Weekly Digest: a new vulnerability is published on the National Vulnerability Database (38 items)

New vulnerabilities from the NVD: CVE-2020-28591 An out-of-bounds read vulnerability exists in the AMF File AMFParserContext::endElement() functionality of Slic3r libslic3r 1.3.0 and Master Commit 92abbc42. A specially crafted AMF file can lead to information disclosure. An attacker can provide a malicious file to trigger this vulnerability. Published at: March 03, 2021 at 08:15PM View on website March 07, 2021 at 08:36AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-28466 This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the server using configs that represent a service export/import cycles. Disclaimer from the maintainers: Running a NATS service which is exposed to untrusted users presents a heightened risk. Any remote execution flaw or equivalent seriousness, or denial-of-service by unauthenticated users, will lead to prompt releases by the NATS maintainers. Fixes for denial of service issues with no threat of remote execution, when limited to account holders, are likely to just be committed to the main development branch with no special attention. Those who are running such services are encouraged to build regularly from git. Published at: March 07, 2021 at 12:15PM View on website March 07, 2021 at 01:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2009-20001 An issue was discovered in MantisBT before 2.24.5. It associates a unique cookie string with each user. This string is not reset upon logout (i.e., the user session is still considered valid and active), allowing an attacker who somehow gained access to a user's cookie to login as them. Published at: March 07, 2021 at 10:15PM View on website March 07, 2021 at 11:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-27817 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Published at: March 08, 2021 at 06:15PM View on website March 08, 2021 at 07:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-23967 Dr.Web Security Space versions 11 and 12 allow elevation of privilege for local users without administrative privileges to NT AUTHORITY\SYSTEM due to insufficient control during autoupdate. Published at: March 08, 2021 at 05:15PM View on website March 08, 2021 at 07:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-27838 A flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients (like client secret) without authentication which could be an issue if the same PUBLIC client changed to CONFIDENTIAL later. The highest threat from this vulnerability is to data confidentiality. Published at: March 09, 2021 at 12:15AM View on website March 09, 2021 at 01:36AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-27576 Maxum Rumpus 8.2.13 and 8.2.14 is affected by cross-site scripting (XSS). Users are able to create folders in the web application. The folder name is insufficiently validated resulting in a stored cross-site scripting vulnerability. Published at: March 09, 2021 at 12:15AM View on website March 09, 2021 at 01:36AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-27575 Maxum Rumpus 8.2.13 and 8.2.14 is affected by a command injection vulnerability. The web administration contains functionality in which administrators are able to manage users. The edit users form contains a parameter vulnerable to command injection due to insufficient validation. Published at: March 09, 2021 at 12:15AM View on website March 09, 2021 at 01:36AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-27574 Maxum Rumpus 8.2.13 and 8.2.14 is affected by cross-site request forgery (CSRF). If an authenticated user visits a malicious page, unintended actions could be performed in the web application as the authenticated user. Published at: March 08, 2021 at 11:15PM View on website March 09, 2021 at 01:36AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-28150 I-Net Software Clear Reports 20.10.136 web application accepts a user-controlled input that specifies a link to an external site, and uses the user supplied data in a Redirect. Published at: March 09, 2021 at 08:15PM View on website March 09, 2021 at 09:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-28952 An issue was discovered on Athom Homey and Homey Pro devices before 5.0.0. ZigBee hub devices should generate a unique Standard Network Key that is then exchanged with all enrolled devices so that all inter-device communication is encrypted. However, the cited Athom products use another widely known key that is designed for testing purposes: "01030507090b0d0f00020406080a0c0d" (the decimal equivalent of 1 3 5 7 9 11 13 15 0 2 4 6 8 10 12 13), which is human generated and static across all issued devices. Published at: March 09, 2021 at 10:15PM View on website March 09, 2021 at 11:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-27225 In versions 4.18 and earlier of the Eclipse Platform, the Help Subsystem does not authenticate active help requests to the local help web server, allowing an unauthenticated local attacker to issue active help commands to the associated Eclipse Platform process or Eclipse Rich Client Platform process. Published at: March 09, 