Kensington UltraThin Magnetic Privacy Screens released for M...
Prevent shoulder-surfers and "visual hackers" with the Apple Store-exclusive Kensington magnetic privacy screen for your MacBook Air or MacBook Pro.The UltraThin Magnetic privacy screen is a great way to guard against prying eyes, whether in the coffee shop, on the bus or plane, or in the office. It seamlessly attaches to your MacBook's magnetic frame and does not interfere with closing the lid or entering sleep mode.When attached to a compatible MacBook Air or MacBook Pro, the UltraThin Magnetic Privacy Screen reduces the viewing angle to plus or minus 30 degrees, making it nearly impossible to read the screen without being directly in front of it.Read more...

Read more »

The Apple Store app is hiding a virtual surprise party
The Apple Store app turned 10 this past June, and Apple is celebrating the milestone with a fun Easter egg. Hidden inside the most recent update is a virtual surprise party. more… The post appeared first on 9to5Mac.

Read more »

Here are the new features and changes in iOS 14 beta 4
In the fourth developer beta of iOS 14, Apple made some improvements bu adding features including a new TV widget, the return of 3D Touch… The post appeared first on MacDailyNews.

Read more »

Virginia launches first US COVID-19-tracking app using Apple...
Virginia has launched its contact-tracing app using Apple and Google’s COVID-19-focused API, becoming the first state in the United States to do so. The app, called COVIDWISE, uses Bluetooth Low Energy tech to notify users who have likely been exposed to individuals with coronavirus. This will, it is hoped, allow them to reduce the risk […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

∞ This iPad sees for you
[VIDEO] This is an amazing project, a tactile (think interactive simplified Braille) interface, attached to an iPad with Lidar. The idea is that you walk with this device and the camera tells you about obstacles in your path via this interface. Video embedded in main Loop post. While this is a relatively simple interface, it does show a path towards something much more complex. I can imagine adding audio (via AirPods, say) to the interface to give you even more clues about the path and obstacles ahead.

Read more »

9to5Mac Daily: August 05, 2020 – New iMac announced, Apple...
Listen to a recap of the top stories of the day from 9to5Mac. 9to5Mac Daily is available on iTunes and Apple’s Podcasts app, Stitcher, TuneIn, Google Play, or through our dedicated RSS feed for Overcast and other podcast players. Sponsored by Direct Mail: Create and send great looking email newsletters with Direct Mail, an easy to use email marketing app for the Mac. Get started for free and save 10% when you sign up for any pricing plan.  more… The post 9to5Mac Daily: August 05, 2020 – New iMac announced, Apple exec shakeup appeared first on 9to5Mac.

Read more »

Third-party RAM for 27-inch iMac still far more affordable t...
Tim Hardwick, MacRumors: To max out the RAM at checkout, Apple charges an additional $2,600, which is like buying another whole ‌iMac‌. Fortunately, the memory in the 27-inch ‌iMac‌ is user-replaceable thanks to the easily-accessible memory backdoor slot, and there are far more affordable options available from third parties. Third party RAM prices vs Apple's add-on price: 128GB (4 x 32GB DIMMs): Amazon ($599) vs Apple ($2,600) 64GB (4 x 16GB DIMMs) - Amazon ($269) vs Apple ($1,000) 32GB (2 x 16GB DIMMs) - Amazon ($135) vs Apple ($400) Same as it ever was. But good reminder for folks ordering the new iMac.∞ Read this on The Loop

Read more »

Readdle’s PDF Expert for Mac is 50% Off, Normally $80
PDF Expert for Mac by Readdle is on sale for US$40 (normal price is US$80) until August 12. PDF Expert PDF Expert, as the name suggests, is a tool that lets you do virtually anything with PDFs, like opening, editing, merging, and more. Here are some of the top features; Annotation Search indexing Signing Reduce file size Redaction It integrates with various platforms like Evernote, Dropbox, Google Drive, email, and Readdle’s suite of other productivity apps. You can find it on the Mac App Store here.

Read more »

Disney+ Subscribers Need to Pay $30 For New Mulan Movie
It was originally scheduled for March 27 but, with cinemas still mostly closed, the live-action remake of Mulan is going to launch on Disney+. However, subscribers will have to pay an additional $30 to get the film, The Verge reported. So far, Apple TV+ subscribers have not had to pay extra for blockbuster movies like Greyhound. Disney executives walked through the new plan for Mulan’s release during an earnings call with analysts today. The $30 fee will be on top of the $6.99 subscriber fee for Disney Plus customers. The company told Insider that the $30 acts as a purchase — as long as people subscribe to Disney Plus, they’ll be able to access the film. Chapek also made it seem like non-subscribers can pay $30 for the film as well, but The Verge has emailed Disney to confirm.

Read more »

Tons of detail on Apple’s upgraded cartography for Japan
Some amazing work by map master Justin O'Beirne, laying out some easy to follow before-and-afters on changes to Apple Maps in Japan, including an interesting data source detail. That last led me down a tiny bit of a rabbit hole to this, a page describing all the data sources for Apple Maps.∞ Read this on The Loop

Read more »

Automated mistake by Apple kills all Mac developer’s apps
An automated mistake by Apple resulted in the company remotely killing all of a Mac developer’s apps. Users were unable to open them, and a message flagged them as malware, advising users to delete the apps to avoid damaging their Macs. Developer Charlie Monroe, creator of the Downie video downloader, among other apps, said that Apple didn’t even send him a message saying it had happened, and for several hours he didn’t know whether he still had a business or not… more… The post appeared first on 9to5Mac.

Read more »

Samsung unveils Galaxy Note20, Watch3, Z Fold2, Buds live
Samsung's Unpacked event has seen the launch of a number of new devices, including the Galaxy Fold 2, the Galaxy Note 20 Series, Galaxy Tab S7 and S7+, Galaxy Buds Live, and the Galaxy Watch 3.Samsung's Galaxy Buds, Note 20, and Tab S7Launched on Wednesday during its regular Samsung Unpacked event, the South Korean electronics giant took the opportunity to launch multiple mobile devices and related products at the same time.Read more...

Read more »

Apple’s kill switch, Charlie Monroe, and a day without bus...
Charlie Monroe: On Aug 4, 2020 I woke up to a slightly different world – I had lost my business as it seemed. Full inbox of reports of my apps not launching (crashing on launch) and after not too long I found out that when I sign into my Apple developer account I can no longer see that I would be enrolled into Apple’s developer program – au contraire – it shows a button for me to enroll, which I tried clicking, but only got a message that I can’t do that. After more investigation, I found out that the distribution certificates were revoked – evidently by Apple as no one else has access to them and I was sound asleep when all this happened. Each macOS app these days needs to be codesigned using an Apple-issued certificate so that the app will flawlessly work on all computers. When Apple revokes the certificate, it’s generally a remove kill-switch for the apps. I got really frightened as all of sudden, no user was able to use my apps anymore. This is an interesting read. Clearly, a mistake was made and Apple did apologize. Do check that alert that popped up when users launched Charlie's app. That'd certainly make me wonder about the safety of the software I was running.∞ Read this on The Loop

Read more »

What is an Apple Fellow? Who Has Held The Role Before?
On Tuesday, Apple announced that Phil Schiller will leave his role as senior vice president of worldwide marketing and become an Apple Fellow. Many people, myself included, have been wondering exactly what such a role might entail. Cult of Mac has a good rundown of what it means and profiles those who have held it before. This honorary position is one that Apple recognizes for a person’s outstanding contribution to the company in some capacity. But while many newer Apple fans may not be familiar with the role, it’s one that’s been part of Apple dating back to the 1980s — even if this is the first time in more than 20 years that Apple has inducted someone into the club.

Read more »

Leak claims Apple’s iPhone 12 will use magnets to simplify...
Photographs claim to show the inside of Apple's forthcoming iPhone 12 and next-gen iPhone 12 cases with a circular arrangement of magnets … The post Leak claims Apple’s iPhone 12 will use magnets to simplify charging appeared first on MacDailyNews.

Read more »

Virginia launches first COVID-19 exposure notification app i...
On Wednesday, the Virginia Department of Health released its official COVID-19 exposure notification app, and it is the first in the United States to use the Google and Apple API.COVIDWISE app by the Virginia Department of HealthApple and Google engineersteamed up to create a cross-platform API for tracing the spread of coronavirus. The API was officially released in May 2020 and has seen little adoption since.Read more...

Read more »

This Photographer Shot a Wedding With an iPhone 11 Pro
Jennifer Van Elk wrote a review of the iPhone 11 Pro as a professional camera, using it to shoot a wedding, and the results are stunning. The best part by far though was that during downtime at the wedding and after the wedding during the ride home we were able to cull and edit the wedding. It was a 45 minute ride home from the wedding. In that time I was able to cull the wedding and edit all the photos in Lightroom on the iPhone 11 Pro. By the time we were home, I was already uploading the gallery.

Read more »

Instagram clones TikTok with new short-form ‘Reels’ vide...
Instagram is out today with a major new release that should crank up the competition between social media apps to another level. “Reels” is rolling out for Instagram users in 50 countries and is focused on entertaining short-form video just like TikTok. more… The post Instagram clones TikTok with new short-form ‘Reels’ video feature launching today appeared first on 9to5Mac.

