Cisco Releases Security Updates

Cisco has released security updates to address vulnerabilities in Cisco products. An attacker could exploit some of these vulnerabilities to take control of an affected system. For updates addressing lower severity vulnerabilities see the Cisco Security Advisories page. The Cybersecurity and...

Arbitrary file deletion

Zyxel VMG5313-B30B router on firmware 5.13ABCJ.6b31127, and possibly older versions of firmware are affected by insecure permissions which allows regular and other users to create new users with elevated privileges. This is done by changing "FirstIndex" field in JSON that is POST-ed during accoun...

Exploit for OS Command Injection in Pi-Hole

CVE 2020-8816 : Pi-holehttps://f...

CVE-2020-3375 Cisco SD-WAN Solution Software Buffer Overflow Vulnerability

A vulnerability in Cisco SD-WAN Solution Software could allow an unauthenticated, remote attacker to cause a buffer overflow on an affected device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted traffic to an affected...

CVE-2019-20886

An issue was discovered in Mattermost Server before 5.8.0. The first user is sometimes inadvertently a system admin...

CVE-2020-13813

An issue was discovered in Foxit Studio Photo before 3.6.6.922. It allows local users to gain privileges via a crafted DLL in the current working directory when FoxitStudioPhoto3663.6.6.916.exe is used...

Design/Logic Flaw

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any authenticated user can create an EC2 credential for themselves for a project that they have a specified role on, and then perform an update to the credential user and project, allowing them to masquerade as another user...

Mail.ru: Vertical Privilege Escalation on {target.my.com}

target.my.com user with read-only privilege can elevate privilege to add another user to project...

CVE-2020-11494

A flaw was discovered in slcbump in drivers/net/can/slcan.c in CAN Communication Protocol. It allows a local attacker with special user privilege or root to read sensitive kernel stack information considering CONFIGINITSTACKALL is not enabled when a partially initialized data structure is exposed...

CVE-2020-11668

A NULL pointer dereference flaw was found in the Xirlink camera USB driver 'xirlink-cit' in the Linux kernel. The driver mishandles invalid descriptors leading to a denial-of-service DoS. This could allow a local attacker with user privilege to crash the system or leak kernel internal information...

Denial Of Service (DoS)

The kernel is vulnerable to denial of service DoS. Due to flaws in the AGPGART driver implementation when handling certain IOCTL commands, it allows a local user to cause a denial of service or escalate their privileges...

Arbitrary Code Execution

freetype is vulnerable to arbitrary code execution. If a user loaded a carefully-crafted font file with an application linked against FreeType, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application...

Arbitrary Code Execution

thunderbird is vulnerable to arbitrary code execution. A flaw was found in the way Thunderbird processed text/enhanced and text/richtext formatted mail message. A specially crafted mail message could execute arbitrary code with the privileges of the user running Thunderbird...

CVE-2020-9286

An improper authorization vulnerability in FortiADC may allow a remote authenticated user with low privileges to perform certain actions such as rebooting the system...

CVE-2020-7053

A use-after-free flaw was found in the Linux kernel’s GPU driver functionality when destroying GEM context. A local user could use this flaw to crash the system or potentially escalate their privileges. Mitigation In case of dedicated graphic card presence and i915 GPU is not being used, you can...

CVE-2020-11464

An issue was discovered in Deskpro before 2019.8.0. The /api/people endpoint failed to properly validate a user's privilege, allowing an attacker to retrieve sensitive information about all users registered on the system. This includes their full name, privilege, email address, phone number, etc...

CVE-2020-11463

An issue was discovered in Deskpro before 2019.8.0. The /api/emailaccounts endpoint failed to properly validate a user's privilege, allowing an attacker to retrieve cleartext credentials of all helpdesk email accounts, including incoming and outgoing email credentials. This enables an attacker to...

CVE-2020-11464

An issue was discovered in Deskpro before 2019.8.0. The /api/people endpoint failed to properly validate a user's privilege, allowing an attacker to retrieve sensitive information about all users registered on the system. This includes their full name, privilege, email address, phone number, etc...

CVE-2020-11464

Deskpro CVE-2020-11464 affects Deskpro before 2019.8.0, where /api/people failed to properly validate a user’s privilege, allowing retrieval of sensitive information for all users (full name, privilege, email, phone, etc.). The issue is documented across multiple feeds, with remediation reference...

Authentication flaw

A CWE-306: Missing Authentication for Critical Function vulnerability exists in IGSS Versions 14 and prior using the service: IGSSupdate, which could allow a local user to execute processes that otherwise require escalation privileges when sending local network commands to the IGSS Update Service...