Weekly Update: a new vulnerability is published on the National Vulnerability Database (53 items)

New vulnerabilities from the NVD: CVE-2020-20247 Mikrotik RouterOs before 6.46.5 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/traceroute process. An authenticated remote attacker can cause a Denial of Service due via the loop counter variable. Published at: May 03, 2021 at 07:15PM View on website May 03, 2021 at 09:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-20218 Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/traceroute process. An authenticated remote attacker can cause a Denial of Service due via the loop counter variable. Published at: May 03, 2021 at 07:15PM View on website May 03, 2021 at 09:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-27518 All versions of Windscribe VPN for Mac and Windows <= v2.02.10 contain a local privilege escalation vulnerability in the WindscribeService component. A low privilege user could leverage several openvpn options to execute code as root/SYSTEM. Published at: May 04, 2021 at 05:15PM View on website May 04, 2021 at 07:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-21999 iWT Ltd FaceSentry Access Control System 6.4.8 suffers from an authenticated OS command injection vulnerability using default credentials. This can be exploited to inject and execute arbitrary shell commands as the root user via the 'strInIP' POST parameter in pingTest PHP script. Published at: May 04, 2021 at 07:15PM View on website May 04, 2021 at 09:45PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-36334 themegrill-demo-importer before 1.6.3 allows CSRF, as demonstrated by wiping the database. Published at: May 05, 2021 at 07:15AM View on website May 05, 2021 at 08:36AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-36333 themegrill-demo-importer before 1.6.2 does not require authentication for wiping the database, because of a reset_wizard_actions hook. Published at: May 05, 2021 at 07:15AM View on website May 05, 2021 at 08:36AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-22428 SolarWinds Serv-U before 15.1.6 Hotfix 3 is affected by Cross Site Scripting (XSS) via a directory name (entered by an admin) containing a JavaScript payload. Published at: May 05, 2021 at 06:15AM View on website May 05, 2021 at 08:36AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2021-20254 A flaw was found in samba. The Samba smbd file server must map Windows group identities (SIDs) into unix group ids (gids). The code that performs this had a flaw that could allow it to read data beyond the end of the array in the case where a negative cache entry had been added to the mapping cache. This could cause the calling code to return those values into the process token that stores the group membership for a user. The highest threat from this vulnerability is to data confidentiality and integrity. Published at: May 05, 2021 at 05:15PM View on website May 05, 2021 at 07:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-13666 Cross-site scripting vulnerability in Drupal Core. Drupal AJAX API does not disable JSONP by default, allowing for an XSS attack. This issue affects: Drupal Drupal Core 7.x versions prior to 7.73; 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6. Published at: May 05, 2021 at 05:15PM View on website May 05, 2021 at 07:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-13665 Access bypass vulnerability in Drupal Core allows JSON:API when JSON:API is in read/write mode. Only sites that have the read_only set to FALSE under jsonapi.settings config are vulnerable. This issue affects: Drupal Drupal Core 8.8.x versions prior to 8.8.8; 8.9.x versions prior to 8.9.1; 9.0.x versions prior to 9.0.1. Published at: May 05, 2021 at 06:15PM View on website May 05, 2021 at 07:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-13664 Arbitrary PHP code execution vulnerability in Drupal Core under certain circumstances. An attacker could trick an administrator into visiting a malicious site that could result in creating a carefully named directory on the file system. With this directory in place, an attacker could attempt to brute force a remote code execution vulnerability. Windows servers are most likely to be affected. This issue affects: Drupal Drupal Core 8.8.x versions prior to 8.8.8; 8.9.x versions prior to 8.9.1; 9.0.1 versions prior to 9.0.1. Published at: May 05, 2021 at 06:15PM View on website May 05, 2021 at 07:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-13662 Open Redirect vulnerability in Drupal Core allows a user to be tricked into visiting a specially crafted link which would redirect them to an arbitrary external URL. This issue affects: Drupal Drupal Core 7 version 7.70 and prior versions. Published at: May 05, 2021 at 06:15PM View on website May 05, 2021 at 07:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2016-20010 EWWW Image Optimizer before 2.8.5 allows remote command execution because it relies on a protection mechanism involving boolval, which is unavailable before PHP 5.5. Published at: May 05, 2021 at 05:15PM View on website May 05, 2021 at 07:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-4932 IBM QRadar SIEM 7.3 and 7.4 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 191748. Published at: May 05, 2021 at 07:15PM View on website May 05, 2021 at 09:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-4929 IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 191706. Published at: May 05, 2021 at 07:15PM View on website May 05, 2021 at 09:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-4883 IBM QRadar SIEM 7.3 and 7.4 could disclose sensitive information about other domains which could be used in further attacks against the system. IBM X-Force ID: 190907. Published at: May 05, 2021 at 07:15PM View on website May 05, 2021 at 09:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-28014 Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. The -oP option is available to the exim user, and allows a denial of service because root-owned files can be overwritten. Published at: May 06, 2021 at 04:15PM View on website May 06, 2021 at 05:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-28013 Exim 4 before 4.94.2 allows Heap-based Buffer Overflow because it mishandles "-F '.