Read more »

iPhone 12 chassis rumored to feature a ring of magnets, perh...
In a left-field rumor, EverythingApplePro is reporting that Chinese accessory manufacturers believe that the iPhone 12 will include an intriguing new set of internal magnets. The iPad Pro is packed full of magnets that aids attachment of the Magic Keyboard. For the iPhone 12, the utility is not immediately clear. As the new ring of magnets is positioned in the chassis in the same place as the wireless charging coil, it is speculated that Apple might be working on a new wireless charging mat to which the iPhone 12 could automatically snap. more… The post iPhone 12 chassis rumored to feature a ring of magnets, perhaps for mounting to a new charging accessory appeared first on 9to5Mac.

Read more »

Master the many facets of Adobe Photoshop, Illustrator and I...
Adobe Creative Suite includes some of the world’s most powerful tools for visual creators. However, the vast array of features in software like Photoshop, Illustrator and InDesign mean steep learning curves. The Essential 2020 Adobe CC Mastery Bundle can help. This bundle of Creative Suite lessons covers everything from the basics to highly advanced usage of […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Bank of America ups Apple target to $470, downgrades stock t...
Bank of America Securities analyst Wamsi Mohan has raised his Apple price target to $470 from $420, but downgraded Apple's stock from "buy" to… The post Bank of America ups Apple target to $470, downgrades stock to ‘neutral’ appeared first on MacDailyNews.

Read more »

Virginia becomes first US state to debut COVID-19 tracing ap...
The Exposure Notification API developed by Apple and Google is officially being put to use in the United States. Virginia has become the first U.S. state to offer a COVID-19 contact tracing application using the Apple and Google API, and it’s available to download today from the App Store for iOS and Google Play for Android. more… The post Virginia becomes first US state to debut COVID-19 tracing app using Apple and Google API appeared first on 9to5Mac.

Read more »

LastPass Dark Web Monitoring, Security Dashboard Here
LogMeIn announced on Wednesday the arrival of LastPass dark web monitoring, as well as a security dashboard for the password manager. The new LastPass dark web monitoring feature proactively checks email addresses against a 3rd party database of breached credentials. If that email address has been found in the database, the user will be immediately notified by email and with a message directly in their LastPass Security Dashboard. From there, users will be prompted to update the password for that compromised account.

Read more »

Pair arrested in Netherlands for theft of $629,000 in Apple ...
A massive Apple Watch theft occurred in May, with Danish authorities making an arrest after the unsolved case was highlighted on a television show.The Royal Netherlands Marechaussee, a branch of the Netherlands Armed Forces, arrested a 37-year-old man from Bulgaria on suspicion of theft of 4,400 Apple Watches. The theft occurred on May 16, when six pallets of Apple's popular wearable were purloined from the warehouse of a transport company at Schiphol East and driven off-site.The six pallets are said to be worth roughly 530,000 euros — almost $629,000.Read more...

Read more »

Ring of magnets could make iPhone 12’s wireless charging e...
The new iPhone 12 chassis could include a mysterious circular array of 36 magnets inside its chassis, possibly to help with wireless charging, suggest new images posted to Weibo and shared by the EverythingApplePro Twitter account. Apple has yet to release a native wireless charger for iPhone. Its most notable move in this direction was […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Hands-on: iOS 14 beta 4 changes and features – the TV widg...
As we inch closer to iOS 14 GM release, we can expect less new features and changes in each beta release, and more focus on stability and refinement. That’s not to say that there won’t be any new changes found in this and forthcoming beta releases, however. Watch our hands-on video walkthrough as we explore a handful of iOS 14 beta 4 changes and features. more… The post Hands-on: iOS 14 beta 4 changes and features – the TV widget lives [Video] appeared first on 9to5Mac.

Read more »

Sharp reports 38% drop in June quarter profit, beats analyst...
Japan-based Apple supplier Sharp on Wednesday reported a 37.8% drop in first-quarter operating profit as the COVID-19 shutdowns weighed on sales of… The post Sharp reports 38% drop in June quarter profit, beats analyst estimates appeared first on MacDailyNews.

Read more »

Bag Apple Watch refurbs for as little as $99.99 today only
Woot’s spectacular sale on Apple Watch refurbs has returned for one day only. A range of models is available, from Series 1 to Series 4, with prices starting at just $99.99. Bag yours before they’re gone again! It’s easier than ever to become an Apple Watch owner, with prices for older models falling significantly in […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

An introduction to every Apple Fellow in company history
On Tuesday, it was announced that Phil Schiller, Apple’s senior vice president of worldwide marketing, will transition into a new role as an Apple Fellow. This honorary position is one that Apple recognizes for a person’s outstanding contribution to the company in some capacity. But while many newer Apple fans may not be familiar with the […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Bank of America hikes AAPL target to $470, downgrades stock ...
Bank of America Securities analyst Wamsi Mohan has downgraded Apple's stock to a "neutral," citing a new balance to risk and reward as the stock has hit new highs following a blockbuster earnings report.Apple's iPhone 12 will drive Apple's fiscal year 2021 revenue — Image Credit: iSpazioAfter hiking a target price for Apple stock to $420 after the earnings report, Wamsi Mohan at Bank of America Securities has again revised his expectations for the stock. In a note to investors seen by AppleInsider, Mohan is now no longer underwater at $470 per share, but has reclassified the stock as neutral versus buy, since he sees the stock as more balanced than it has been previously.Read more...

Read more »

Robocall Legal Advocate Leaks Customer Data
A California company that helps telemarketing firms avoid getting sued for violating a federal law that seeks to curb robocalls has leaked the phone numbers, email addresses and passwords of all its customers, as well as the mobile phone numbers and other data on people who have hired lawyers to go after telemarketers.

Read more »

