Weekly Digest: a new vulnerability is published on the National Vulnerability Database (32 items)

New vulnerabilities from the NVD: CVE-2020-11920 An issue was discovered in Svakom Siime Eye 14.1.00000001.3.330.0.0.3.14. A command injection vulnerability resides in the HOST/IP section of the NFS settings menu in the webserver running on the device. By injecting Bash commands via shell metacharacters here, the device executes arbitrary code with root privileges (all of the device's services are running as root). Published at: February 08, 2021 at 04:15AM View on website February 08, 2021 at 08:36AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-11915 An issue was discovered in Svakom Siime Eye 14.1.00000001.3.330.0.0.3.14. By sending a set_params.cgi?telnetd=1&save=1&reboot=1 request to the webserver, it is possible to enable the telnet interface on the device. The telnet interface can then be used to obtain access to the device with root privileges via a reecam4debug default password. This default telnet password is the same across all Siime Eye devices. In order for the attack to be exploited, an attacker must be physically close in order to connect to the device's Wi-Fi access point. Published at: February 08, 2021 at 04:15AM View on website February 08, 2021 at 08:36AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-1779 When dynamic templates are used (OTRSTicketForms), admin can use OTRS tags which are not masked properly and can reveal sensitive information. This issue affects: OTRS AG OTRSTicketForms 6.0.x version 6.0.40 and prior versions; 7.0.x version 7.0.29 and prior versions; 8.0.x version 8.0.3 and prior versions. Published at: February 08, 2021 at 01:15PM View on website February 08, 2021 at 03:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-16629 PhpOK 5.4.137 contains a SQL injection vulnerability that can inject an attachment data through SQL, and then call the attachment replacement function through api.php to write a PHP file to the target path. Published at: February 08, 2021 at 05:15PM View on website February 08, 2021 at 07:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-13947 An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the message.jsp page of Apache ActiveMQ versions 5.15.12 through 5.16.0. Published at: February 09, 2021 at 12:15AM View on website February 09, 2021 at 01:36AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-14391 A flaw was found in the GNOME Control Center in Red Hat Enterprise Linux 8 versions prior to 8.2, where it improperly uses Red Hat Customer Portal credentials when a user registers a system through the GNOME Settings User Interface. This flaw allows a local attacker to discover the Red Hat Customer Portal password. The highest threat from this vulnerability is to confidentiality. Published at: February 09, 2021 at 01:15AM View on website February 09, 2021 at 03:36AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-13461 Username enumeration in present in Tufin SecureTrack. It's affecting all versions of SecureTrack. The vendor has decided not to fix this vulnerability. Vendor's response: "This attack requires access to the internal network. If an attacker is part of the internal network, they do not require access to TOS to know the usernames". Published at: February 09, 2021 at 07:15AM View on website February 09, 2021 at 08:36AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-13460 Multiple Cross-Site Request Forgery (CSRF) vulnerabilities were present in Tufin SecureTrack, affecting all versions prior to R20-2 GA. Published at: February 09, 2021 at 07:15AM View on website February 09, 2021 at 08:36AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-13409 Tufin SecureTrack < R20-2 GA contains reflected + stored XSS (as in, the value is reflected back to the user, but is also stored within the DB and can be later triggered again by the same victim, or also later by different users). Both stored, and reflected payloads are triggerable by admin, so malicious non-authenticated user could get admin level access. Even malicious low-privileged user can inject XSS, which can be executed by admin, potentially elevating privileges and obtaining admin access. (issue 3 of 3) Published at: February 09, 2021 at 07:15AM View on website February 09, 2021 at 08:36AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-13408 Tufin SecureTrack < R20-2 GA contains reflected + stored XSS (as in, the value is reflected back to the user, but is also stored within the DB and can be later triggered again by the same victim, or also later by different users). Both stored, and reflected payloads are triggerable by admin, so malicious non-authenticated user could get admin level access. Even malicious low-privileged user can inject XSS, which can be executed by admin, potentially elevating privileges and obtaining admin access. (issue 2 of 3) Published at: February 09, 2021 at 07:15AM View on website February 09, 2021 at 08:36AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-13407 Tufin SecureTrack < R20-2 GA contains reflected + stored XSS (as in, the value is reflected back to the user, but is also stored within the DB and can be later triggered again by the same victim, or also later by different users). Both stored, and reflected payloads are triggerable by admin, so malicious non-authenticated user could get admin level access. Even malicious low-privileged user can inject XSS, which can be executed by admin, potentially elevating privileges and obtaining admin access. (issue 1 of 3) Published at: February 09, 2021 at 07:15AM View on website February 09, 2021 at 08:36AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-13462 Insecure Direct Object Reference (IDOR) exists in Tufin SecureChange, affecting all versions prior to R20-2 GA. Fixed in version R20-2 GA. Published at: February 09, 2021 at 08:15AM View on website February 09, 2021 at 01:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-16044 Use after free in WebRTC in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially exploit heap corruption via a crafted SCTP packet. Published at: February 09, 2021 at 04:15PM View on website February 09, 2021 at 05:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-10048 A vulnerability has been identified in SIMATIC PCS 7 (All versions), SIMATIC WinCC (All versions < V7.5 SP2). Due to an insecure password verification process, an attacker could bypass the password protection set on protected files, thus being granted access to the protected content, circumventing authentication. Published at: February 09, 2021 at 07:15PM View on website February 09, 2021 