CVE-2020-15903

An issue was found in Nagios XI before 5.7.3. There is a privilege escalation vulnerability in backend scripts that ran as root where some included files were editable by nagios user. This issue was fixed in version 5.7.3...

vBulletin Cross-Site Scripting Vulnerability (CNVD-2020-50941)

vBulletin is a suite of forum programs that can be customized to suit your needs. A cross-site scripting vulnerability exists in the Admin CP in vBulletin 5.6.3. The vulnerability can be exploited to conduct cross-site scripting attacks via admincp/attachment.php&do=rebuild&type= URI...

PT-2020-6165

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.9-rc4 Description A flaw in the Linux kernel allows memory corruption to be exploited, potentially granting root privileges to unprivileged processes. This poses a significant threat to data confidentiality and...

CVE-2020-25043

The installer of Kaspersky VPN Secure Connection prior to 5.0 was vulnerable to arbitrary file deletion that could allow an attacker to delete any file in the system...

TP-Link TL-WA855RE Elevation of Privilege Vulnerability

The TP-Link TL-WA855RE is a 300Mbps Wi-Fi range extender. An elevation of privilege vulnerability exists in the TP-Link TL-WA855RE V5 version 20200415-rel37464. An attacker can perform a factory reset and reboot via a TDDPRESET POST request, which can be exploited to set a new administrative...

PT-2020-15707

Name of the Vulnerable Software and Affected Versions: TP-Link TL-WA855RE version V5 20200415-rel37464 Description: TP-Link TL-WA855RE devices allow an unauthenticated attacker on the same network to submit a TDDP RESET POST request, leading to a factory reset and reboot. This allows the attacker...

Unspecified Vulnerability in SAP Banking Services

SAP Banking Services is a banking services solution from SAP. A security vulnerability exists in SAP Banking Services versions 400, 450, and 500 that stems from a lack of privilege checking in the program. An attacker could exploit the vulnerability to display a user's General Market Data GMD and...

kernel: sync of excessive duration via an XFS v5 image with crafted metadata

A flaw was discovered in the XFS source in the Linux kernel. This flaw allows an attacker with the ability to mount an XFS filesystem, to trigger a denial of service while attempting to sync a file located on an XFS v5 image with crafted metadata...

Squid Denial of Service Vulnerability (CNVD-2020-48582)

Squid is a suite of proxy server and web caching server software. The software provides features such as caching the World Wide Web, filtering traffic, and proxying the Internet. A security vulnerability exists in Squid versions prior to 4.13 and 5.0.4 in the 5.x series, which can be exploited by...

mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2020)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 5.7.28 and prior and 8.0.18 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL...

mysql: InnoDB unspecified vulnerability (CPU Jan 2020)

Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 5.7.28 and prior and 8.0.17 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2020)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 5.6.46 and prior, 5.7.28 and prior and 8.0.18 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to...

Lua Buffer Overflow Vulnerability

Lua is a lightweight, extensible open source scripting language from the Lua team. A buffer overflow vulnerability exists in luaOpushvfstring in Lua 5.4.0 and earlier versions, which originates when a networked system or product performs an operation in memory without properly validating the data...

UBUNTU-CVE-2020-16092

In QEMU through 5.0.0, an assertion failure can occur in the network packet processing. This issue affects the e1000e and vmxnet3 network devices. A malicious guest user/process could use this flaw to abort the QEMU process on the host, resulting in a denial of service condition in...

Researcher Demonstrates Several Zoom Vulnerabilities at DEF CON 28

Popular video conferencing app Zoom has addressed several security vulnerabilities, two of which affect its Linux client that could have allowed an attacker with access to a compromised system to read and exfiltrate Zoom user data—and even run stealthy malware as a sub-process of a trusted...

IBM Security Identity Governance and Intelligence Information Disclosure Vulnerability (CNVD-2020-45099)

IBM Security Identity Governance and Intelligence IGI is a suite of identity governance solutions from IBM in the United States. The product includes features such as lifecycle management, access risk assessment and identity management. A security vulnerability exists in IBM Security IGI version...

Advantech iView Input Validation Vulnerability (CVE-2020-14503)

Advantech iView is a device management application from Advantech. An input validation error vulnerability exists in Advantech iView 5.6 and prior versions. A remote attacker can exploit this vulnerability to execute arbitrary code...

CVE-2020-9682

Adobe Creative Cloud Desktop Application versions 5.1 and earlier have a symlink vulnerability vulnerability. Successful exploitation could lead to arbitrary file system write...

CVE-2020-9670

Adobe Creative Cloud Desktop Application versions 5.1 and earlier have a symlink vulnerability vulnerability. Successful exploitation could lead to privilege escalation...

CVE-2020-14499

Advantech iView, versions 5.6 and prior, has an improper access control vulnerability. Successful exploitation of this vulnerability may allow an attacker to obtain all user accounts credentials...