Vulnerability Summary for the Week of July 27, 2020
Original release date: August 3, 2020 The CISA Weekly Vulnerability Summary Bulletin is created using information from the NIST NVD. In some cases, the vulnerabilities in the Bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.   High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info adobe -- magento Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a path traversal vulnerability. Successful exploitation could lead to arbitrary code execution. 2020-07-29 8.5 CVE-2020-9689CONFIRM adobe -- magento Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a security mitigation bypass vulnerability. Successful exploitation could lead to arbitrary code execution. 2020-07-29 8.5 CVE-2020-9692CONFIRM adobe -- magento   Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a dom-based cross-site scripting vulnerability. Successful exploitation could lead to arbitrary code execution. 2020-07-29 9.3 CVE-2020-9691CONFIRM arris -- ruckus_wireless_unleashed   rkscli in Ruckus Wireless Unleashed through 200.7.10.92 allows a remote attacker to achieve command injection and jailbreak the CLI via a crafted CLI command. This affects C110, E510, H320, H510, M510, R320, R310, R500, R510 R600, R610, R710, R720, R750, T300, T301n, T301s, T310c, T310d, T310n, T310s, T610, T710, and T710s devices. 2020-07-28 7.5 CVE-2020-13917CONFIRM arris -- ruckus_wireless_unleashed   A stack buffer overflow in webs in Ruckus Wireless Unleashed through 200.7.10.102.92 allows a remote attacker to execute code via an unauthenticated crafted HTTP request. This affects C110, E510, H320, H510, M510, R320, R310, R500, R510 R600, R610, R710, R720, R750, T300, T301n, T301s, T310c, T310d, T310n, T310s, T610, T710, and T710s devices. 2020-07-28 7.5 CVE-2020-13916CONFIRM arris -- ruckus_wireless_unleashed   emfd/libemf in Ruckus Wireless Unleashed through 200.7.10.102.92 allows a remote attacker to achieve command injection via a crafted HTTP request. This affects C110, E510, H320, H510, M510, R320, R310, R500, R510 R600, R610, R710, R720, R750, T300, T301n, T301s, T310c, T310d, T310n, T310s, T610, T710, and T710s devices. 2020-07-28 7.5 CVE-2020-13919CONFIRM artifex_software -- ghostscript A memory corruption issue was found in Artifex Ghostscript 9.50 and 9.52. Use of a non-standard PostScript operator can allow overriding of file access controls. The 'rsearch' calculation for the 'post' size resulted in a size that was too large, and could underflow to max uint32_t. This was fixed in commit 5d499272b95a6b890a1397e11d20937de000d31b. 2020-07-28 7.5 CVE-2020-15900MISCCONFIRMMISCMISCMISC aternity -- steelcentral_aternity_agent SteelCentral Aternity Agent 11.0.0.120 on Windows mishandles IPC. It uses an executable running as a high privileged Windows service to perform administrative tasks and collect data from other processes. It distributes functionality among different processes and uses IPC (Inter-Process Communication) primitives to enable the processes to cooperate. Any user in the system is allowed to access the interprocess communication channel AternityAgentAssistantIpc, retrieve a serialized object and call object methods remotely. Among others, the methods allow any user to: (1) Create and/or overwrite arbitrary XML files across the system; (2) Create arbitrary directories across the system; and (3) Load arbitrary plugins (i.e., C# assemblies) from the "%PROGRAMFILES(X86)/Aternity Information Systems/Assistant/plugins” directory and execute code contained in them. 2020-07-27 7.2 CVE-2020-15593CONFIRMMISC control_web_panel -- centos_web_panel This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_disk_usage.php. When parsing the folderName parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9713. 2020-07-28 10 CVE-2020-15427N/A control_web_panel -- centos_web_panel This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_list_accounts.php. When parsing the username parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9736. 2020-07-28 10 CVE-2020-15430N/A control_web_panel -- centos_web_panel This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_new_account.php. When parsing the domain parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-9727. 2020-07-28 7.8 CVE-2020-15624N/A control_web_panel -- centos_web_panel This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mail_autoreply.php. When parsing the search parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-9712. 2020-07-28 7.8 CVE-2020-15622N/A control_web_panel -- centos_web_panel This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-el7-0.9.8.891. Authentication is not required to exploit this vulnerability. The specific flaw exists within loader_ajax.php. When parsing the line parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9259. 2020-07-28 10 CVE-2020-15420N/A control_web_panel -- centos_web_panel   This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_crons.php. When parsing the line parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9714. 2020-07-28 10 CVE-2020-15428N/A control_web_panel -- centos_web_panel   This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_crons.php. When parsing the user parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9716. 2020-07-28 10 CVE-2020-15429N/A control_web_panel -- centos_web_panel   This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_crons.php. When parsing the user parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9740. 2020-07-28 10 CVE-2020-15431N/A control_web_panel -- centos_web_panel   This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_php_pecl.php. When parsing the phpversion parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9715. 2020-07-28 10 CVE-2020-15433N/A control_web_panel -- centos_web_panel   This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_php_pecl.php. When parsing the canal parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9745. 2020-07-28 10 CVE-2020-15434N/A control_web_panel -- centos_web_panel   This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_dashboard.php. When parsing the service_start parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9719. 2020-07-28 10 CVE-2020-15435N/A control_web_panel -- centos_web_panel   This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_list_accounts.php. When parsing the type parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-9723. 2020-07-28 7.8 CVE-2020-15619N/A control_web_panel -- centos_web_panel   This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_list_accounts.php. When parsing the username parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-9717. 2020-07-28 7.8 CVE-2020-15618N/A control_web_panel -- centos_web_panel   This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_dashboard.php. When parsing the ai_service parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9724. 2020-07-28 10 CVE-2020-15608N/A control_web_panel -- centos_web_panel   This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_dashboard.php. When parsing the service_stop parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9726. 2020-07-28 10 CVE-2020-15609N/A control_web_panel -- centos_web_panel   This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_php_pecl.php. When parsing the modulo parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9728. 2020-07-28 10 CVE-2020-15610N/A control_web_panel -- centos_web_panel   This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_dashboard.php. When parsing the service_restart parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9734. 2020-07-28 10 CVE-2020-15611N/A control_web_panel -- centos_web_panel   This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mod_security.php. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9742. 2020-07-28 10 CVE-2020-15425N/A control_web_panel -- centos_web_panel   This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_admin_apis.php. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9720. 2020-07-28 10 CVE-2020-15606N/A control_web_panel -- centos_web_panel   This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_migration_cpanel.php. When parsing the serverip parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9709. 2020-07-28 10 CVE-2020-15426N/A control_web_panel -- centos_web_panel   This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_ftp_manager.php. When parsing the userLogin parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9737. 2020-07-28 10 CVE-2020-15612N/A control_web_panel -- centos_web_panel   This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_admin_apis.php. When parsing the line parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9721. 2020-07-28 10 CVE-2020-15607N/A control_web_panel -- centos_web_panel   This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mail_autoreply.php. When parsing the user parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-9710. 2020-07-28 7.8 CVE-2020-15628N/A control_web_panel -- centos_web_panel   This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mod_security.php. When parsing the archivo parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9731. 2020-07-28 10 CVE-2020-15422N/A control_web_panel -- centos_web_panel   This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_ftp_manager.php. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9746. 2020-07-28 10 CVE-2020-15615N/A control_web_panel -- centos_web_panel   This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mod_security.php. When parsing the check_ip parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9707. 2020-07-28 10 CVE-2020-15421N/A control_web_panel -- centos_web_panel   This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mail_autoreply.php. When parsing the email parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-9711. 2020-07-28 7.8 CVE-2020-15621N/A control_web_panel -- centos_web_panel   This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_add_mailbox.php. When parsing the username parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-9729. 2020-07-28 7.8 CVE-2020-15625N/A control_web_panel -- centos_web_panel   This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_list_accounts.php. When parsing the id parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-9741. 2020-07-28 7.8 CVE-2020-15620N/A control_web_panel -- centos_web_panel   This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_dashboard.php. When parsing the term parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-9730. 2020-07-28 7.8 CVE-2020-15626N/A control_web_panel -- centos_web_panel   This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mail_autoreply.php. When parsing the account parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-9738. 2020-07-28 7.8 CVE-2020-15627N/A control_web_panel -- centos_web_panel   This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_list_accounts.php. When parsing the status parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-9708. 2020-07-28 7.8 CVE-2020-15617N/A control_web_panel -- centos_web_panel   This vulnerability allows remote attackers to write arbitrary files on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mod_security.php. When parsing the archivo parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9722. 2020-07-28 10 CVE-2020-15623N/A control_web_panel -- centos_web_panel   This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_admin_apis.php. When parsing the line parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9739. 2020-07-28 10 CVE-2020-15613N/A control_web_panel -- centos_web_panel   This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_php_pecl.php. When parsing the cha parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9718. 2020-07-28 10 CVE-2020-15614N/A control_web_panel -- centos_web_panel   This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_migration_cpanel.php. When parsing the filespace parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9743. 2020-07-28 10 CVE-2020-15432N/A control_web_panel -- centos_web_panel   This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mod_security.php. When parsing the domain parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9735. 2020-07-28 10 CVE-2020-15424N/A control_web_panel -- centos_web_panel   This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mod_security.php. When parsing the dominio parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9732. 2020-07-28 10 CVE-2020-15423N/A control_web_panel -- centos_web_panel   This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_list_accounts.php. When parsing the package parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-9706. 2020-07-28 7.8 CVE-2020-15616N/A fortinet -- fortios An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of authentication (FortiToken) if they changed the case of their username. 2020-07-24 7.5 CVE-2020-12812MISC gerapy -- gerapy   This affects the package Gerapy from 0 and before 0.9.3. The input being passed to Popen, via the project_configure endpoint, isn’t being sanitized. 2020-07-29 7.5 CVE-2020-7698MISCMISC grandstream -- ht800_series_devices   Grandstream HT800 series firmware version 1.0.17.5 and below contain a backdoor in the SSH service. An authenticated remote attacker can obtain a root shell by correctly answering a challenge prompt. 2020-07-29 9 CVE-2020-5763MISCMISC grandstream -- ht800_series_devices   Grandstream HT800 series firmware version 1.0.17.5 and below is vulnerable to CPU exhaustion due to an infinite loop in the TR-069 service. Unauthenticated remote attackers can trigger this case by sending a one character TCP message to the TR-069 service. 2020-07-29 7.8 CVE-2020-5761MISCMISC grandstream -- ht800_series_devices   Grandstream HT800 series firmware version 1.0.17.5 and below is vulnerable to an OS command injection vulnerability. Unauthenticated remote attackers can execute arbitrary commands as root by crafting a special configuration file and sending a crafted SIP message. 2020-07-29 9.3 CVE-2020-5760MISCMISC libssh -- libssh   libssh 0.9.4 has a NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL. 2020-07-29 7.5 CVE-2020-16135MISCMISCMISCMLIST mida_solutions -- eframework Mida eFramework through 2.9.0 allows unauthenticated ../ directory traversal. 2020-07-24 7.8 CVE-2020-15923MISC mida_solutions -- eframework   Mida eFramework through 2.9.0 has a back door that permits a change of the administrative password and access to restricted functionalities, such as Code Execution. 2020-07-24 7.5 CVE-2020-15921MISC mida_solutions -- eframework   There is an OS Command Injection in Mida eFramework 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with administrative (root) privileges. Authentication is required. 2020-07-24 10 CVE-2020-15922MISC mida_solutions -- eframework   There is an OS Command Injection in Mida eFramework through 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with administrative (root) privileges. No authentication is required. 2020-07-24 10 CVE-2020-15920MISC mock2easy -- mock2easy   This affects all versions of package mock2easy. a malicious user could inject commands through the _data variable: Affected Area require('../server/getJsonByCurl')(mock2easy, function (error, stdout) { if (error) { return res.json(500, error); } res.json(JSON.parse(stdout)); }, '', _data.interfaceUrl, query, _data.cookie,_data.interfaceType); 2020-07-29 7.5 CVE-2020-7697MISCMISC netgear -- r6700_routers This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length, stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9703. 2020-07-28 8.3 CVE-2020-15416MISC netgear -- r6700_routers This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UPnP service, which listens on TCP port 5000. A crafted UPnP message can be used to bypass authentication. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-9642. 2020-07-28 8.3 CVE-2020-10923MISC netgear -- r6700_routers   This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the downloading of files via HTTPS. The issue results from the lack of proper validation of the certificate presented by the server. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-9647. 2020-07-28 8.3 CVE-2020-10925MISC netgear -- r6700_routers   This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the encryption of firmware update images. The issue results from the use of an inappropriate encryption algorithm. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-9649. 2020-07-28 8.3 CVE-2020-10927MISC netgear -- r6700_routers   This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of firmware updates. The issue results from the lack of proper validation of the firmware image prior to performing an upgrade. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-9648. 2020-07-28 8.3 CVE-2020-10926MISC netgear -- r6700_routers   This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the UPnP service, which listens on TCP port 5000 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length, stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9643. 2020-07-28 8.3 CVE-2020-10924MISC netgear -- r6700_routers   This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of string table file uploads. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the admin user. Was ZDI-CAN-9768. 2020-07-28 8.3 CVE-2020-10929MISC node.js -- node.js   napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0. 2020-07-24 10 CVE-2020-8174MISC openbsd_project -- openbsd   iked in OpenIKED, as used in OpenBSD through 6.7, allows authentication bypass because ca.c has the wrong logic for checking whether a public key matches. 2020-07-28 7.5 CVE-2020-16088CONFIRMMISCMISCMISC openclinic_ga -- openclinic_ga OpenClinic GA 5.09.02 and 5.89.05b does not properly verify uploaded files, which may allow a low-privilege user to upload and execute arbitrary files on the system. 2020-07-29 9 CVE-2020-14488MISC openclinic_ga -- openclinic_ga OpenClinic GA 5.09.02 contains a hidden default user account that may be accessed if an administrator has not expressly turned off this account, which may allow an attacker to login and execute arbitrary commands. 2020-07-29 7.5 CVE-2020-14487MISC opendmarc -- opendmarc OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 has improper null termination in the function opendmarc_xml_parse that can result in a one-byte heap overflow in opendmarc_xml when parsing a specially crafted DMARC aggregate report. This can cause remote memory corruption when a '' byte overwrites the heap metadata of the next chunk and its PREV_INUSE flag. 2020-07-27 7.5 CVE-2020-12460MISCMISC portland_labs -- concrete5   Concrete5 before 8.5.3 allows Unrestricted Upload of File with Dangerous Type such as a .phar file. 2020-07-28 9 CVE-2020-11476CONFIRMCONFIRMMISCMISC pulse_secure -- pulse_connect_secure   An improper authentication vulnerability exists in Pulse Connect Secure

