Weekly Digest: a new vulnerability is published on the National Vulnerability Database (42 items)

New vulnerabilities from the NVD: CVE-2020-25624 hw/usb/hcd-ohci.c in QEMU 5.0.0 has a stack-based buffer over-read via values obtained from the host controller driver. Published at: November 30, 2020 at 09:15AM View on website November 30, 2020 at 02:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-25537 File upload vulnerability exists in UCMS 1.5.0, and the attacker can take advantage of this vulnerability to obtain server management permission. Published at: November 30, 2020 at 08:15PM View on website November 30, 2020 at 09:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-17901 Cross-site request forgery (CSRF) in PbootCMS 1.3.2 allows attackers to change the password of a user. Published at: November 30, 2020 at 09:15PM View on website November 30, 2020 at 11:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-16850 Mitsubishi MELSEC iQ-R Series PLCs with firmware 49 allow an unauthenticated attacker to halt the industrial process by sending a crafted packet over the network. This denial of service attack exposes Improper Input Validation. After halting, physical access to the PLC is required in order to restore production, and the device state is lost. This is related to R04CPU, RJ71GF11-T2, R04CPU, and RJ71GF11-T2. Published at: December 01, 2020 at 12:15AM View on website December 01, 2020 at 01:36AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-16849 An issue was discovered on Canon MF237w 06.07 devices. An "Improper Handling of Length Parameter Inconsistency" issue in the IPv4/ICMPv4 component, when handling a packet sent by an unauthenticated network attacker, may expose Sensitive Information. Published at: December 01, 2020 at 12:15AM View on website December 01, 2020 at 01:36AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-11867 Audacity through 2.3.3 saves temporary files to /var/tmp/audacity-$USER by default. After Audacity creates the temporary directory, it sets its permissions to 755. Any user on the system can read and play the temporary audio .au files located there. Published at: December 01, 2020 at 12:15AM View on website December 01, 2020 at 01:36AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-14193 Affected versions of Automation for Jira - Server allowed remote attackers to read and render files as mustache templates in files inside the WEB-INF/classes & <jira-installation>/jira/bin directories via a template injection vulnerability in Jira smart values using mustache partials. The affected versions are those before version 7.1.15. Published at: December 01, 2020 at 01:15AM View on website December 01, 2020 at 03:36AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-15257 containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. In containerd before versions 1.3.9 and 1.4.3, the containerd-shim API is improperly exposed to host network containers. Access controls for the shim’s API socket verified that the connecting process had an effective UID of 0, but did not otherwise restrict access to the abstract Unix domain socket. This would allow malicious containers running in the same network namespace as the shim, with an effective UID of 0 but otherwise reduced privileges, to cause new processes to be run with elevated privileges. This vulnerability has been fixed in containerd 1.3.9 and 1.4.3. Users should update to these versions as soon as they are released. It should be noted that containers started with an old version of containerd-shim should be stopped and restarted, as running containers will continue to be vulnerable even after an upgrade. If you are not providing the ability for untrusted users to start containers in the same network namespace as the shim (typically the "host" network namespace, for example with docker run --net=host or hostNetwork: true in a Kubernetes pod) and run with an effective UID of 0, you are not vulnerable to this issue. If you are running containers with a vulnerable configuration, you can deny access to all abstract sockets with AppArmor by adding a line similar to deny unix addr=@**, to your policy. It is best practice to run containers with a reduced set of privileges, with a non-zero UID, and with isolated namespaces. The containerd maintainers strongly advise against sharing namespaces with the host. Reducing the set of isolation mechanisms used for a container necessarily increases that container's privilege, regardless of what container runtime is used for running that container. Published at: December 01, 2020 at 05:15AM View on website December 01, 2020 at 08:36AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-25181 WECON PLC Editor Versions 1.3.8 and prior has a heap-based buffer overflow vulnerabilities have been identified that may allow arbitrary code execution. Published at: December 01, 2020 at 05:15PM View on website December 01, 2020 at 07:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-25177 WECON PLC Editor Versions 1.3.8 and prior has a stack-based buffer overflow vulnerability has been identified that may allow arbitrary code execution. Published at: December 01, 2020 at 05:15PM View on website December 01, 2020 at 07:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-11990 We have resolved a security issue in the camera plugin that could have affected certain Cordova (Android) applications. An attacker who could install (or lead the victim to install) a specially crafted (or malicious) Android application would be able to access pictures taken with the app externally. Published at: December 01, 2020 at 07:15PM View on website December 01, 2020 at 09:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2019-16958 Cross-site Scripting (XSS) vulnerability in SolarWinds Web Help Desk 12.7.0 allows attacker to inject arbitrary web script or HTML via Location Name. Published at: December 01, 2020 at 08:15PM View on website December 01, 2020 at 09:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-14383 A flaw was found in samba's DNS server. An authenticated user could use this flaw to the RPC server to crash. This RPC server, which also serves protocols other than dnsserver, will be restarted after a short delay, but it is easy for an authenticated non administrative attacker to crash it again as soon as it returns. The Samba DNS server itself will continue to operate, but many RPC services will not. Published at: December 02, 2020 at 03:15AM View on website December 02, 2020 at 08:36AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-14305 An out-of-bounds memory write flaw was found in how the Linux kernel’s Voice Over IP H.323 connection tracking functionality handled connections on ipv6 port 1720. This flaw allows an unauthenticated remote user to crash the system, causing a denial of service. