Unbreakable Enterprise kernel security update

4.14.35-1902.302.2 - KVM: x86: Protect pmuintel.c from Spectre-v1/L1TF attacks Marios Pomonis Orabug: 31191092 - KVM: x86: Protect MSR-based index computations in fixedmsrtosegunit from Spectre-v1/L1TF attacks Marios Pomonis Orabug: 31191092 - KVM: x86: Protect x86decodeinsn from Spectre-v1/L1TF...

CVE-2017-18754

Certain NETGEAR devices are affected by command injection by an authenticated user. This affects WNDR3700v4 before 1.0.2.88, WNDR4300v1 before 1.0.2.90, and WNR2000v5 before 1.0.0.58...

CVE-2019-7308

A bypass was found for the Spectre v1 hardening in the eBPF engine of the Linux kernel. The code in the kernel/bpf/verifier.c performs undesirable out-of-bounds speculation on pointer arithmetic in various cases, including cases of different branches with different state or limits to sanitize,...

CVE-2020-11576

Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames of valid non-SSO accounts because /api/v1/session returned 401 for an existing username and 404 otherwise...

CVE-2020-11576: Observable Discrepancy

Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames of valid non-SSO accounts because /api/v1/session returned 401 for an existing username and 404 otherwise...

CVE-2020-11515: URL Redirection to Untrusted Site

The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to create new URIs that redirect to an external web site via the unsecured rankmath/v1/updateRedirection REST API endpoint. In other words, this is not an "Open Redirect" issue; instead, it allows the...

Mirus Landing Page Cross Site Scripting

Exploit Title: Mirus Landing Pages V1 XSS Vulnerability Google Dork:N/A Date: 2020-04-03 Exploit Author: @ThelastVvV Vendor Homepage: https://mirus.co.il/ Version: Landing Pages v1 Tested on: Ubuntu --------------------------------------------------------- PoC 1 : XSS Vulnerability Payloads : In...

CVE-2020-0551

A flaw was found in Intel's microprocessors. Intel microprocessors contain an implementation weakness that allows for an 'inverse MDS' style attack to be performed during store operations writes to memory and are stuffed maliciously into microarchitectural buffers from which unsuspecting victim...

PT-2020-5301

Name of the Vulnerable Software and Affected Versions D-Link DSL-2640B versions prior to EU 4.01B Description The issue is related to insufficient input validation, allowing a remote attacker to reset the device's configuration by accessing an unauthenticated URL, such as "/api/v1/reset" or...

CVE-2020-10591

An issue was discovered in Walmart Labs Concord before 1.44.0. CORS Access-Control-Allow-Origin headers have a potentially unsafe dependency on Origin headers, and are not configurable. This allows remote attackers to discover host information, nodes, API metadata, and references to usernames via...

CVE-2020-10591: Undefined Security Weakness

An issue was discovered in Walmart Labs Concord before 1.44.0. CORS Access-Control-Allow-Origin headers have a potentially unsafe dependency on Origin headers, and are not configurable. This allows remote attackers to discover host information, nodes, API metadata, and references to usernames via...

PT-2020-12222

Name of the Vulnerable Software and Affected Versions Walmart Labs Concord versions prior to 1.44.0 Description An issue allows remote attackers to discover host information, nodes, API metadata, and references to usernames via the "api/v1/apikey" endpoint. This is due to CORS...

CVE-2020-10541: Undefined Security Weakness

Zoho ManageEngine OpManager before 12.4.179 allows remote code execution via a specially crafted Mail Server Settings v1 API request. This was fixed in 12.5.108...

PT-2020-12193

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine OpManager versions prior to 12.5.108 Description The issue allows remote code execution via a specially crafted "Mail Server Settings" v1 API request. Recommendations For versions prior to 12.5.108, update to version 12.5.108...

CVE-2019-19381

oauth/oauth2/v1/saml/ in Abacus OAuth Login 201901r4201910210000 before prior to R4 20.11.2019 Hotfix allows Reflected Cross Site Scripting XSS via an error message...

PT-2020-10151

Name of the Vulnerable Software and Affected Versions Abacus OAuth Login versions 2019 01 r4 20191021 0000 through prior to R4 20.11.2019 Hotfix Description The issue allows Reflected Cross Site Scripting XSS via an error message. This occurs in the "oauth/oauth2/v1/saml/" endpoint. Recommendatio...

CVE-2019-19381: Improper Neutralization of Input During Web Page Generation

oauth/oauth2/v1/saml/ in Abacus OAuth Login 201901r4201910210000 before prior to R4 20.11.2019 Hotfix allows Reflected Cross Site Scripting XSS via an error message...

CVE-2019-19995

A CSRF issue was discovered on Intelbras IWR 3000N 1.8.7 devices, leading to complete control of the router, as demonstrated by v1/system/user...

PT-2019-16037

Name of the Vulnerable Software and Affected Versions Intelbras IWR 3000N version 1.8.7 Description An issue allows remote attackers to cause a denial of service, resulting in a device reboot. This can be achieved by sending a malformed login request, specifically by misparsing the " string in JS...

PT-2019-16036

Name of the Vulnerable Software and Affected Versions Intelbras IWR 3000N version 1.8.7 Description A CSRF issue was discovered, allowing for complete control of the router. The issue is demonstrated by the "/v1/system/user" API endpoint. Recommendations For Intelbras IWR 3000N version 1.8.7, as ...