Read more »

Three Charged in July 15 Twitter Compromise
Three individuals have been charged for their alleged roles in the July 15 hack on Twitter, an incident that resulted in Twitter profiles for some of the world's most recognizable celebrities, executives and public figures sending out tweets advertising a bitcoin scam. 

Read more »

How computer security is depicted in movies – Intego Mac P...
We talk about an update on the Great Twitter Hack of 2020, discuss a ransomware attack on Garmin that shut down the company’s services, and even its assembly lines, and warn listeners about some Netgear devices that have vulnerabilities and can’t be updated. We then discuss the often ridiculous way hacking is portrayed in movies […] The post How computer security is depicted in movies – Intego Mac Podcast Episode 146 appeared first on The Mac Security Blog.

Read more »

Garmin ransomware outage, data breaches, and more – Weekly...
This week in privacy news: new details have emerged about the Twitter hack, Garmin outages were caused by a ransomware attack, and more. The post Garmin ransomware outage, data breaches, and more – Weekly privacy news, July 31, 2020 appeared first on The Mac Security Blog.

Read more »

Is Your Chip Card Secure? Much Depends on Where You Bank
Chip-based credit and debit cards are designed to make it infeasible for skimming devices or malware to clone your card when you pay for something by dipping the chip instead of swiping the stripe. But a recent series of malware attacks on U.S.-based merchants suggest thieves are exploiting weaknesses in how certain financial institutions have implemented the technology to sidestep key chip card security features and effectively create usable, counterfeit cards.

Read more »

Here’s Why Credit Card Fraud is Still a Thing
Most of the civilized world years ago shifted to requiring computer chips in payment cards that make it far more expensive and difficult for thieves to clone and use them for fraud. One notable exception is the United States, which is still lurching toward this goal. Here's a look at the havoc that lag has wrought, as seen through the purchasing patterns at one of the underground's biggest stolen card shops that was hacked last year.

Read more »

Business ID Theft Soars Amid COVID Closures
Identity thieves who specialize in running up unauthorized lines of credit in the names of small businesses are having a field day with all of the closures and economic uncertainty wrought by the COVID-19 pandemic, KrebsOnSecurity has learned. This story is about the victims of a particularly aggressive business ID theft ring that's spent years targeting small businesses across the country and is now pivoting toward using that access for pandemic assistance loans and unemployment benefits.

Read more »