2021 at 09:15PM View on website March 09, 2021 at 11:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-29238 An integer buffer overflow in the Nginx webserver of ExpressVPN Router version 1 allows remote attackers to obtain sensitive information when the server running as reverse proxy via specially crafted request. Published at: March 10, 2021 at 05:15AM View on website March 10, 2021 at 08:36AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-13959 The default error page for VelocityView in Apache Velocity Tools prior to 3.1 reflects back the vm file that was entered as part of the URL. An attacker can set an XSS payload file as this vm file in the URL which results in this payload being executed. XSS vulnerabilities allow attackers to execute arbitrary JavaScript in the context of the attacked website and the attacked user. This can be abused to steal session cookies, perform requests in the name of the victim or for phishing attacks. Published at: March 10, 2021 at 10:15AM View on website March 10, 2021 at 01:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-13936 An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2. Published at: March 10, 2021 at 10:15AM View on website March 10, 2021 at 01:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-28705 FUEL CMS 1.4.13 contains a cross-site request forgery (CSRF) vulnerability that can delete a page via a post ID to /pages/delete/3. Published at: March 10, 2021 at 04:15PM View on website March 10, 2021 at 05:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-24791 FUEL CMS 1.4.8 allows SQL injection via the 'fuel_replace_id' parameter in pages/replace/1. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Published at: March 10, 2021 at 04:15PM View on website March 10, 2021 at 05:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-23722 An issue was discovered in FUEL CMS 1.4.7. There is a escalation of privilege vulnerability to obtain super admin privilege via the "id" and "fuel_id" parameters. Published at: March 10, 2021 at 04:15PM View on website March 10, 2021 at 05:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-23721 An issue was discovered in FUEL CMS V1.4.7. An attacker can use a XSS payload and bypass a filter via /fuelCM/fuel/pages/edit/1?lang=english. Published at: March 10, 2021 at 04:15PM View on website March 10, 2021 at 05:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-1921 In the crypt function, we attempt to null terminate a buffer using the size of the input salt without validating that the offset is within the buffer. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0. Published at: March 10, 2021 at 06:15PM View on website March 10, 2021 at 07:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-1919 Incorrect bounds calculations in substr_compare could lead to an out-of-bounds read when the second string argument passed in is longer than the first. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0. Published at: March 10, 2021 at 06:15PM View on website March 10, 2021 at 07:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-1918 In-memory file operations (ie: using fopen on a data URI) did not properly restrict negative seeking, allowing for the reading of memory prior to the in-memory buffer. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0. Published at: March 10, 2021 at 06:15PM View on website March 10, 2021 at 07:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-1917 xbuf_format_converter, used as part of exif_read_data, was appending a terminating null character to the generated string, but was not using its standard append char function. As a result, if the buffer was full, it would result in an out-of-bounds write. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0. Published at: March 10, 2021 at 06:15PM View on website March 10, 2021 at 07:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-1916 An incorrect size calculation in ldap_escape may lead to an integer overflow when overly long input is passed in, resulting in an out-of-bounds write. This issue affects HHVM prior to 4.56.2, all versions between 4.57.0 and 4.78.0, 4.79.0, 4.80.0, 4.81.0, 4.82.0, 4.83.0. Published at: March 10, 2021 at 06:15PM View on website March 10, 2021 at 07:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-0025 In deletePackageVersionedInternal of PackageManagerService.java, there is a possible way to exit Screen Pinning due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-135604684 Published at: March 10, 2021 at 06:15PM View on website March 10, 2021 at 07:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-27632 In SIMATIC MV400 family versions prior to v7.0.6, the ISN generator is initialized with a constant value and has constant increments. An attacker could predict and hijack TCP sessions. Published at: March 10, 2021 at 08:15PM View on website March 10, 2021 at 09:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-19419 Incorrect Access Control in Emerson Smart Wireless Gateway 1420 4.6.59 allows remote attackers to obtain sensitive device information from the administrator console without authentication. Published at: March 10, 2021 at 08:15PM