New vulnerabilities from the NVD: CVE-2018-21036 | | Sails.js before v1.0.0-46 allows attackers to cause a denial of service with a single request because there is no error handler in sails-hook-sockets to handle an empty pathname in a WebSocket request. Published at: July 21, 2020 at 05:15PM View on website July 21, 2020 at 07:36PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2016-7064 | | A flaw was found in pritunl-client before version 1.0.1116.6. A lack of signature verification leads to sensitive information leakage Published at: July 21, 2020 at 08:15PM View on website July 21, 2020 at 09:36PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2016-7063 | | A flaw was found in pritunl-client before version 1.0.1116.6. Arbitrary write to user specified path may lead to privilege escalation. Published at: July 21, 2020 at 08:15PM View on website July 21, 2020 at 09:36PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2015-5238 | | ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2015-3796. Reason: This candidate is a reservation duplicate of CVE-2015-3796. Notes: All CVE users should reference CVE-2015-3796 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. Published at: July 21, 2020 at 09:15PM View on website July 21, 2020 at 11:36PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2020-12774 | | D-Link DSL-7740C does not properly validate user input, which allows an authenticated LAN user to inject arbitrary command. Published at: July 22, 2020 at 11:15AM View on website July 22, 2020 at 01:36PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2019-18619 | | Incorrect parameter validation in the synaTee component of Synaptics WBF drivers using an SGX enclave (all versions prior to 2019-11-15) allows a local user to execute arbitrary code in the enclave (that can compromise confidentiality of enclave data) via APIs that accept invalid pointers. Published at: July 22, 2020 at 05:15PM View on website July 22, 2020 at 07:36PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2019-18618 | | Incorrect access control in the firmware of Synaptics VFS75xx family fingerprint sensors that include external flash (all versions prior to 2019-11-15) allows a local administrator or physical attacker to compromise the confidentiality of sensor data via injection of an unverified partition table. Published at: July 22, 2020 at 05:15PM View on website July 22, 2020 at 07:36PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2019-16244 | | OMERO.server before 5.6.1 allows attackers to bypass the security filters and access hidden objects via a crafted query. Published at: July 22, 2020 at 07:15PM View on website July 22, 2020 at 09:36PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2014-1422 | | In Ubuntu's trust-store, if a user revokes location access from an application, the location is still available to the application because the application will honour incorrect, cached permissions. This is because the cache was not ordered by creation time by the Select struct in src/core/trust/impl/sqlite3/store.cpp. Fixed in trust-store (Ubuntu) version 1.1.0+15.04.20150123-0ubuntu1 and trust-store (Ubuntu RTM) version 1.1.0+15.04.20150123~rtm-0ubuntu1. Published at: July 22, 2020 at 09:15PM View on website July 22, 2020 at 11:36PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2020-10917 | | This vulnerability allows remote attackers to execute arbitrary code on affected installations of NEC ESMPRO Manager 6.42. Authentication is not required to exploit this vulnerability. The specific flaw exists within the RMI service. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-10007. Published at: July 23, 2020 at 02:15AM View on website July 23, 2020 at 03:36AM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2020-11440 | | httpRpmFs in WebCLI in Wind River VxWorks 5.5 through 7 SR0640 has no check for an escape from the web root. Published at: July 23, 2020 at 05:15PM View on website July 23, 2020 at 07:36PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2019-11252 | | The Kubernetes kube-controller-manager in versions v1.0-v1.17 is vulnerable to a credential leakage via error messages in mount failure logs and events for AzureFile and CephFS volumes. Published at: July 23, 2020 at 06:15PM View on website July 23, 2020 at 07:36PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2020-12638 | | An encryption-bypass issue was discovered on Espressif ESP-IDF devices through 4.2, ESP8266_NONOS_SDK devices through 3.0.3, and ESP8266_RTOS_SDK devices through 3.3. Broadcasting forged beacon frames forces a device to change its authentication mode to OPEN, effectively disabling its 802.11 encryption. Published at: July 23, 2020 at 07:15PM View on website July 23, 2020 at 09:36PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2020-10922 | | This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the EA-HTTP.exe process. The issue results from the lack of proper input validation prior to further processing user requests. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-10527. Published at: July 23, 2020 at 07:15PM View on website July 23, 2020 at 09:36PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2020-10921 | | This vulnerability allows remote attackers to issue commands on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the EA-HTTP.exe process. The issue results from the lack of authentication prior to allowing alterations to the system configuration. An attacker can leverage this vulnerability to issue commands to the physical equipment controlled by the device. Was ZDI-CAN-10482. Published at: July 23, 2020 at 07:15PM View on website July 23, 2020 at 09:36PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2020-10920 | | This vulnerability allows remote attackers to execute arbitrary code on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the control service, which listens on TCP port 9999 by default. The issue results from the lack of authentication prior to allowing alterations to the system configuration. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-10493. Published at: July 23, 2020 at 07:15PM View on website July 23, 2020 at 09:36PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2020-10919 | | This vulnerability allows remote attackers to disclose sensitive information on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of passwords. When transmitting passwords, the process encrypts them in a recoverable format using a hard-coded key. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. Was ZDI-CAN-10185. Published at: July 23, 2020 at 07:15PM View on website July 23, 2020 at 09:36PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2020-10918 | | This vulnerability allows remote attackers to bypass authentication on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the authentication mechanism. The issue is due to insufficient authentication on post-authentication requests. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from unauthenticated users. Was ZDI-CAN-10182. Published at: July 23, 2020 at 07:15PM View on website July 23, 2020 at 09:36PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2020-11625 | | An issue was discovered in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD Indoor/Outdoor Mini IP Bullet Camera HD438. Failed web UI login attempts elicit different responses depending on whether a user account exists. Because the responses indicate whether a submitted username is valid or not, they make it easier to identify legitimate usernames. If a login request is sent to ISAPI/Security/sessionLogin/capabilities using a username that exists, it will return the value of the salt given to that username, even if the password is incorrect. However, if a login request is sent using a username that is not present in the database, it will return an empty salt value. This allows attackers to enumerate legitimate usernames, facilitating brute-force attacks. NOTE: this is different from CVE-2020-7057. Published at: July 24, 2020 at 12:15AM View on website July 24, 2020 at 01:36AM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2020-11624 | | An issue was discovered in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD Indoor/Outdoor Mini IP Bullet Camera HD438. They do not require users to change the default password for the admin account. They only show a pop-up window suggesting a change but there's no enforcement. An administrator can click Cancel and proceed to use the device without changing the password. Additionally, they disclose the default username within the login.js script. Since many attacks for IoT devices, including malware and exploits, are based on the usage of default credentials, it makes these cameras an easy target for malicious actors. Published at: July 24, 2020 at 12:15AM View on website July 24, 2020 at 01:36AM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2020-11623 | | An issue was discovered in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD Indoor/Outdoor Mini IP Bullet Camera HD438. An attacker with physical access to the UART interface could access additional diagnostic and configuration functionalities as well as the camera's bootloader. Successful exploitation could compromise confidentiality, integrity, and availability of the affected system. It could even render the device inoperable. Published at: July 23, 2020 at 11:15PM View on website July 24, 2020 at 01:36AM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2019-18834 | | Persistent XSS in the WooCommerce Subscriptions plugin before 2.6.3 for WordPress allows remote attackers to execute arbitrary JavaScript because Billing Details are mishandled in WCS_Admin_Post_Types in class-wcs-admin-post-types.php. Published at: July 23, 2020 at 11:15PM View on website July 24, 2020 at 01:36AM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2020-10610 | | In OSIsoft PI System multiple products and versions, a local attacker can modify a search path and plant a binary to exploit the affected PI System software to take control of the local computer at Windows system privilege level, resulting in unauthorized information disclosure, deletion, or modification. Published at: July 25, 2020 at 02:15AM View on website July 25, 2020 at 03:36AM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2020-10608 | | In OSIsoft PI System multiple products and versions, a local attacker can plant a binary and bypass a code integrity check for loading PI System libraries. This exploitation can target another local user of PI System software on the computer to escalate privilege and result in unauthorized information disclosure, deletion, or modification. Published at: July 25, 2020 at 02:15AM View on website July 25, 2020 at 03:36AM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2020-10606 | | In OSIsoft PI System multiple products and versions, a local attacker can exploit incorrect permissions set by affected PI System software. This exploitation can result in unauthorized information disclosure, deletion, or modification if the local computer also processes PI System data from other users, such as from a shared workstation or terminal server deployment. Published at: July 25, 2020 at 02:15AM View on website July 25, 2020 at 03:36AM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2020-10602 | | In OSIsoft PI System multiple products and versions, an authenticated remote attacker could crash PI Network Manager due to a race condition. This can result in blocking connections and queries to PI Data Archive. Published at: July 25, 2020 at 02:15AM View on website July 25, 2020 at 03:36AM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2020-10600 | | In OSIsoft PI System multiple products and versions, an authenticated remote attacker could crash PI Archive Subsystem when the subsystem is working under memory pressure. This can result in blocking queries to PI Data Archive. Published at: July 25, 2020 at 02:15AM View on website July 25, 2020 at 03:36AM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2020-10614 | | In OSIsoft PI System multiple products and versions, an authenticated remote attacker with write access to PI Vision databases could inject code into a display. Unauthorized information disclosure, deletion, or modification is possible if a victim views the infected display. Published at: July 25, 2020 at 03:15AM View on website July 25, 2020 at 08:36AM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2020-10604 | | In OSIsoft PI System multiple products and versions, a remote, unauthenticated attacker could crash PI Network Manager service through specially crafted requests. This can result in blocking connections and queries to PI Data Archive. Published at: July 25, 2020 at 03:15AM View on website July 25, 2020 at 08:36AM via National Vulnerability Database |
Няма коментари:
Публикуване на коментар