Vulnerability Summary for the Week of July 20, 2020
Original release date: July 27, 2020 The CISA Weekly Vulnerability Summary Bulletin is created using information from the NIST NVD. In some cases, the vulnerabilities in the Bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.   High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info adobe -- creative_cloud_desktop   Adobe Creative Cloud Desktop Application versions 5.1 and earlier have an insecure file permissions vulnerability. Successful exploitation could lead to privilege escalation. 2020-07-17 7.5 CVE-2020-9671CONFIRM adobe -- creative_cloud_desktop   Adobe Creative Cloud Desktop Application versions 5.1 and earlier have a symlink vulnerability vulnerability. Successful exploitation could lead to arbitrary file system write. 2020-07-17 10 CVE-2020-9682CONFIRM adobe -- creative_cloud_desktop   Adobe Creative Cloud Desktop Application versions 5.1 and earlier have a symlink vulnerability vulnerability. Successful exploitation could lead to privilege escalation. 2020-07-17 7.5 CVE-2020-9670CONFIRM adobe -- creative_cloud_desktop   Adobe Creative Cloud Desktop Application versions 5.1 and earlier have a lack of exploit mitigations vulnerability. Successful exploitation could lead to privilege escalation. 2020-07-17 7.5 CVE-2020-9669CONFIRM adobe -- download_manager Adobe Download Manager version 2.0.0.518 have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution. 2020-07-17 9.3 CVE-2020-9688CONFIRM adobe -- magento Magento versions 1.14.4.5 and earlier, and 1.9.4.5 and earlier have a php object injection vulnerability. Successful exploitation could lead to arbitrary code execution. 2020-07-22 7.5 CVE-2020-9664CONFIRM apache -- airflow An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attack can connect to the broker (Redis, RabbitMQ) directly, it was possible to insert a malicious payload directly to the broker which could lead to a deserialization attack (and thus remote code execution) on the Worker. 2020-07-17 7.5 CVE-2020-11982MISC apache -- airflow   An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the celery worker running arbitrary commands. 2020-07-17 7.5 CVE-2020-11981MISC blysoft --eyesurfer_bflyinstallerx.ocx   EyeSurfer BflyInstallerX.ocx v1.0.0.16 and earlier versions contain a vulnerability that could allow remote files to be download by setting the arguments to the vulnerable method. This can be leveraged for code execution. When the vulnerable method is called, they fail to properly check the parameters that are passed to it. 2020-07-17 7.5 CVE-2020-7826CONFIRM d-link -- dir-816l_devices   An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. Universal Plug and Play (UPnP) is enabled by default on port 1900. An attacker can perform command injection by injecting a payload into the Search Target (ST) field of the SSDP M-SEARCH discover packet. 2020-07-22 7.5 CVE-2020-15893MISCMISC google -- android There is a possible out of bounds write due to an incorrect bounds check. Product: AndroidVersions: Android SoCAndroid ID: A-156337262 2020-07-17 7.5 CVE-2020-0230CONFIRM google -- android In a2dp_vendor_ldac_decoder_decode_packet of a2dp_vendor_ldac_decoder.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-142546668 2020-07-17 10 CVE-2020-0225CONFIRM google -- android There is a possible out of bounds write due to an incorrect bounds check. Product: AndroidVersions: Android SoCAndroid ID: A-156333727 2020-07-17 7.5 CVE-2020-0231CONFIRM google -- android   In FastKeyAccumulator::GetKeysSlow of keys.cc, there is a possible out of bounds write due to type confusion. This could lead to remote code execution when processing a proxy configuration with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-147664838 2020-07-17 10 CVE-2020-0224CONFIRM google -- android   In createWithSurfaceParent of Client.cpp, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege in the graphics server with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-150226994 2020-07-17 7.2 CVE-2020-0226CONFIRM google -- android   In the permission declaration for com.google.android.providers.gsf.permission.WRITE_GSERVICES in AndroidManifest.xml, there is a possible permissions bypass. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-147247775 2020-07-17 7.2 CVE-2020-0122CONFIRM google -- android   In onCommand of CompanionDeviceManagerService.java, there is a possible permissions bypass due to a missing permission check. This could lead to local escalation of privilege allowing background data usage or launching from the background, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-129476618 2020-07-17 7.2 CVE-2020-0227CONFIRM google -- chrome   Heap buffer overflow in PDFium in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. 2020-07-22 9.3 CVE-2020-6513SUSEMISCMISCGENTOO google -- chrome   Use after free in tab strip in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2020-07-22 9.3 CVE-2020-6515SUSEMISCMISCGENTOO google -- chrome   Use after free in developer tools in Google Chrome prior to 84.0.4147.89 allowed a remote attacker who had convinced the user to use developer tools to potentially exploit heap corruption via a crafted HTML page. 2020-07-22 9.3 CVE-2020-6518SUSEMISCMISCGENTOO google -- chrome   Heap buffer overflow in WebAudio in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2020-07-22 9.3 CVE-2020-6524SUSEMISCMISCGENTOO google -- chrome   Buffer overflow in Skia in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2020-07-22 9.3 CVE-2020-6520SUSEMISCMISCGENTOO grandstream -- gwn7000_series_devices   Grandstream GWN7000 firmware version 1.0.9.4 and below allows authenticated remote users to modify the system's crontab via undocumented API. An attacker can use this functionality to execute arbitrary OS commands on the router. 2020-07-17 9 CVE-2020-5756https://www.tenable.com/cve/CVE-2020-5756CONFIRM grandstream -- ucm6200_series_devices Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via SSH. An authenticated remote attacker can execute commands as the root user by issuing a specially crafted "unset" command. 2020-07-17 10 CVE-2020-5759https://www.tenable.com/cve/CVE-2020-5759CONFIRM grandstream -- ucm6200_series_devices   Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via HTTP. An authenticated remote attacker can bypass command injection mitigations and execute commands as the root user by sending a crafted HTTP POST to the UCM's "New" HTTPS API. 2020-07-17 10 CVE-2020-5757https://www.tenable.com/cve/CVE-2020-5757CONFIRM grandstream -- ucm6200_series_devices   Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via HTTP. An authenticated remote attacker can execute commands as the root user by sending a crafted HTTP GET to the UCM's "Old" HTTPS API. 2020-07-17 9 CVE-2020-5758https://www.tenable.com/cve/CVE-2020-5758CONFIRM hp -- nagios-plugins-hpilo HP nagios plugin for iLO (nagios-plugins-hpilo v1.50 and earlier) has a php code injection vulnerability. 2020-07-17 7.5 CVE-2020-7206CONFIRM ibm -- verify_gateway IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 179266. 2020-07-22 7.5 CVE-2020-4385XFCONFIRM ibm -- websphere_application_server IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code on a system with a specially-crafted sequence of serialized objects over the SOAP connector. IBM X-Force ID: 181489. 2020-07-17 9 CVE-2020-4464XFCONFIRMMISC juniper_networks -- srx_series_devices   On Juniper Networks SRX Series with ICAP (Internet Content Adaptation Protocol) redirect service enabled, processing a malformed HTTP message can lead to a Denial of Service (DoS) or Remote Code Execution (RCE) Continued processing of this malformed HTTP message may result in an extended Denial of Service (DoS) condition. The offending HTTP message that causes this issue may originate both from the HTTP server or the HTTP client. This issue affects Juniper Networks Junos OS on SRX Series: 18.1 versions prior to 18.1R3-S9 ; 18.2 versions prior to 18.2R2-S7, 18.2R3-S3; 18.3 versions prior to 18.3R1-S7, 18.3R2-S4, 18.3R3-S1; 18.4 versions prior to 18.4R1-S7, 18.4R2-S4, 18.4R3; 19.1 versions prior to 19.1R1-S5, 19.1R2; 19.2 versions prior to 19.2R1-S2, 19.2R2; 19.3 versions prior to 19.3R2. This issue does not affect Juniper Networks Junos OS prior to 18.1R1. 2020-07-17 7.5 CVE-2020-1654CONFIRM kramdown_gem_for_ruby_on_rails -- kramdown_gem_for_ruby_on_rails The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such as template="/etc/passwd") or unintended embedded Ruby code execution (such as a string that begins with template="string://Software module. An attacker can use XSS to send a malicious script to an unsuspecting user. This affects all versions prior to latest releases as specified in https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0080855&sys_kb_id=971d99ed1b8ed01c086dcbfc0a4bcb6a. 2020-07-17 3.5 CVE-2020-4104CONFIRM hcl -- campaign   "HCL Campaign is vulnerable to cross-site scripting when a user provides XSS scripts in Campaign Description field." 2020-07-17 3.5 CVE-2019-4090MISC hcl -- marketing_platform   "HCL Marketing Platform is vulnerable to cross-site scripting during addition of new users and also while searching for users in Dashboard, potentially giving an attacker ability to inject malicious code into the system. " 2020-07-17 3.5 CVE-2019-4091MISC huawei -- mate_20_smartphones   HUAWEI Mate 20 versions earlier than 10.1.0.160(C00E160R3P8), HUAWEI Mate 20 X versions earlier than 10.1.0.135(C00E135R2P8), HUAWEI Mate 20 RS versions earlier than 10.1.0.160(C786E160R3P8), and Honor Magic2 smartphones versions earlier than 10.1.0.160(C00E160R2P11) have a path traversal vulnerability. The system does not sufficiently validate certain pathname from certain process, successful exploit could allow the attacker write files to a crafted path. 2020-07-17 2.1 CVE-2020-9252CONFIRM huawei -- multiple_cloudengine_products   There is a information leak vulnerability in some Huawei products, and it could allow a local attacker to get information. The vulnerability is due to the improper management of the username. An attacker with the ability to access the device and cause the username information leak. Affected product versions include: CloudEngine 12800 versions V200R002C50SPC800, V200R003C00SPC810, V200R005C00SPC800, V200R005C10SPC800, V200R019C00SPC800; CloudEngine 5800 versions V200R002C50SPC800, V200R003C00SPC810, V200R005C00SPC800, V200R005C10SPC800, V200R019C00SPC800; CloudEngine 6800 versions V200R002C50SPC800, V200R003C00SPC810, V200R005C00SPC800, V200R005C10SPC800, V200R005C20SPC800, V200R019C00SPC800; CloudEngine 7800 versions V200R002C50SPC800, V200R003C00SPC810, V200R005C00SPC800, V200R005C10SPC800, V200R019C00SPC800 2020-07-17 2.1 CVE-2020-9102CONFIRM huawei -- multiple_products   There is an out-of-bounds write vulnerability in some products. An unauthenticated attacker crafts malformed packets with specific parameter and sends the packets to the affected products. Due to insufficient validation of packets, which may be exploited to cause the process reboot. Affected product versions include: IPS Module versions V500R005C00, V500R005C10; NGFW Module versions V500R005C00, V500R005C10; Secospace USG6300 versions V500R001C30, V500R001C60, V500R005C00, V500R005C10; Secospace USG6500 versions V500R001C30, V500R001C60, V500R005C00, V500R005C10; Secospace USG6600 versions V500R001C30, V500R001C60, V500R005C00, V500R005C10; USG9500 versions V500R001C30, V500R001C60, V500R005C00, V500R005C10 2020-07-18 3.3 CVE-2020-9101CONFIRM ibm -- verify_gateway   IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 contains sensitive information in leftover debug code that could be used aid a local user in further attacks against the system. IBM X-Force ID: 179008. 