at 09:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-13117 Wavlink WN575A4 and WN579X3 devices through 2020-05-15 allow unauthenticated remote users to inject commands via the key parameter in a login request. Published at: February 09, 2021 at 09:15PM View on website February 09, 2021 at 11:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2019-17582 A use-after-free in the _zip_dirent_read function of zip_dirent.c in libzip 1.2.0 allows attackers to have an unspecified impact by attempting to unzip a malformed ZIP archive. NOTE: the discoverer states "This use-after-free is triggered prior to the double free reported in CVE-2017-12858." Published at: February 09, 2021 at 09:15PM View on website February 09, 2021 at 11:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-13546 In SoftMaker Software GmbH SoftMaker Office TextMaker 2021 (revision 1014), a specially crafted document can cause the document parser to miscalculate a length used to allocate a buffer, later upon usage of this buffer the application will write outside its bounds resulting in a heap-based buffer overflow. An attacker can entice the victim to open a document to trigger this vulnerability. Published at: February 10, 2021 at 07:15PM View on website February 10, 2021 at 09:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-13577 A denial-of-service vulnerability exists in the WS-Security plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability. Published at: February 10, 2021 at 10:15PM View on website February 10, 2021 at 11:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-13576 A code execution vulnerability exists in the WS-Addressing plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to remote code execution. An attacker can send an HTTP request to trigger this vulnerability. Published at: February 10, 2021 at 10:15PM View on website February 10, 2021 at 11:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-13575 A denial-of-service vulnerability exists in the WS-Addressing plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability. Published at: February 10, 2021 at 10:15PM View on website February 10, 2021 at 11:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-13574 A denial-of-service vulnerability exists in the WS-Security plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability. Published at: February 10, 2021 at 10:15PM View on website February 10, 2021 at 11:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-13565 An open redirect vulnerability exists in the return_page redirection functionality of phpGACL 3.3.7, OpenEMR 5.0.2 and OpenEMR development version 6.0.0 (commit babec93f600ff1394f91ccd512bcad85832eb6ce). A specially crafted HTTP request can redirect users to an arbitrary URL. An attacker can provide a crafted URL to trigger this vulnerability. Published at: February 10, 2021 at 10:15PM View on website February 10, 2021 at 11:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-13548 In Foxit Reader 10.1.0.37527, a specially crafted PDF document can trigger reuse of previously free memory which can lead to arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability. Published at: February 10, 2021 at 10:15PM View on website February 10, 2021 at 11:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-13572 A heap overflow vulnerability exists in the way the GIF parser decodes LZW compressed streams in Accusoft ImageGear 19.8. A specially crafted malformed file can trigger a heap overflow, which can result in arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability. Published at: February 11, 2021 at 12:15AM View on website February 11, 2021 at 01:36AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-13571 An out-of-bounds write vulnerability exists in the SGI RLE decompression functionality of Accusoft ImageGear 19.8. A specially crafted malformed file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability. Published at: February 11, 2021 at 12:15AM View on website February 11, 2021 at 01:36AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-13561 An out-of-bounds write vulnerability exists in the TIFF parser of Accusoft ImageGear 19.8. A specially crafted malformed file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability. Published at: February 11, 2021 at 12:15AM View on website February 11, 2021 at 01:36AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-13186 An Anti CSRF mechanism was discovered missing in the Teradici Cloud Access Connector v31 and earlier in a specific web form, which allowed an attacker with knowledge of both a machineID and user GUID to modify data if a user clicked a malicious link. Published at: February 11, 2021 at 08:15PM View on website February 11, 2021 at 09:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-13185 Certain web application pages in the authenticated section of the Teradici Cloud Access Connector prior to v18 were accessible without the need to specify authentication tokens, which allowed an attacker in the ability to execute sensitive functions without credentials. Published at: February 11, 2021 at 08:15PM View on website February 11, 2021 at 09:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-10734 A vulnerability was found in keycloak in the way that the OIDC logout endpoint does not have CSRF protection. Versions shipped with Red Hat Fuse 7, Red Hat Single Sign-on 7, and Red Hat Openshift Application Runtimes are believed to be vulnerable. Published at: February 11, 2021 at 08:15PM View on website February 11, 2021 at 09:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2019-19005 A bitmap double free in main.c in autotrace 0.31.1 allows attackers to cause an unspecified impact via a malformed bitmap image. This may occur after the use-after-free in CVE-2017-9182. Published at: February 11, 2021 at 11:15PM View on website February 12, 2021 at 01:36AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2019-19004 A biWidth*biBitCnt integer overflow in input-bmp.c in autotrace 0.31.1 allows attackers to provide an unexpected input value to malloc via a malformed bitmap image. Published at: February 11, 2021 at 11:15PM View on website February 12, 2021 at 01:36AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2013-20001 An issue was discovered in OpenZFS through 2.0.3. When an NFS share is exported to IPv6 addresses via the sharenfs feature, there is a silent failure to parse the IPv6 address data, and access is allowed to everyone. IPv6 restrictions from the configuration are not applied. Published at: February 12, 2021 at 10:15PM View on website February 12, 2021 at 11:36PM via National Vulnerability Database