Design/Logic Flaw

The update feature for Pydio Cells 2.0.4 allows an administrator user to set a custom update URL and the public RSA key used to validate the downloaded update package. The update process involves downloading the updated binary file from a URL indicated in the update server response, validating it...

NOTICE-OF-CHANGE ANNOUNCEMENT FOR CITRIX SD-WAN 5100 Standard Edition and 800 WANOP Edition

Citrix Systems, Inc. announces a Notice of Status Change for the Citrix SD-WAN 5100 Standard Edition and 800 WANOP Edition platforms. The tables below explain the Citrix SD-WAN life cycle management milestones as well as important information regarding dates and options during this period. The...

CVE-2020-4019

The file editing functionality in the Atlassian Companion App before version 1.0.0 allows local attackers to have the app run a different executable in place of the app's cmd.exe via a untrusted search path vulnerability...

CVE-2020-9046

A vulnerability in all versions of Kantech EntraPass Editions could potentially allow an authorized low-privileged user to gain full system-level privileges by replacing critical files with specifically crafted files...

PT-2020-20459

Name of the Vulnerable Software and Affected Versions Kantech EntraPass Editions affected versions not specified Description A vulnerability could potentially allow an authorized low-privileged user to gain full system-level privileges by replacing critical files with specifically crafted files...

CVE-2020-9046: Improper Access Control

A vulnerability in all versions of Kantech EntraPass Editions could potentially allow an authorized low-privileged user to gain full system-level privileges by replacing critical files with specifically crafted files...

Description of the cumulative update for Lync 2010 Attendee - Administrator level installation: June 2012

Describes the cumulative update for Lync 2010 Attendee, Administrator level installation that is dated June 2012.SummaryThis article describes the issue that is fixed in the cumulative update for Microsoft Lync 2010 Attendee - Administrator level installation that is dated June 2012.This article...

Cross-site Scripting (XSS)

Overview angular is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly. Affected versions of this package...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS. The regex-based input HTML replacement may turn sanitized code into unsanitized one. Wrapping elements in ones changes parsing behavior, leading to possibly unsanitizing code. Details Cross-site scripting or XS...

Opto 22 SoftPAC Project Code Issue Vulnerability

Opto 22 SoftPAC Project is an automation software suite from Opto 22 USA. The product is capable of providing industrial automation, process control, building automation, remote monitoring, data acquisition and industrial IoT. A code issue vulnerability exists in Opto 22 SoftPAC Project 9.6 and...

PT-2020-13012

Name of the Vulnerable Software and Affected Versions Opto 22 SoftPAC Project versions 9.6 and prior Description The issue concerns the lack of verification of firmware files' signatures during updates, allowing an attacker to replace legitimate firmware files with malicious ones. Recommendations...

SAE IT-systems FW-50 Remote Telemetry Unit (RTU)

1. EXECUTIVE SUMMARY CVSS v3 9.1 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: SAE IT-systems Equipment: FW-50 Remote Telemetry Unit RTU Vulnerabilities: Cross-site Scripting, Path Traversal 2. RISK EVALUATION Successful exploitation of these vulnerabilities may allow an...

CVE-2020-8833

Time-of-check Time-of-use Race Condition vulnerability on crash report ownership change in Apport allows for a possible privilege escalation opportunity. If fs.protectedsymlinks is disabled, this can be exploited between the os.open and os.chown calls when the Apport cron script clears out crash...

Malicious Package

Overview aws-snssubscription is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using...

Malicious Package

Overview acme-base64-hexagrams is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using...

Malicious Package

Overview active-model-policy is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using...

Malicious Package

Overview authenticated-client is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using...

Malicious Package

Overview accessible-tooltip is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using...

Malicious Package

Overview banner-jobsub is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using banner-jobsub...

Malicious Package

Overview aasm-active-fedora is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using...