('" on the command line, and thus may allow privilege escalation from any user to root. This occurs because of the interpretation of negative sizes in strncpy. Published at: May 06, 2021 at 04:15PM View on website May 06, 2021 at 05:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-28012 Exim 4 before 4.94.2 allows Exposure of File Descriptor to Unintended Control Sphere because rda_interpret uses a privileged pipe that lacks a close-on-exec flag. Published at: May 06, 2021 at 04:15PM View on website May 06, 2021 at 05:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-28011 Exim 4 before 4.94.2 allows Heap-based Buffer Overflow in queue_run via two sender options: -R and -S. This may cause privilege escalation from exim to root. Published at: May 06, 2021 at 04:15PM View on website May 06, 2021 at 05:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-28010 Exim 4 before 4.94.2 allows Out-of-bounds Write because the main function, while setuid root, copies the current working directory pathname into a buffer that is too small (on some common platforms). Published at: May 06, 2021 at 04:15PM View on website May 06, 2021 at 05:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-28009 Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow because get_stdinput allows unbounded reads that are accompanied by unbounded increases in a certain size variable. NOTE: exploitation may be impractical because of the execution time needed to overflow (multiple days). Published at: May 06, 2021 at 04:15PM View on website May 06, 2021 at 05:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-28008 Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root in the spool directory (owned by a non-root user), an attacker can write to a /var/spool/exim4/input spool header file, in which a crafted recipient address can indirectly lead to command execution. Published at: May 06, 2021 at 04:15PM View on website May 06, 2021 at 05:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-28007 Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root in the log directory (owned by a non-root user), a symlink or hard link attack allows overwriting critical root-owned files anywhere on the filesystem. Published at: May 06, 2021 at 04:15PM View on website May 06, 2021 at 05:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-23128 Chamilo LMS 1.11.10 does not properly manage privileges which could allow a user with Sessions administrator privilege to create a new user then use the edit user function to change this new user to administrator privilege. Published at: May 06, 2021 at 04:15PM View on website May 06, 2021 at 05:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-23127 Chamilo LMS 1.11.10 is affected by Cross Site Request Forgery (CSRF) via the edit_user function by targeting an admin user. Published at: May 06, 2021 at 04:15PM View on website May 06, 2021 at 05:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-19114 SQL Injection vulnerability in Online Book Store v1.0 via the publisher parameter to edit_book.php, which could let a remote malicious user execute arbitrary code. Published at: May 06, 2021 at 04:15PM View on website May 06, 2021 at 05:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-19113 Arbitrary File Upload vulnerability in Online Book Store v1.0 in admin_add.php, which may lead to remote code execution. Published at: May 06, 2021 at 04:15PM View on website May 06, 2021 at 05:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-19112 SQL Injection vulnerability in Online Book Store v1.0 via the bookisbn parameter to admin_delete.php, which could let a remote malicious user execute arbitrary code. Published at: May 06, 2021 at 04:15PM View on website May 06, 2021 at 05:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-19111 Incorrect Access Control vulnerability in Online Book Store v1.0 via admin_verify.php, which could let a remote mailicious user bypass authentication and obtain sensitive information. Published at: May 06, 2021 at 04:15PM View on website May 06, 2021 at 05:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-19110 SQL Injection vulnerability in Online Book Store v1.0 via the bookisbn parameter to book.php parameter, which could let a remote malicious user execute arbitrary code. Published at: May 06, 2021 at 04:15PM View on website May 06, 2021 at 05:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-19109 SQL Injection vulnerability in Online Book Store v1.0 via the bookisbn parameter to admin_edit.php, which could let a remote malicious user execute arbitrary code. Published at: May 06, 2021 at 04:15PM View on website May 06, 2021 at 05:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-19108 SQL Injection vulnerability in Online Book Store v1.0 via the pubid parameter to bookPerPub.php, which could let a remote malicious user execute arbitrary code. Published at: May 06, 2021 at 04:15PM View on website May 06, 2021 at 05:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-19107 SQL Injection vulnerability in Online Book Store v1.0 via the isbn parameter to edit_book.php, which could let a remote malicious user execute arbitrary code. Published at: May 06, 2021 at 04:15PM View on website May 06, 2021 at 05:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-18889 Cross Site Request Forgery (CSRF) vulnerability in puppyCMS v5.1 that can change the admin's password via /admin/settings.php. Published at: May 06, 2021 at 08:15PM View on website May 06, 2021 at 09:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2019-25043 ModSecurity 3.x before 3.0.4 mishandles key-value pair parsing, as demonstrated by a "string index out of range" error and worker-process crash for a "Cookie: =abc" header. Published at: May 06, 2021 at 08:15PM View on website May 06, 2021 at 09:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-18890 Rmote Code Execution (RCE) vulnerability in puppyCMS v5.1 due to insecure permissions, which could let a remote malicious user getshell via /admin/functions.php. Published at: May 06, 2021 at 09:15PM View on website May 06, 2021 at 11:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-18888 Arbitrary File Deletion vulnerability in puppyCMS v5.1 allows remote malicious attackers to delete the file/folder via /admin/functions.php. Published at: May 06, 2021 at 09:15PM View on website May 06, 2021 at 11:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-23264 Cross-site request forgery (CSRF) in Fork-CMS before 5.8.2 allow remote attackers to hijack the authentication of logged administrators. Published at: May 07, 2021 at 01:15AM View on website May 07, 2021 at 03:36AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-23263 Persistent Cross-site scripting vulnerability on Fork CMS version 5.8.2 allows remote attackers to inject arbitrary Javascript code via the "navigation_title" parameter and the "title" parameter in /private/en/pages/add. Published at: May 07, 2021 at 01:15AM View on website May 07, 2021 at 03:36AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-11295 Use after free in camera If the threadmanager is being cleaned up while the worker thread is processing objects in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile Published at: May 07, 2021 at 12:15PM View on website May 07, 2021 at 01:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-11294 Out of bound write in logger due to prefix size is not validated while prepended to logging string in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables Published at: May 07, 2021 at 12:15PM View on website May 07, 2021 at 01:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-11293 Out of bound read can happen in Widevine TA while copying data to buffer from user data due to lack of check of buffer length received in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking Published at: May 07, 2021 at 12:15PM View on website May 07, 2021 at 01:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-11289 Out of bound write can occur in TZ command handler due to lack of validation of command ID in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking Published at: May 07, 2021 at 12:15PM View on website May 07, 2021 at 01:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-11288 Out of bound write can occur in playready while processing command due to lack of input validation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music Published at: May 07, 2021 at 12:15PM View on website May 07, 2021 at 01:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-11285 Buffer over-read while unpacking the RTCP packet we may read extra byte if wrong length is provided in RTCP packets in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables Published at: May 07, 2021 at 12:15PM View on website May 07, 2021 at 01:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-11284 Locked memory can be unlocked and modified by non secure boot loader through improper system call sequence making the memory region untrusted source of input for secure boot loader in Snapdragon Auto, Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking Published at: May 07, 2021 at 12:15PM View on website May 07, 2021 at 01:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-11279 Memory corruption while processing crafted SDES packets due to improper length check in sdes packets recieved in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables Published at: May 07, 2021 at 12:15PM View on website May 07, 2021 at 01:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-11274 Denial of service in MODEM due to assert to the invalid configuration in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile Published at: May 07, 2021 at 12:15PM View on website May 07, 2021 at 01:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-11273 Histogram type KPI was teardown with the assumption of the existence of histogram binning info and will lead to null pointer access when histogram binning info is missing due to lack of null check in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile Published at: May 07, 2021 at 12:15PM View on website May 07, 2021 at 01:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-11268 Potential UE reset while decoding a crafted Sib1 or SIB1 that schedules unsupported SIBs and can lead to denial of service in Snapdragon Auto, Snapdragon Mobile Published at: May 07, 2021 at 12:15PM View on website May 07, 2021 at 01:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-11254 Memory corruption during buffer allocation due to dereferencing session ctx pointer without checking if pointer is valid in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile Published at: May 07, 2021 at 12:15PM View on website May 07, 2021 at 01:36PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2020-14009 Proofpoint Enterprise Protection (PPS/PoD) before 8.17.0 contains a vulnerability that could allow an attacker to deliver an email message with a malicious attachment that bypasses scanning and file-blocking rules. The vulnerability exists because messages with certain crafted and malformed multipart structures are not properly handled. Published at: May 07, 2021 at 03:15PM View on website May 07, 2021 at 05:36PM via National Vulnerability Database