SUSE-SU-2020:1392-1 Security update for salt

This update for salt fixes the following issues: Security issues fixed: - CVE-2020-11651: Fixed the improper validation of method calls in salt-master, that could have allowed unauthenticated remote users to run arbitrary commands on salt minions bsc1170595. - CVE-2020-11652: Fixed an improper pa...

SAP Adaptive Server Enterprise SQL Injection Vulnerability (CNVD-2020-29750)

SAP Adaptive Server Enterprise is a relational database server from SAP. A SQL injection vulnerability exists in SAP Adaptive Server Enterprise. An attacker could exploit this vulnerability by executing specially crafted query statements to elevate privileges, modify database objects, or execute...

CyberArk PSMP 10.9.1 - Policy Restriction Bypass

Exploit Title: CyberArk PSMP 10.9.1 - Policy Restriction Bypass Google Dork: NA Date: 2020-02-25 Exploit Author: LAHBAL Said Vendor Homepage: https://www.cyberark.com/ Software Link: https://www.cyberark.com/ Version: PSMP = 11.1 Prerequisites Policy allows us to overwrite PSMRemoteMachine...

Command Execution Vulnerability in Marlboze/Marlboze-w30 Series Cameras at Shenzhen Anjubao Electronics Co.

Marbleizer camera software enables all kinds of hardware alarm effects, so that you can enjoy a real-time home monitoring experience, so that you can easily understand all the situations in the family. Shenzhen Anjubao Electronics Co., Ltd Marlboze/Marlboze-w30 series cameras have a command...

ASUS ZenFone 3 Laser Access Control Error Vulnerability

The ASUS ZenFone 3 Laser is a smartphone from Asus ASUS of Taiwan, China. An access control error vulnerability exists in ASUS ZenFone 3 Laser. The vulnerability arises from a network system or product that does not properly restrict access to resources from unauthorized roles. An attacker could...

ASUS ZenFone 5Q Access Control Error Vulnerability (CNVD-2020-14785)

The ASUS ZenFone 5Q is a smartphone from Asus ASUS of Taiwan, China. An access control error vulnerability exists in the ASUS ZenFone 5Q. The vulnerability arises from a network system or product that does not properly restrict access to resources from unauthorized roles. An attacker could exploi...

ASUS ZenFone 4 Selfie Access Control Error Vulnerability (CNVD-2020-14727)

The ASUS ZenFone 4 Selfie is a smartphone from Asus ASUS of Taiwan, China. An access control error vulnerability exists in ASUS ZenFone 4 Selfie. The vulnerability arises from a network system or product that does not properly restrict access to resources from unauthorized roles. An attacker coul...

ASUS ZenFone 4 Selfie Access Control Error Vulnerability (CNVD-2020-14737)

The ASUS ZenFone 4 Selfie is a smartphone from Asus ASUS of Taiwan, China. An access control error vulnerability exists in ASUS ZenFone 4 Selfie. The vulnerability arises from a network system or product that does not properly restrict access to resources from unauthorized roles. An attacker coul...

ASUS ZenFone Max 4 Access Control Error Vulnerability (CNVD-2020-14732)

The ASUS ZenFone Max 4 is a smartphone from Asus ASUS of Taiwan, China. An access control error vulnerability exists in the ASUS ZenFone Max 4. The vulnerability arises from a network system or product that does not properly restrict access to resources from unauthorized roles. An attacker could...

Unspecified Vulnerability in ASUS ASUS_X015_1

The ASUS ASUSX0151 is a smartphone from Asus ASUS of Taiwan, China. Asus ASUSX0151 build fingerprint: asus/CNX015/ASUSX0151:7.0/NRD90M/CNX015-14.00.1709.35-20171215:user/release-keys has a security vulnerability in the com. A security vulnerability exists in the lovelyfont.defcontainer app. An...

CVE-2019-15419

The Asus ASUSX0151 Android device with a build fingerprint of asus/CNX015/ASUSX0151:7.0/NRD90M/CNX015-14.00.1709.35-20171215:user/release-keys contains a pre-installed app with a package name of com.lovelyfont.defcontainer app versionCode=5, versionName=5.0.1 that allows unauthorized command...

CVE-2019-15418

The Asus ASUSX00K1 Android device with a build fingerprint of asus/CNX00K/ASUSX00K1:7.0/NRD90M/CNX00K-14.01.1711.27-20180420:user/release-keys contains a pre-installed app with a package name of com.lovelyfont.defcontainer app versionCode=5, versionName=5.0.1 that allows unauthorized command...

Command injection

The Asus ASUSX0151 Android device with a build fingerprint of asus/CNX015/ASUSX0151:7.0/NRD90M/CNX015-14.00.1709.35-20171215:user/release-keys contains a pre-installed app with a package name of com.lovelyfont.defcontainer app versionCode=5, versionName=5.0.1 that allows unauthorized command...

CVE-2019-15419

Technical details about CVE-2019-15419 are not publicly provided in the connected documents. Monitor for updates and new disclosures before drawing conclusions on impact, affected components, or remediation.

CVE-2019-15418

The Asus ASUSX00K1 Android device with a build fingerprint of asus/CNX00K/ASUSX00K1:7.0/NRD90M/CNX00K-14.01.1711.27-20180420:user/release-keys contains a pre-installed app with a package name of com.lovelyfont.defcontainer app versionCode=5, versionName=5.0.1 that allows unauthorized command...

CVE-2019-15418

The CVE-2019-15418 entry concerns the ASUS_X00K_1 device running Android 7.0 with a pre-installed app (package com.lovelyfont.defcontainer, versionCode 5, versionName 5.0.1) that enables unauthorized command execution via a confused deputy attack. Affected component is the defcontainer app on the...

CVE-2019-15419: Externally Controlled Reference to a Resource in Another Sphere

The Asus ASUSX0151 Android device with a build fingerprint of asus/CNX015/ASUSX0151:7.0/NRD90M/CNX015-14.00.1709.35-20171215:user/release-keys contains a pre-installed app with a package name of com.lovelyfont.defcontainer app versionCode=5, versionName=5.0.1 that allows unauthorized command...

CVE-2019-15429: Externally Controlled Reference to a Resource in Another Sphere

The Panasonic ELUGAI9 Android device with a build fingerprint of Panasonic/ELUGAI9/ELUGAI9:7.0/NRD90M/1501740649:user/release-keys contains a pre-installed app with a package name of com.ovvi.modem app versionCode=1, versionName=1 that allows unauthorized attacker-controlled at command via a...

CVE-2019-16662

An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by sending a GET request to ajaxServerSettingsChk.php because the rootUname parameter is passed to the exec function without filtering, which can lead to command execution...

CVE-2019-10969

Affected product: Moxa EDR 810 Series Secure Router (all versions 5.1 and prior). Vulnerability: CVE-2019-10969 is described as an improper input validation vulnerability in the CLI/ping feature that allows an authenticated attacker to execute unauthorized commands on the router, potentially resu...