PT-2020-2874 · Cisco · Cisco Ios Xe

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Software affected versions not specified Description: A vulnerability in Cisco IOS XE Software could allow an authenticated, local attacker to escalate their privileges to a user with root-level privileges. The issue is due to...

Default credentials

In QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8, the local www-data user has sudo privileges to execute grep as root without a password, which allows an attacker to obtain sensitive information via a grep of a /root/.db or /etc/shadow file...

Cisco Nexus 9000 ACI Mode Shell Escape Vulnerability (cisco-sa-20190306-aci-shell-escape)

A shell escape / privilege escalation vulnerability exists in ACI Mode due to insufficient sanitization of user-supplied input. Therefore, an authenticated, remote attacker can exploit this, via a specifically crafted CLI command, to escape the ACI shell and gain root access to the system. Please...

SWARCO CPU LS4000 G4 Access Control Error Vulnerability

SWARCO CPU LS4000 G4 is a set of software used in SWARCO chips from SWARCO Austria. An access control error vulnerability exists in SWARCOs CPU LS4000 G4, which arises from an open port used for debugging that fails network access control and has root access to the device. An attacker could use...

CVE-2020-3957

VMware Fusion 11.x before 11.5.5, VMware Remote Console for Mac 11.x and prior and VMware Horizon Client for Mac 5.x and prior contain a local privilege escalation vulnerability due to a Time-of-check Time-of-use TOCTOU issue in the service opener. Successful exploitation of this issue may allow...

CVE-2020-12493

An open port used for debugging in SWARCOs CPU LS4000 Series with versions starting with G4... grants root access to the device without access control via network. A malicious user could use this vulnerability to get access to the device and disturb operations with connected devices...

CVE-2020-12493

An open port used for debugging in SWARCOs CPU LS4000 Series with versions starting with G4... grants root access to the device without access control via network. A malicious user could use this vulnerability to get access to the device and disturb operations with connected devices...

CVE-2020-12493 Critical Vulnerability in SWARCO CPU LS4000

An open port used for debugging in SWARCOs CPU LS4000 Series with versions starting with G4... grants root access to the device without access control via network. A malicious user could use this vulnerability to get access to the device and disturb operations with connected devices...

CVE-2020-12493

CVE-2020-12493 affects SWARCO CPU LS4000 Series (OS versions starting with G4). The vulnerability arises from an open debugging port that grants root access to the device over the network without access control. Impact is high: remote access could allow full control and disruption of operations o...

Apple macOS Catalina PackageKit Component Elevation of Privilege Vulnerability

Apple macOS Catalina is a proprietary operating system developed by Apple for Mac computers.PackageKit is an open-source suite of applications for installing and updating Linux software. A security vulnerability exists in the PackageKit component of Apple macOS Catalina versions prior to 10.15.5...

StrandHogg 2.0 Critical Bug Allows Android App Hijacking

A critical privilege-escalation vulnerability affecting Android devices has been found that allows attackers to hijack any app on an infected phone – potentially exposing private SMS messages and photos, login credentials, GPS movements, phone conversations and more. The bug is dubbed the...

New Android Flaw Affecting Over 1 Billion Phones Let Attackers Hijack Apps

Remember Strandhogg? A security vulnerability affecting Android that malicious apps can exploit to masquerade as any other app installed on a targeted device to display fake interfaces to the users, tricking them into giving away sensitive information. Late last year, at the time of its public...

New Tool Can Jailbreak Any iPhone and iPad Using An Unpatched 0-Day Bug

The hacking team behind the "unc0ver" jailbreaking tool has released a new version of the software that can unlock every single iPhone, including those running the latest iOS 13.5 version. Calling it the first zero-day jailbreak to be released since iOS 8, unc0ver's lead developer Pwn20wnd said...

Authorization

An issue was discovered on D-Link DAP-1360 revision F devices. Remote attackers can start a telnet service without authorization via an undocumented HTTP request. Although this is the primary vulnerability, the impact depends on the firmware version. Versions 609EU through 613EUbeta were tested...

CVE-2019-18666

An issue was discovered on D-Link DAP-1360 revision F devices. Remote attackers can start a telnet service without authorization via an undocumented HTTP request. Although this is the primary vulnerability, the impact depends on the firmware version. Versions 609EU through 613EUbeta were tested...

Palo Alto Networks PAN-OS Operating System Command Injection Vulnerability (CNVD-2020-31588)

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks for its firewall appliances. A security vulnerability exists in Palo Alto Networks PAN-OS version 7.1, version 8.0, and version 8.1 prior to 8.1.14. An attacker could exploit the vulnerability to execute code with ro...

Palo Alto Networks PAN-OS Management Server Component Buffer Overflow Vulnerability

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks for its firewall appliances. A buffer overflow vulnerability exists in the Management Server component of Palo Alto Networks PAN-OS version 7.1, version 8.0, and version 8.1 prior to 8.1.14, which can be exploited by...

CVE-2020-2014

An OS Command Injection vulnerability in PAN-OS management server allows authenticated users to inject and execute arbitrary shell commands with root privileges. This issue affects: All versions of PAN-OS 7.1 and 8.0; PAN-OS 8.1 versions earlier than 8.1.14; PAN-OS 9.0 versions earlier than 9.0.7...

CVE-2020-2008

An OS command injection and external control of filename vulnerability in Palo Alto Networks PAN-OS allows authenticated administrators to execute code with root privileges or delete arbitrary system files and impact the system's integrity or cause a denial of service condition. This issue affect...

CVE-2020-2009

An external control of filename vulnerability in the SD WAN component of Palo Alto Networks PAN-OS Panorama allows an authenticated administrator to send a request that results in the creation and write of an arbitrary file on all firewalls managed by the Panorama. In some cases this results in...