UBUNTU-CVE-2020-28924

An issue was discovered in Rclone before 1.53.3. Due to the use of a weak random number generator, the password generator has been producing weak passwords with much less entropy than advertised. The suggested passwords depend deterministically on the time the second rclone was started. This limi...

GO SMS Pro Android App Exposes Private Photos, Videos and Messages

A security weakness discovered in the GO SMS Pro Android app can be exploited to publicly expose media sent using the app, according to researchers. The GO SMS Pro application is a popular messenger app with more than 100 million downloads from the Google Play store. Researchers at Trustwave...

Cisco IoT Field Network Director SQL Injection Vulnerability

Cisco IoT Field Network Director IoT-FND is an end-to-end IoT management system from Cisco USA. The system features device management, asset tracking and smart metering. Cisco IoT Field Network Director suffers from a SQL injection vulnerability that results from insufficient input validation of...

Oracle VM VirtualBox Core Component Unauthorized Access

The vulnerability of the shaderGenerateMain function in the Core component of the Oracle VM VirtualBox software lies in insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

Intel Privilege Escalation

The vulnerability of Intel microprogramming software is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

In-band Protocol Negotiation And Robustness Weakness

aws-encryption-sdk suffers from an In-band protocol negotiation and robustness weakness. The SDK allows a unique ciphertext to be decrypted into different results due to the non-committing property of AES-GCM, and other AEAD ciphers such as AES-GCM-SIV, or XChaCha20Poly1305, when encrypting...

Windows Update Medic Service Privilege Escalation

The vulnerability of the Windows Update Medic Service component in Windows operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

Cisco SD-WAN Privilege Escalation

The vulnerability of the command-line interface CLI of Cisco SD-WAN software-defined networks is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

CVE-2020-7772: Undefined Security Weakness

This affects the package doc-path before 2.1.2...

PT-2020-18717

Name of the Vulnerable Software and Affected Versions Nagios XI version 5.7.4 Description The issue allows a local, low-privileged, authenticated user to weaken the permissions of files, resulting in low-privileged users being able to write to and execute arbitrary PHP code with root privileges...

Oracle Business Intelligence Enterprise Edition Installation Unauthorized Access

The vulnerability of the Installation component of the Oracle Business Intelligence Enterprise Edition software lies in insufficient validation of input data. Exploiting this vulnerability allows an attacker, operating remotely, to gain unauthorized access to protected information using the HTTP...

CVE-2020-17494

Untangle Firewall NG before 16.0 uses MD5 for passwords...

CVE-2020-8761

Inadequate encryption strength in subsystem for IntelR CSME versions before 13.0.40 and 13.30.10 may allow an unauthenticated user to potentially enable information disclosure via physical access...

PT-2021-5807

Name of the Vulnerable Software and Affected Versions Ansible Engine versions prior to 2.9.6 Description A flaw was found in the use of insufficiently random values in Ansible. Two random password lookups of the same length generate the equal value as the template caching action for the same file...

Core server component Code Execution

The vulnerability of the Core server component of Oracle WebLogic Server is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using the IIOP protocol remotely...

Oracle Business Intelligence Enterprise Edition Analytics Web Administration Data Modification

The vulnerability of the Analytics Web Administration component of the Oracle Business Intelligence Enterprise Edition relates to insufficient validation of input data. Exploiting this vulnerability may allow an attacker, operating remotely, to modify, add, or delete data using the HTTP protocol...

Pre-Login Component Unauthorized Access

The vulnerability of the Pre-Login component of the Oracle FLEXCUBE Direct Banking system relates to insufficient validation of entered data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information using the HTTP network...

PT-2020-4797 · Microsoft · Office Word

Name of the Vulnerable Software and Affected Versions: Microsoft Word affected versions not specified Description: The issue is related to a security feature bypass in Microsoft Word, associated with authentication weaknesses. Exploitation of this issue may allow an attacker to disclose protected...

Check Point Response to CVE-2020-28041 - NAT Slipstreaming

Cause The attack involves several vectors - Local IP disclosure, max MTU UDP and TCP calculation and leveraging a SIP parser weakness in fragmented HTTP packets which enables to "Slipstream" a legitimate SIP connection in an HTTP POST request generated by the victim's browser. The full descriptio...

Libraries Component Data Modification

The vulnerability of the Libraries component in Java SE and Java SE Embedded software platforms is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain access to modify, add, or delete data...