2020-07-22 2.1 CVE-2020-4371XFCONFIRM ibm -- verify_gateway   IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 179009 2020-07-22 2.1 CVE-2020-4372XFCONFIRM ibm -- verify_gateway   IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 stores highly sensitive information in cleartext that could be obtained by a user. IBM X-Force ID: 179004. 2020-07-22 2.1 CVE-2020-4369XFCONFIRM juniper_networks -- junos_os   A Race Condition vulnerability in Juniper Networks Junos OS LLDP implementation allows an attacker to cause LLDP to crash leading to a Denial of Service (DoS). This issue occurs when crafted LLDP packets are received by the device from an adjacent device. Multiple LACP flaps will occur after LLDP crashes. An indicator of compromise is to evaluate log file details for lldp with RLIMIT. Intervention should occur before 85% threshold of used KB versus maximum available KB memory is reached. show log messages | match RLIMIT | match lldp | last 20 Matching statement is " /kernel: %KERNEL-[number]: Process ([pid #],lldpd) has exceeded 85% of RLIMIT_DATA: " with [] as variable data to evaluate for. This issue affects: Juniper Networks Junos OS: 12.3 versions prior to 12.3R12-S15; 12.3X48 versions prior to 12.3X48-D95; 15.1 versions prior to 15.1R7-S6; 15.1X49 versions prior to 15.1X49-D200; 15.1X53 versions prior to 15.1X53-D593; 16.1 versions prior to 16.1R7-S7; 17.1 versions prior to 17.1R2-S11, 17.1R3-S2; 17.2 versions prior to 17.2R1-S9, 17.2R3-S3; 17.3 versions prior to 17.3R2-S5, 17.3R3-S6; 17.4 versions prior to 17.4R2-S4, 17.4R3; 18.1 versions prior to 18.1R3-S5; 18.2 versions prior to 18.2R2-S7, 18.2R3; 18.2X75 versions prior to 18.2X75-D12, 18.2X75-D33, 18.2X75-D50, 18.2X75-D420; 18.3 versions prior to 18.3R1-S7, 18.3R2-S3, 18.3R3; 18.4 versions prior to 18.4R1-S5, 18.4R2; 19.1 versions prior to 19.1R1-S4, 19.1R2. 2020-07-17 2.9 CVE-2020-1641MISC juniper_networks -- junos_os   Execution of the "show ospf interface extensive" or "show ospf interface detail" CLI commands on a Juniper Networks device running Junos OS may cause the routing protocols process (RPD) to crash and restart if OSPF interface authentication is configured, leading to a Denial of Service (DoS). By continuously executing the same CLI commands, a local attacker can repeatedly crash the RPD process causing a sustained Denial of Service. Note: Only systems utilizing ARM processors, found on the EX2300 and EX3400, are vulnerable to this issue. Systems shipped with other processor architectures are not vulnerable to this issue. The processor architecture can be displayed via the 'uname -a' command. For example: ARM (vulnerable): % uname -a | awk '{print $NF}' arm PowerPC (not vulnerable): % uname -a | awk '{print $NF}' powerpc AMD (not vulnerable): % uname -a | awk '{print $NF}' amd64 Intel (not vulnerable): % uname -a | awk '{print $NF}' i386 This issue affects Juniper Networks Junos OS: 12.3X48 versions prior to 12.3X48-D100; 14.1X53 versions prior to 14.1X53-D140, 14.1X53-D54; 15.1 versions prior to 15.1R7-S7; 15.1X49 versions prior to 15.1X49-D210; 15.1X53 versions prior to 15.1X53-D593; 16.1 versions prior to 16.1R7-S8; 17.1 versions prior to 17.1R2-S12; 17.2 versions prior to 17.2R3-S4; 17.3 versions prior to 17.3R3-S8; 17.4 versions prior to 17.4R2-S2, 17.4R3; 18.1 versions prior to 18.1R3-S2; 18.2 versions prior to 18.2R2, 18.2R3; 18.2X75 versions prior to 18.2X75-D40; 18.3 versions prior to 18.3R1-S2, 18.3R2. 2020-07-17 1.9 CVE-2020-1643CONFIRM juniper_networks -- mx_series_devices   On Juniper Networks MX series, receipt of a stream of specific Layer 2 frames may cause a memory leak resulting in the packet forwarding engine (PFE) on the line card to crash and restart, causing traffic interruption. By continuously sending this stream of specific layer 2 frame, an attacker connected to the same broadcast domain can repeatedly crash the PFE, causing a prolonged Denial of Service (DoS). This issue affects Juniper Networks Junos OS on MX Series: 17.2 versions prior to 17.2R3-S4; 17.2X75 versions prior to 17.2X75-D105.19; 17.3 versions prior to 17.3R3-S7; 17.4 versions prior to 17.4R1-S3, 17.4R2; 18.1 versions prior to 18.1R2. This issue does not affect Juniper Networks Junos OS releases prior to 17.2R1. 2020-07-17 3.3 CVE-2020-1651CONFIRM mida_solutions -- eframework Multiple Stored Cross Site Scripting (XSS) vulnerabilities were discovered in Mida eFramework through 2.9.0. 2020-07-24 3.5 CVE-2020-15918MISC qemu -- qemu   QEMU 4.2.0 has a use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e packet with the data's address set to the e1000e's MMIO address. 2020-07-21 2.1 CVE-2020-15859MISCMISCMLIST teltonika -- trb2_r_devices   Insufficient output sanitization in Teltonika firmware TRB2_R_00.02.02 allows a remote, authenticated attacker to conduct persistent cross-site scripting (XSS) attacks by injecting malicious client-side code into the 'URL/ Host / Connection' form in the 'DATA TO SERVER' configuration section. 2020-07-17 3.5 CVE-2020-5769CONFIRM Back to top   Severity Not Yet Assigned Primary Vendor -- Product Description Published CVSS Score Source & Patch Info asus -- screenxpertservicec_and_screenxpertupgradeservicemanager   AsusScreenXpertServicec.exe and ScreenXpertUpgradeServiceManager.exe in ScreenPad2_Upgrade_Tool.msi V1.0.3 for ASUS PCs with ScreenPad 1.0 (UX450FDX, UX550GDX and UX550GEX) could lead to unsigned code execution with no additional restrictions when a user puts an application at a particular path with a particular file name. 2020-07-20 not yet calculated CVE-2020-15009MISCCONFIRMCONFIRM atlassian -- confluence_server_and_data_center   Affected versions of Atlassian Confluence Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in user macro parameters. The affected versions are before version 7.4.2, and from version 7.5.0 before 7.5.2. 2020-07-24 not yet calculated CVE-2020-14175N/A bsdiff4 -- bsdiff4   A buffer overflow in the patching routine of bsdiff4 before 1.2.0 allows an attacker to write to heap memory (beyond allocated bounds) via a crafted patch file. 2020-07-22 not yet calculated CVE-2020-15904MISC c-more -- hmi_ea9_devices   This vulnerability allows remote attackers to bypass authentication on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the authentication mechanism. The issue is due to insufficient authentication on post-authentication requests. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from unauthenticated users. Was ZDI-CAN-10182. 2020-07-23 not yet calculated CVE-2020-10918MISC c-more -- hmi_ea9_touch_screen_panels   This vulnerability allows remote attackers to execute arbitrary code on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the control service, which listens on TCP port 9999 by default. The issue results from the lack of authentication prior to allowing alterations to the system configuration. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-10493. 2020-07-23 not yet calculated CVE-2020-10920MISC c-more -- hmi_ea9_touch_screen_panels   This vulnerability allows remote attackers to disclose sensitive information on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of passwords. When transmitting passwords, the process encrypts them in a recoverable format using a hard-coded key. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. Was ZDI-CAN-10185. 2020-07-23 not yet calculated CVE-2020-10919MISC c-more -- hmi_ea9_touch_screen_panels   This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the EA-HTTP.exe process. The issue results from the lack of proper input validation prior to further processing user requests. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-10527. 2020-07-23 not yet calculated CVE-2020-10922MISC c-more -- hmi_ea9_touch_screen_panels   This vulnerability allows remote attackers to issue commands on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the EA-HTTP.exe process. The issue results from the lack of authentication prior to allowing alterations to the system configuration. An attacker can leverage this vulnerability to issue commands to the physical equipment controlled by the device. Was ZDI-CAN-10482. 2020-07-23 not yet calculated CVE-2020-10921MISC cauldron_cbang -- tar/tarfilereader   tar/TarFileReader.cpp in Cauldron cbang (aka C-Bang or C!) before 1.6.0 allows Directory Traversal during extraction from a TAR archive. 2020-07-23 not yet calculated CVE-2020-15908MISCMISC citrix -- workspace_app_for_windows   Improper access control in Citrix Workspace app for Windows 1912 CU1 and 2006.1 causes privilege escalation and code execution when the automatic updater service is running. 2020-07-24 not yet calculated CVE-2020-8207MISC claws_mail -- claws_mail   common/session.c in Claws Mail before 3.17.6 has a protocol violation because suffix data after STARTTLS is mishandled. 2020-07-23 not yet calculated CVE-2020-15917MISCMISC codecov -- codecov   In codecov (npm package) before version 3.7.1 the upload method has a command injection vulnerability. Clients of the codecov-node library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability. A similar CVE (CVE-2020-7597 for GHSA-5q88-cjfq-g2mh) was issued but the fix was incomplete. It only blocked &, and command injection is still possible using backticks instead to bypass the sanitizer. The attack surface is low in this case. Particularly in the standard use of codecov, where the module is used directly in a build pipeline, not built against as a library in another application that may supply malicious input and perform command injection. 2020-07-20 not yet calculated CVE-2020-15123MISCMISCMISCCONFIRMMISC d-link -- dap-1520_devices   An issue was discovered in apply.cgi on D-Link DAP-1520 devices before 1.10b04Beta02. Whenever a user performs a login action from the web interface, the request values are being forwarded to the ssi binary. On the login page, the web interface restricts the password input field to a fixed length of 15 characters. The problem is that validation is being done on the client side, hence it can be bypassed. When an attacker manages to intercept the login request (POST based) and tampers with the vulnerable parameter (log_pass), to a larger length, the request will be forwarded to the webserver. This results in a stack-based buffer overflow. A few other POST variables, (transferred as part of the login request) are also vulnerable: html_response_page and log_user. 2020-07-22 not yet calculated CVE-2020-15892MISCMISC d-link -- dap-1522_devices   An authentication-bypass issue was discovered on D-Link DAP-1522 devices 1.4x before 1.10b04Beta02. There exist a few pages that are directly accessible by any unauthorized user, e.g., logout.php and login.php. This occurs because of checking the value of NO_NEED_AUTH. If the value of NO_NEED_AUTH is 1, the user has direct access to the webpage without any authentication. By appending a query string NO_NEED_AUTH with the value of 1 to any protected URL, any unauthorized user can access the application directly, as demonstrated by bsc_lan.php?NO_NEED_AUTH=1. 2020-07-22 not yet calculated CVE-2020-15896MISCMISC d-link -- dap-1860_devices   This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1860 1.04B03_HOTFIX WiFi extenders. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the HNAP service, which listens on TCP port 80 by default. When parsing the SOAPAction header, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-10084. 2020-07-23 not yet calculated CVE-2020-15631MISCMISC d-link -- dir-842_devices   This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-842 3.13B05 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of HNAP GetCAPTCHAsetting requests. The issue results from the lack of proper handling of sessions. An attacker can leverage this vulnerability to execute arbitrary code in the context of the device. Was ZDI-CAN-10083. 