View on website March 10, 2021 at 09:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-19417 Emerson Smart Wireless Gateway 1420 4.6.59 allows non-privileged users (such as the default account 'maint') to perform administrative tasks by sending specially crafted HTTP requests to the application. Published at: March 10, 2021 at 08:15PM View on website March 10, 2021 at 09:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-15260 PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In version 2.10 and earlier, PJSIP transport can be reused if they have the same IP address + port + protocol. However, this is insufficient for secure transport since it lacks remote hostname authentication. Suppose we have created a TLS connection to `sip.foo.com`, which has an IP address `100.1.1.1`. If we want to create a TLS connection to another hostname, say `sip.bar.com`, which has the same IP address, then it will reuse that existing connection, even though `100.1.1.1` does not have certificate to authenticate as `sip.bar.com`. The vulnerability allows for an insecure interaction without user awareness. It affects users who need access to connections to different destinations that translate to the same address, and allows man-in-the-middle attack if attacker can route a connection to another destination such as in the case of DNS spoofing. Published at: March 11, 2021 at 01:15AM View on website March 11, 2021 at 03:36AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-1900 When unserializing an object with dynamic properties HHVM needs to pre-reserve the full size of the dynamic property array before inserting anything into it. Otherwise the array might resize, invalidating previously stored references. This pre-reservation was not occurring in HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0. Published at: March 11, 2021 at 03:15AM View on website March 11, 2021 at 08:36AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-1899 The unserialize() function supported a type code, "S", which was meant to be supported only for APC serialization. This type code allowed arbitrary memory addresses to be accessed as if they were static StringData objects. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0. Published at: March 11, 2021 at 03:15AM View on website March 11, 2021 at 08:36AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-1898 The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a maliciously constructed string could cause deserialization to recurse, leading to stack exhaustion. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0. Published at: March 11, 2021 at 03:15AM View on website March 11, 2021 at 08:36AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-14987 An issue was discovered in Bloomreach Experience Manager (brXM) 4.1.0 through 14.2.2. It allows remote attackers to execute arbitrary code because there is a mishandling of the capability for administrators to write and run Groovy scripts within the updater editor. An attacker must use an AST transforming annotation such as @Grab. Published at: March 11, 2021 at 08:15PM View on website March 11, 2021 at 09:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-14989 An issue was discovered in Bloomreach Experience Manager (brXM) 4.1.0 through 14.2.2. It allows CSRF if the attacker uses GET where POST was intended. Published at: March 11, 2021 at 09:15PM View on website March 11, 2021 at 11:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-14988 An issue was discovered in Bloomreach Experience Manager (brXM) 4.1.0 through 14.2.2. It allows XSS in the login page via the loginmessage parameter, the text editor via the src attribute of HTML elements, the translations menu via the foldername parameter, the author page via the link URL, or the upload image functionality via an SVG document containing JavaScript. Published at: March 11, 2021 at 09:15PM View on website March 11, 2021 at 11:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-24984 An issue was discovered in Quadbase EspressReports ES 7 Update 9. It allows CSRF, whereby an attacker may be able to trick an authenticated admin level user into uploading malicious files to the web server. Published at: March 12, 2021 at 12:15AM View on website March 12, 2021 at 01:36AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-24983 An issue was discovered in Quadbase EspressReports ES 7 Update 9. An unauthenticated attacker can create a malicious HTML file that houses a POST request made to the DashboardBuilder within the target web application. This request will utilise the target admin session and perform the authenticated request (to change the Dashboard name) as if the victim had done so themselves, aka CSRF. Published at: March 12, 2021 at 12:15AM View on website March 12, 2021 at 01:36AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2016-20009 ** UNSUPPORTED WHEN ASSIGNED ** A DNS client stack-based buffer overflow in ipdnsc_decode_name() affects Wind River VxWorks 6.5 through 7. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Published at: March 12, 2021 at 12:15AM View on website March 12, 2021 at 01:36AM via National Vulnerability Database