CVE-2020-28036

wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post...

CVE-2020-28036

WordPress vulnerability CVE-2020-28036: wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows privilege escalation via XML-RPC comment actions. Root cause: XML-RPC handling enables elevated privileges when commenting on a post. Affected: WordPress core prior to 5.5.2. Impact: po...

CVE-2020-28036

wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post...

CVE-2020-28036

wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post...

CVE-2020-28035

CVE-2020-28035 affects WordPress up to version 5.5.2, where an XML‑RPC based flaw allows an attacker to escalate privileges. The issue is publicly documented in CVE-2020-28035 with a high launcher in the CVSS context (network, low attack complexity, no authentication). The connected records corro...

CVE-2020-28035

WordPress before 5.5.2 allows attackers to gain privileges via XML-RPC...

CVE-2020-28035

WordPress before 5.5.2 allows attackers to gain privileges via XML-RPC...

Metasploit Wrap-Up

Keep your eyes peeled for another Metasploit CTF We hosted our third Annualish Metasploit CTF back in January of this year. All 1,000 slots were booked within days of announcing the competition. Because of the resounding success, we'll be hosting the fourth Annualish Metasploit CTF by year’s end...

CVE-2020-14383

A flaw was found in Samba's DNS server. This flaw allows an authenticated user to crash the RPC server. The RPC server, which also serves protocols other than the DNS server, is restarted after a short delay, however, an authenticated non-administrative attacker can cause a crash as soon as it...

SUSE-SU-2020:3082-1 Security update for samba

This update for samba fixes the following issues: - CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records bsc1177613. - CVE-2020-14323: Unprivileged user can crash winbind bsc1173994. - CVE-2020-14318: Missing permissions check in SMB1/2/3 ChangeNotify...

SUSE-SU-2020:3081-1 Security update for samba

This update for samba fixes the following issues: Update to samba 4.11.14 - CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records bsc1177613. - CVE-2020-14323: Unprivileged user can crash winbind bsc1173994. - CVE-2020-14318: Missing permissions check in...

wordpress -- multiple issues

wordpress developers reports: Ten security issues affect WordPress versions 5.5.1 and earlier. If you havent yet updated to 5.5, all WordPress versions since 3.7 have also been updated to fix the following security issues: -Props to Alex Concha of the WordPress Security Team for their work in...

WordPress < 5.5.2 - XML-RPC Privilege Escalation

Description The release notes state: "Thanks to Justin Tran who reported an issue surrounding privilege escalation in XML-RPC. He also found and disclosed an issue around privilege escalation around post commenting via XML-RPC."...

CVE-2020-14383

A flaw was found in samba's DNS server. An authenticated user could use this flaw to the RPC server to crash. This RPC server, which also serves protocols other than dnsserver, will be restarted after a short delay, but it is easy for an authenticated non administrative attacker to crash it again...

An authenticated user can crash the DCE/RPC DNS with

Description Some DNS records such as MX and NS records usually contain data in the additional section. Samba's dnsserver RPC pipe which is an administrative interface not used in the DNS server itself made an error in handling the case where there are no records present: instead of noticing the...

WordPress <= 5.5.1 - XML-RPC Privilege Escalation vulnerability

XML-RPC Privilege Escalation vulnerability found by Justin Tran in WordPress versions = 5.5.1. Solution Update the WordPress to the latest available version at least 5.5.2...

Security fix for the ALT Linux 10 package samba version 4.12.9-alt1

Oct. 29, 2020 Evgeny Sinelnikov 4.12.9-alt1 - Update to latest stable security release of the Samba 4.12 - Security fixes: + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify + CVE-2020-14323: Unprivileged user can crash winbind + CVE-2020-14383: An authenticated user can...

Amazon Linux 2 : samba (ALAS-2020-1544)

The version of samba installed on the remote host is prior to 4.10.16-7. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1544 advisory. All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with log...

Exploit for CVE-2020-1472

ZeroLogon testing script A Python script that uses the Impack...

EulerOS Virtualization 3.0.2.2 : glusterfs (EulerOS-SA-2020-2187)

According to the versions of the glusterfs packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A flaw was found in RPC request using gfs3lookupreq in glusterfs server. An authenticated attacker could use this flaw to leak...