2020-07-23 not yet calculated CVE-2020-15632MISCMISC d-link -- dir-867_and_dir-878_and_dir-882_devices   This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.20B10_BETA. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP requests. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the router. Was ZDI-CAN-10835. 2020-07-23 not yet calculated CVE-2020-15633MISCMISC devspace -- devspace   The UI in DevSpace 4.13.0 allows web sites to execute actions on pods (on behalf of a victim) because of a lack of authentication for the WebSocket protocol. This leads to remote code execution. 2020-07-23 not yet calculated CVE-2020-15391CONFIRMMISC embedthis -- goahead   GoAhead before 5.1.2 mishandles the nonce value during Digest authentication. This may permit request replay attacks for local requests over HTTP. 2020-07-23 not yet calculated CVE-2020-15688MISC espressif -- esp-idf_devices   An encryption-bypass issue was discovered on Espressif ESP-IDF devices through 4.2, ESP8266_NONOS_SDK devices through 3.0.3, and ESP8266_RTOS_SDK devices through 3.3. Broadcasting forged beacon frames forces a device to change its authentication mode to OPEN, effectively disabling its 802.11 encryption. 2020-07-23 not yet calculated CVE-2020-12638MISCMISCMISCMISC fast-http -- fast-http   This affects all versions of package fast-http. There is no path sanitization in the path provided at fs.readFile in index.js. 2020-07-25 not yet calculated CVE-2020-7687MISC fiber -- fiber   In Fiber before version 1.12.6, the filename that is given in c.Attachment() (https://docs.gofiber.io/ctx#attachment) is not escaped, and therefore vulnerable for a CRLF injection attack. I.e. an attacker could upload a custom filename and then give the link to the victim. With this filename, the attacker can change the name of the downloaded file, redirect to another site, change the authorization header, etc. A possible workaround is to serialize the input before passing it to ctx.Attachment(). 2020-07-20 not yet calculated CVE-2020-15111MISCCONFIRM fortiguard -- fortios   An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of authentication (FortiToken) if they changed the case of their username. 2020-07-24 not yet calculated CVE-2020-12812MISC google -- chrome   Type Confusion in V8 in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2020-07-22 not yet calculated CVE-2020-6512SUSEMISCMISCGENTOO google -- chrome   Inappropriate implementation in WebRTC in Google Chrome prior to 84.0.4147.89 allowed an attacker in a privileged network position to potentially exploit heap corruption via a crafted SCTP stream. 2020-07-22 not yet calculated CVE-2020-6514SUSEMISCMISCGENTOO google -- chrome   Insufficient policy enforcement in WebView in Google Chrome on Android prior to 83.0.4103.106 allowed a remote attacker to bypass site isolation via a crafted HTML page. 2020-07-22 not yet calculated CVE-2020-6506MISCMISCGENTOO google -- chrome   Information leak in content security policy in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to leak cross-origin data via a crafted HTML page. 2020-07-22 not yet calculated CVE-2020-6511SUSEMISCMISCGENTOO google -- chrome   Heap buffer overflow in history in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2020-07-22 not yet calculated CVE-2020-6517SUSEMISCMISCGENTOO google -- chrome   Heap buffer overflow in WebRTC in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2020-07-22 not yet calculated CVE-2020-6534SUSEMISCMISCGENTOO google -- chrome   Inappropriate implementation in external protocol handlers in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. 2020-07-22 not yet calculated CVE-2020-6522SUSEMISCMISCGENTOO google -- chrome   Out of bounds write in Skia in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2020-07-22 not yet calculated CVE-2020-6523SUSEMISCMISCGENTOO google -- chrome   Insufficient data validation in WebUI in Google Chrome prior to 84.0.4147.89 allowed a remote attacker who had compromised the renderer process to inject scripts or HTML into a privileged page via a crafted HTML page. 2020-07-22 not yet calculated CVE-2020-6535SUSEMISCMISCGENTOO google -- chrome   Out of bounds memory access in developer tools in Google Chrome prior to 84.0.4147.89 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. 2020-07-22 not yet calculated CVE-2020-6530SUSEMISCMISCGENTOO google -- chrome   Type Confusion in V8 in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2020-07-22 not yet calculated CVE-2020-6533SUSEMISCMISCGENTOO hp -- synaptics_vfs75xx_sensors   Incorrect access control in the firmware of Synaptics VFS75xx family fingerprint sensors that include external flash (all versions prior to 2019-11-15) allows a local administrator or physical attacker to compromise the confidentiality of sensor data via injection of an unverified partition table. 2020-07-22 not yet calculated CVE-2019-18618MISCMISCMISCCONFIRM hp -- synaptics_wbf_drivers   Incorrect parameter validation in the synaTee component of Synaptics WBF drivers using an SGX enclave (all versions prior to 2019-11-15) allows a local user to execute arbitrary code in the enclave (that can compromise confidentiality of enclave data) via APIs that accept invalid pointers. 2020-07-22 not yet calculated CVE-2019-18619MISCMISCMISCCONFIRMMISC ibm -- filenet_content_manager   IBM FileNet Content Manager 5.5.3 and 5.5.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 181227. 2020-07-23 not yet calculated CVE-2020-4447XFCONFIRM inneo -- startup_tools   An issue was discovered in INNEO Startup TOOLS 2017 M021 12.0.66.3784 through 2018 M040 13.0.70.3804. The sut_srv.exe web application (served on TCP port 85) includes user input into a filesystem access without any further validation. This might allow an unauthenticated attacker to read files on the server via Directory Traversal, or possibly have unspecified other impact. 2020-07-23 not yet calculated CVE-2020-15492MISCCONFIRMMISCMISC jimp -- jimp   Uncontrolled resource consumption in `jpeg-js` before 0.4.0 may allow attacker to launch denial of service attacks using specially a crafted JPEG image. 2020-07-24 not yet calculated CVE-2020-8175MISC kubernetes -- kubelet   The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which writes to its own /etc/hosts file. The /etc/hosts file mounted in a pod by kubelet is not included by the kubelet eviction manager when calculating ephemeral storage usage by a pod. If a pod writes a large amount of data to the /etc/hosts file, it could fill the storage space of the node and cause the node to fail. 2020-07-23 not yet calculated CVE-2020-8557CONFIRMMLIST kubernetes -- kubelet   The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a full cluster compromise. 2020-07-22 not yet calculated CVE-2020-8559MISCMISC lenovo -- drivers_management   A DLL search path vulnerability was reported in Lenovo Drivers Management prior to version 2.7.1128.1046 that could allow an authenticated user to execute code with elevated privileges. 2020-07-24 not yet calculated CVE-2020-8317CONFIRM lenovo -- drivers_management   An unquoted service path vulnerability was reported in Lenovo Drivers Management prior to version 2.7.1128.1046 that could allow an authenticated user to execute code with elevated privileges. 2020-07-24 not yet calculated CVE-2020-8326CONFIRM lua -- lua   Lua through 5.4.0 has a segmentation fault in changedline in ldebug.c (e.g., when called by luaG_traceexec) because it incorrectly expects that an oldpc value is always updated upon a return of the flow of control to a function. 2020-07-24 not yet calculated CVE-2020-15945MISCMISC marked-tree -- marked-tree   This affects all versions of package marked-tree. There is no path sanitization in the path provided at fs.readFile in index.js. 2020-07-25 not yet calculated CVE-2020-7682MISC marscode -- marscode   This affects all versions of package marscode. There is no path sanitization in the path provided at fs.readFile in index.js. 2020-07-25 not yet calculated CVE-2020-7681MISC mida_solutions -- eframework There is an OS Command Injection in Mida eFramework 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with administrative (root) privileges. Authentication is required. 2020-07-24 not yet calculated CVE-2020-15922MISC mida_solutions -- eframework Mida eFramework through 2.9.0 allows unauthenticated ../ directory traversal. 2020-07-24 not yet calculated CVE-2020-15923MISC mida_solutions -- eframework Mida eFramework through 2.9.0 has a back door that permits a change of the administrative password and access to restricted functionalities, such as Code Execution. 2020-07-24 not yet calculated CVE-2020-15921MISC mida_solutions -- eframework There is an OS Command Injection in Mida eFramework through 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with administrative (root) privileges. No authentication is required. 2020-07-24 not yet calculated CVE-2020-15920MISC mida_solutions -- eframework   There is a SQL Injection in Mida eFramework through 2.9.0 that leads to Information Disclosure. No authentication is required. The injection point resides in one of the authentication parameters. 2020-07-24 not yet calculated CVE-2020-15924MISC mountsensitive -- azurefile_and_cephfs   The Kubernetes kube-controller-manager in versions v1.0-v1.17 is vulnerable to a credential leakage via error messages in mount failure logs and events for AzureFile and CephFS volumes. 2020-07-23 not yet calculated CVE-2019-11252MISC munkireport -- munkireport   A SQL injection vulnerability in reportdata_controller.php in the reportdata module before 3.5 for MunkiReport allows attackers to execute arbitrary SQL commands via the req parameter of the /module/reportdata/ip endpoint. 2020-07-23 not yet calculated CVE-2020-15886MISCMISCMISCMISC munkireport -- munkireport   A Cross-Site Scripting (XSS) vulnerability in the munki_facts (aka Munki Conditions) module before 1.5 for MunkiReport allows remote attackers to inject arbitrary web script or HTML via the key name. 2020-07-23 not yet calculated CVE-2020-15881MISCMISCMISCMISC munkireport -- munkireport   A SQL injection vulnerability in softwareupdate_controller.php in the Software Update module before 1.6 for MunkiReport allows attackers to execute arbitrary SQL commands via the last URL parameter of the /module/softwareupdate/get_tab_data/ endpoint. 2020-07-23 not yet calculated CVE-2020-15887MISCMISCMISCMISC munkireport -- munkireport   A Cross-Site Scripting (XSS) vulnerability in the comment module before 4.0 for MunkiReport allows remote attackers to inject arbitrary web script or HTML by posting a new comment. 2020-07-23 not yet calculated CVE-2020-15885MISCMISCMISCMISC munkireport -- munkireport   A SQL injection vulnerability in TableQuery.php in MunkiReport before 5.6.3 allows attackers to execute arbitrary SQL commands via the order[0][dir] field on POST requests to /datatables/data. 2020-07-23 not yet calculated CVE-2020-15884MISCMISCMISC munkireport -- munkireport   A Cross-Site Scripting (XSS) vulnerability in the managedinstalls module before 2.6 for MunkiReport allows remote attackers to inject arbitrary web script or HTML via the last two URL parameters (through which installed packages names and versions are reported). 2020-07-23 not yet calculated CVE-2020-15883MISCMISCMISCMISC munkireport -- munkireport   A CSRF issue in manager/delete_machine/{id} in MunkiReport before 5.6.3 allows attackers to delete arbitrary machines from the MunkiReport database. 2020-07-23 not yet calculated CVE-2020-15882MISCMISCMISC nagios -- nagios_xi Graph Explorer in Nagios XI before 5.7.2 allows XSS via the link url option. 