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Published at: December 02, 2020 at 03:15AM View on website December 02, 2020 at 08:36AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-14260 HCL Domino is susceptible to a Buffer Overflow vulnerability in DXL due to improper validation of user input. A successful exploit could enable an attacker to crash Domino or execute attacker-controlled code on the server system. Published at: December 02, 2020 at 03:15AM View on website December 02, 2020 at 08:36AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2012-0955 software-properties was vulnerable to a person-in-the-middle attack due to incorrect TLS certificate validation in softwareproperties/ppa.py. software-properties didn't check TLS certificates under python2 and only checked certificates under python3 if a valid certificate bundle was provided. Fixed in software-properties version 0.92. Published at: December 02, 2020 at 03:15AM View on website December 02, 2020 at 08:36AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-14369 This release fixes a Cross Site Request Forgery vulnerability was found in Red Hat CloudForms which forces end users to execute unwanted actions on a web application in which the user is currently authenticated. An attacker can make a forgery HTTP request to the server by crafting custom flash file which can force the user to perform state changing requests like provisioning VMs, running ansible playbooks and so forth. Published at: December 02, 2020 at 05:15PM View on website December 02, 2020 at 07:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-12524 Uncontrolled Resource Consumption can be exploited to cause the Phoenix Contact HMIs BTP 2043W, BTP 2070W and BTP 2102W in all versions to become unresponsive and not accurately update the display content (Denial of Service). Published at: December 02, 2020 at 05:15PM View on website December 02, 2020 at 07:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-13956 Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution. Published at: December 02, 2020 at 07:15PM View on website December 02, 2020 at 09:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-13498 An exploitable vulnerability exists in the way Pixar OpenUSD 20.05 handles parses certain encoded types. A specially crafted malformed file can trigger an arbitrary out of bounds memory access in SdfPath Type Index. This vulnerability could be used to bypass mitigations and aid further exploitation. To trigger this vulnerability, the victim needs to access an attacker-provided malformed file. Published at: December 02, 2020 at 08:15PM View on website December 02, 2020 at 09:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-13497 An exploitable vulnerability exists in the way Pixar OpenUSD 20.05 handles parses certain encoded types. A specially crafted malformed file can trigger an arbitrary out of bounds memory access in String Type Index. This vulnerability could be used to bypass mitigations and aid further exploitation. To trigger this vulnerability, the victim needs to access an attacker-provided malformed file. Published at: December 02, 2020 at 08:15PM View on website December 02, 2020 at 09:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-13496 An exploitable vulnerability exists in the way Pixar OpenUSD 20.05 handles parses certain encoded types. A specially crafted malformed file can trigger an arbitrary out of bounds memory access in TfToken Type Index. This vulnerability could be used to bypass mitigations and aid further exploitation. To trigger this vulnerability, the victim needs to access an attacker-provided malformed file. Published at: December 02, 2020 at 08:15PM View on website December 02, 2020 at 09:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-13494 A heap overflow vulnerability exists in the Pixar OpenUSD 20.05 parsing of compressed string tokens in binary USD files. A specially crafted malformed file can trigger a heap overflow which can result in out of bounds memory access which could lead to information disclosure. This vulnerability could be used to bypass mitigations and aid further exploitation. To trigger this vulnerability, victim needs to access an attacker-provided malformed file. Published at: December 02, 2020 at 08:15PM View on website December 02, 2020 at 09:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-13493 A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files. A specially crafted USDC file format path jumps decompression heap overflow in a way path jumps are processed. To trigger this vulnerability, the victim needs to open an attacker-provided malformed file. Published at: December 02, 2020 at 08:15PM View on website December 02, 2020 at 09:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2017-2910 An exploitable Out-of-bounds Write vulnerability exists in the xls_addCell function of libxls 2.0. A specially crafted xls file can cause a memory corruption resulting in remote code execution. An attacker can send malicious xls file to trigger this vulnerability. Published at: December 02, 2020 at 08:15PM View on website December 02, 2020 at 09:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2017-14451 An exploitable out-of-bounds read vulnerability exists in libevm (Ethereum Virtual Machine) of CPP-Ethereum. A specially crafted smart contract code can cause an out-of-bounds read which can subsequently trigger an out-of-bounds write resulting in remote code execution. An attacker can create/send malicious smart contract to trigger this vulnerability. Published at: December 02, 2020 at 08:15PM View on website December 02, 2020 at 09:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-2324 Jenkins CVS Plugin 2.16 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. Published at: December 03, 2020 at 06:15PM View on website December 03, 2020 at 07:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-2323 Jenkins Chaos Monkey Plugin 0.4 and earlier does not perform permission checks in an HTTP endpoint, allowing attackers with Overall/Read permission to access the Chaos Monkey page and to see the history of actions. Published at: December 03, 2020 at 06:15PM View on website December 03, 2020 at 07:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-2322 Jenkins Chaos Monkey Plugin 0.3 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to generate load and to generate memory leaks. Published at: December 03, 2020 at 06:15PM View on website December 03, 2020 at 07:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-2321 A cross-site request forgery (CSRF) vulnerability in Jenkins Shelve Project Plugin 3.0 and earlier allows attackers to shelve, unshelve, or delete a project. Published at: December 03, 2020 at 06:15PM View on website December 03, 2020 at 07:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-2320 Jenkins Plugin Installation Manager Tool 2.1.3 and earlier does not verify plugin downloads. Published at: December 03, 2020 at 06:15PM View on website December 03, 2020 at 07:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-14318 A flaw was found in the way samba handled file and directory permissions. An authenticated user could use this flaw to gain access to certain file and directory information which otherwise would be unavailable to the attacker. Published at: December 03, 2020 at 06:15PM View on website December 03, 2020 at 07:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-14381 A flaw was found in the Linux kernel’s futex implementation. This flaw allows a local attacker to corrupt system memory or escalate their privileges when creating a futex on a filesystem that is about to be unmounted. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Published at: December 03, 2020 at 07:15PM View on website December 03, 2020 at 09:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-14351 A flaw was found in the Linux kernel. A use-after-free memory flaw was found in the perf subsystem allowing a local attacker with permission to monitor perf events to corrupt memory and possibly escalate privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Published at: December 03, 2020 at 07:15PM View on website December 03, 2020 at 09:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-14339 A flaw was found in libvirt, where it leaked a file descriptor for `/dev/mapper/control` into the QEMU process. This file descriptor allows for privileged operations to happen against the device-mapper on the host. This flaw allows a malicious guest user or process to perform operations outside of their standard permissions, potentially causing serious damage to the host operating system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Published at: December 03, 2020 at 07:15PM View on website December 03, 2020 at 09:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-13584 An exploitable use-after-free vulnerability exists in WebKitGTK browser version 2.30.1 x64. A specially crafted HTML web page can cause a use-after-free condition, resulting in a remote code execution. The victim needs to visit a malicious web site to trigger this vulnerability. Published at: December 03, 2020 at 07:15PM View on website December 03, 2020 at 09:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-13543 A code execution vulnerability exists in the WebSocket functionality of Webkit WebKitGTK 2.30.0. A specially crafted web page can trigger a use-after-free vulnerability which can lead to remote code execution. An attacker can get a user to visit a webpage to trigger this vulnerability. Published at: December 03, 2020 at 07:15PM View on website December 03, 2020 at 09:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-13542 A local privilege elevation vulnerability exists in the file system permissions of LogicalDoc 8.5.1 installation. Depending on the vector chosen, an attacker can either replace the service binary or replace DLL files loaded by the service, both which get executed by a service thus executing arbitrary commands with System privileges. Published at: December 03, 2020 at 07:15PM View on website December 03, 2020 at 09:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-13531 A use-after-free vulnerability exists in a way Pixar OpenUSD 20.08 processes reference paths textual USD files. A specially crafted file can trigger the reuse of a freed memory which can result in further memory corruption and arbitrary code execution. To trigger this vulnerability, the victim needs to open an attacker-provided malformed file. Published at: December 03, 2020 at 07:15PM View on website December 03, 2020 at 09:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-13525 The sort parameter in the download page /sysworkflow/en/neoclassic/reportTables/reportTables_Ajax is vulnerable to SQL injection in ProcessMaker 3.4.11. A specially crafted HTTP request can cause an SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability. Published at: December 03, 2020 at 08:15PM View on website December 03, 2020 at 09:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-13524 An out-of-bounds memory corruption vulnerability exists in the way Pixar OpenUSD 20.05 uses SPECS data from binary USD files. A specially crafted malformed file can trigger an out-of-bounds memory access and modification which results in memory corruption. To trigger this vulnerability, the victim needs to access an attacker-provided malformed file. Published at: December 03, 2020 at 08:15PM View on website December 03, 2020 at 09:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2018-21270 Versions less than 0.0.6 of the Node.js stringstream module are vulnerable to an out-of-bounds read because of allocation of uninitialized buffers when a number is passed in the input stream (when using Node.js 4.x). Published at: December 03, 2020 at 11:15PM View on website December 04, 2020 at 01:36AM via National Vulnerability Database