Access Control, Relative Path Traversal 2. UPDATE INFORMATION This updated advisory is a...

GE Reason S20 Ethernet Switch

1. EXECUTIVE SUMMARY CVSS v3 6.1 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: General Electric Equipment: Reason S20 Ethernet Switch Vulnerabilities: Cross-site Scripting 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow unauthorized accounts...

PT-2020-6320 · Atlassian · Jira

Name of the Vulnerable Software and Affected Versions: Atlassian Jira Server and Data Center versions prior to 8.5.8 Atlassian Jira Server and Data Center versions 8.6.0 through 8.11.0 Description: The issue is related to an information disclosure vulnerability in the...

PT-2020-14619 · Gradle · Gradle Enterprise

Name of the Vulnerable Software and Affected Versions: Gradle Enterprise versions 2018.5 through 2020.2.4 Description: An issue allows a remote attacker with administrative access to perform server side request forgery when configuring Gradle Enterprise to integrate with a SAML identity provider...

PT-2020-6738 · Linux +9 · Linux Kernel +9

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.10 Description: The issue is related to a use-after-free vulnerability in the Linux kernel, specifically in the drivers/infiniband/core/ucma.c component. This vulnerability allows a remote attacker to access...

HMS Networks Ewon Flexy and Cosy

1. EXECUTIVE SUMMARY CVSS v3 2.3 ATTENTION: Low skill level to exploit Vendor: HMS Networks Equipment: Ewon Flexy and Cosy Vulnerability: Permissive Cross-domain Policy with Untrusted Domains 2. RISK EVALUATION Successful exploitation of this vulnerability could allow attackers to retrieve...

Siemens License Management Utility

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low skill level to exploit Vendor: Siemens Equipment: License Management Utility Vulnerability: Execution with Unnecessary Privileges 2. RISK EVALUATION Successful exploitation of this vulnerability could allow local users to escalate privileges. 3...

Basics of Keeping Kubernetes Clusters Secure Part 1

With Kubernetes’ popularity and high adoption rates, its security should always be prioritized. We provide vital tips and recommendations on keeping the master node, the API server, etcd, RBAC, and network policies secure...

PT-2020-14842 · Hashicorp · Hashicorp Vault +1

Name of the Vulnerable Software and Affected Versions: HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer Description: The issue concerns an authentication bypass when HashiCorp Vault and Vault Enterprise are configured with the AWS IAM auth method. This could potentially allow...

PT-2020-14937 · Cellopoint · Cellopoint Cellos

Name of the Vulnerable Software and Affected Versions: Cellopoint Cellos version 4.1.10 Build 20190922 Description: The issue concerns improper validation of URL input. An attacker can manipulate the URL parameter using the cookie of an authenticated user to access arbitrary files on the system...

PT-2020-14834 · Philips · Philips Suresigns Vs4

Name of the Vulnerable Software and Affected Versions: Philips SureSigns VS4 versions A.07.107 and prior Description: The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Recommendations: For Philips SureSigns VS4 versions A.07.107 and prior,...

PT-2020-19344 · Elastic · Elasticsearch

Name of the Vulnerable Software and Affected Versions: Elasticsearch versions prior to 7.9.0 Elasticsearch versions prior to 6.8.12 Description: A field disclosure flaw was found in Elasticsearch when running a scrolling search with Field Level Security. If a user runs the same query another more...

PT-2020-20038 · Phpbb · Phpbb

Name of the Vulnerable Software and Affected Versions: phpBB versions prior to 3.2.10 phpBB versions prior to 3.3.1 Description: A vulnerability exists that allows the remote image dimensions check to be used for Server-Side Request Forgery SSRF. Recommendations: For versions prior to 3.2.10,...

August 11, 2020—KB4571694 (OS Build 14393.3866)

None None...

Intel® Mailbox Interface Driver Advisory

Summary: A potential security vulnerability in the Intel® Mailbox Interface driver may allow escalation of privilege. Intel is not releasing updates to mitigate this potential vulnerability and has issued a Product Discontinuation Notice for the Intel® Mailbox Interface driver. Vulnerability...

PT-2020-14816 · Advantech · Advantech Webaccess Hmi Designer

Name of the Vulnerable Software and Affected Versions: Advantech WebAccess HMI Designer versions 2.1.9.31 and prior Description: A double free vulnerability exists due to the processing of specially crafted project files, which may allow remote code execution, disclosure or modification of...

Securing Weak Points in Serverless Architectures

The big shift to serverless computing is imminent. Gain insights on the security considerations and recommendations for serverless environments that can help ensure your serverless deployments are secure...

GRUB2 Vulnerability – AKA

No description provided...

GNU GRUB2 Vulnerability

Free Software Foundation GNU Project's multiboot boot loader, GNU GRUB2, contains a vulnerability—CVE-2020-10713—that a local attacker could exploit to take control of an affected system. The Cybersecurity and Infrastructure Security Agency CISA encourages users and administrators to review the...

PT-2020-19342 · Elastic · Kibana

Name of the Vulnerable Software and Affected Versions: Kibana versions prior to 6.8.11 Kibana versions prior to 7.8.1 Description: The region map visualization in Kibana contains a stored XSS flaw. An attacker who can edit or create a region map visualization could obtain sensitive information or...