2020-07-22 not yet calculated CVE-2020-15902MISC nagios -- nagios_xi   ajaxhelper.php in Nagios XI before 5.7.2 allows remote attackers to execute arbitrary commands via cmdsubsys. 2020-07-22 not yet calculated CVE-2020-15901MISC napi_get_value_string -- napi_get_value_string   napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0. 2020-07-24 not yet calculated CVE-2020-8174MISC nec -- esmpro_manager   This vulnerability allows remote attackers to execute arbitrary code on affected installations of NEC ESMPRO Manager 6.42. Authentication is not required to exploit this vulnerability. The specific flaw exists within the RMI service. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-10007. 2020-07-22 not yet calculated CVE-2020-10917MISC open_microscopy_environment -- omero   OMERO.server before 5.6.1 allows attackers to bypass the security filters and access hidden objects via a crafted query. 2020-07-22 not yet calculated CVE-2019-16244CONFIRM openbsd -- openssh   scp in OpenSSH through 8.3p1 allows command injection in scp.c remote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows." 2020-07-24 not yet calculated CVE-2020-15778MISCMISC oracle -- mysql_server   Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). 2020-07-24 not yet calculated CVE-2020-14725MISC oslsoft -- pi_system   In OSIsoft PI System multiple products and versions, an authenticated remote attacker could crash PI Archive Subsystem when the subsystem is working under memory pressure. This can result in blocking queries to PI Data Archive. 2020-07-24 not yet calculated CVE-2020-10600MISC oslsoft -- pi_system   In OSIsoft PI System multiple products and versions, a remote, unauthenticated attacker could crash PI Network Manager service through specially crafted requests. This can result in blocking connections and queries to PI Data Archive. 2020-07-25 not yet calculated CVE-2020-10604MISC oslsoft -- pi_system   In OSIsoft PI System multiple products and versions, a local attacker can exploit incorrect permissions set by affected PI System software. This exploitation can result in unauthorized information disclosure, deletion, or modification if the local computer also processes PI System data from other users, such as from a shared workstation or terminal server deployment. 2020-07-24 not yet calculated CVE-2020-10606MISC oslsoft -- pi_system   In OSIsoft PI System multiple products and versions, a local attacker can plant a binary and bypass a code integrity check for loading PI System libraries. This exploitation can target another local user of PI System software on the computer to escalate privilege and result in unauthorized information disclosure, deletion, or modification. 2020-07-24 not yet calculated CVE-2020-10608MISC oslsoft -- pi_system   In OSIsoft PI System multiple products and versions, a local attacker can modify a search path and plant a binary to exploit the affected PI System software to take control of the local computer at Windows system privilege level, resulting in unauthorized information disclosure, deletion, or modification. 2020-07-24 not yet calculated CVE-2020-10610MISC oslsoft -- pi_system   In OSIsoft PI System multiple products and versions, an authenticated remote attacker with write access to PI Vision databases could inject code into a display. Unauthorized information disclosure, deletion, or modification is possible if a victim views the infected display. 2020-07-25 not yet calculated CVE-2020-10614MISC oslsoft -- pi_system   In OSIsoft PI System multiple products and versions, an authenticated remote attacker could crash PI Network Manager due to a race condition. This can result in blocking connections and queries to PI Data Archive. 2020-07-24 not yet calculated CVE-2020-10602MISC overwolf -- overwolf   Overwolf before 0.149.2.30 mishandles Symbolic Links during updates, causing elevation of privileges. 2020-07-24 not yet calculated CVE-2020-15932MISC palo_alto_networks -- avertx_hd838_and_hd438_ip_cameras   An issue was discovered in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD Indoor/Outdoor Mini IP Bullet Camera HD438. An attacker with physical access to the UART interface could access additional diagnostic and configuration functionalities as well as the camera's bootloader. Successful exploitation could compromise confidentiality, integrity, and availability of the affected system. It could even render the device inoperable. 2020-07-23 not yet calculated CVE-2020-11623MISC palo_alto_networks -- avertx_hd838_and_hd438_ip_cameras   An issue was discovered in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD Indoor/Outdoor Mini IP Bullet Camera HD438. They do not require users to change the default password for the admin account. They only show a pop-up window suggesting a change but there's no enforcement. An administrator can click Cancel and proceed to use the device without changing the password. Additionally, they disclose the default username within the login.js script. Since many attacks for IoT devices, including malware and exploits, are based on the usage of default credentials, it makes these cameras an easy target for malicious actors. 2020-07-23 not yet calculated CVE-2020-11624MISC palo_alto_networks -- avertx_hd838_and_hd438_ip_cameras   An issue was discovered in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD Indoor/Outdoor Mini IP Bullet Camera HD438. Failed web UI login attempts elicit different responses depending on whether a user account exists. Because the responses indicate whether a submitted username is valid or not, they make it easier to identify legitimate usernames. If a login request is sent to ISAPI/Security/sessionLogin/capabilities using a username that exists, it will return the value of the salt given to that username, even if the password is incorrect. However, if a login request is sent using a username that is not present in the database, it will return an empty salt value. This allows attackers to enumerate legitimate usernames, facilitating brute-force attacks. NOTE: this is different from CVE-2020-7057. 2020-07-23 not yet calculated CVE-2020-11625MISC parallels -- remote_application_server   Parallels Remote Application Server (RAS) 17.1.1 has a Business Logic Error causing remote code execution. It allows an authenticated user to execute any application in the backend operating system through the web application, despite the affected application not being published. In addition, it was discovered that it is possible to access any host in the internal domain, even if it has no published applications or the mentioned host is no longer associated with that server farm. 2020-07-24 not yet calculated CVE-2020-15860MISCMISC parser-server -- parser-server   In parser-server from version 3.5.0 and before 4.3.0, an authenticated user using the viewer GraphQL query can by pass all read security on his User object and can also by pass all objects linked via relation or Pointer on his User object. 2020-07-22 not yet calculated CVE-2020-15126MISCMISCCONFIRM phoenix_contact -- plcnext_engineer   In PHOENIX CONTACT PLCnext Engineer version 2020.3.1 and earlier an improper path sanitation vulnerability exists on import of project files. 2020-07-21 not yet calculated CVE-2020-12499CONFIRM radare -- radare2   In radare2 before version 4.5.0, malformed PDB file names in the PDB server path cause shell injection. To trigger the problem it's required to open the executable in radare2 and run idpd to trigger the download. The shell code will execute, and will create a file called pwned in the current directory. 2020-07-20 not yet calculated CVE-2020-15121MISCMISCMISCCONFIRM raspberry_tortoise -- raspberry_tortoise   The WebControl in RaspberryTortoise through 2012-10-28 is vulnerable to remote code execution via shell metacharacters in a URI. The file nodejs/raspberryTortoise.js has no validation on the parameter incomingString before passing it to the child_process.exec function. 2020-07-23 not yet calculated CVE-2020-15477MISCMISC rollup-plugin-server -- rollup-plugin-server   This affects all versions of package rollup-plugin-server. There is no path sanitization in readFile operation performed inside the readFileFromContentBase function. 2020-07-25 not yet calculated CVE-2020-7683MISC rollup-plugin-server -- rollup-plugin-server   This affects all versions of package rollup-plugin-dev-server. There is no path sanitization in readFile operation inside the readFileFromContentBase function. 2020-07-25 not yet calculated CVE-2020-7686MISC schneider_electric -- easergy_builder   A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could allow an attacker access to the authorization credentials for a device and gain full access. 2020-07-23 not yet calculated CVE-2020-7514MISC schneider_electric -- easergy_builder   A CWE-321: Use of hard-coded cryptographic key stored in cleartext vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could allow an attacker to decrypt a password. 2020-07-23 not yet calculated CVE-2020-7515MISC schneider_electric -- easergy_builder   A CWE-316: Cleartext Storage of Sensitive Information in Memory vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could allow an attacker access to login credentials. 2020-07-23 not yet calculated CVE-2020-7516MISC schneider_electric -- easergy_builder   A CWE-312: Cleartext Storage of Sensitive Information vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could allow an attacker to read user credentials. 2020-07-23 not yet calculated CVE-2020-7517MISC schneider_electric -- easergy_builder   A CWE-521: Weak Password Requirements vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could allow an attacker to compromise a user account. 2020-07-23 not yet calculated CVE-2020-7519MISC schneider_electric -- easergy_builder   A CWE-20: Improper input validation vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could allow an attacker to modify project configuration files. 2020-07-23 not yet calculated CVE-2020-7518MISC schneider_electric -- sesu   A CWE-601: URL Redirection to Untrusted Site ('Open Redirect') vulnerability exists in Schneider Electric Software Update (SESU), V2.4.0 and prior, which could cause execution of malicious code on the victim's machine. In order to exploit this vulnerability, an attacker requires privileged access on the engineering workstation to modify a Windows registry key which would divert all traffic updates to go through a server in the attacker's possession. A man-in-the-middle attack is then used to complete the exploit. 2020-07-23 not yet calculated CVE-2020-7520MISC schneider_electric -- triconex_safety_systems   **VERSION NOT SUPPORTED WHEN ASSIGNED** A legacy debug port account in TCMs installed in Tricon system versions 10.2.0 through 10.5.3 is visible on the network and could allow inappropriate access. This vulnerability was remediated in TCM version 10.5.4. 2020-07-23 not yet calculated CVE-2020-7491MISC tenda -- ac15_ac1900_devices   goform/AdvSetLanip endpoint on Tenda AC15 AC1900 15.03.05.19 devices allows remote attackers to execute arbitrary system commands via shell metacharacters in the lanIp POST parameter. 2020-07-23 not yet calculated CVE-2020-15916MISC tesla -- model_3_vehicles   ** DISPUTED ** Tesla Model 3 vehicles allow attackers to open a door by leveraging access to a legitimate key card, and then using NFC Relay. NOTE: the vendor has developed Pin2Drive to mitigate this issue. 2020-07-23 not yet calculated CVE-2020-15912MISCMISCMISCMISC torchbox -- wagtail   In Wagtail before versions 2.7.4 and 2.9.3, when a form page type is made available to Wagtail editors through the `wagtail.contrib.forms` app, and the page template is built using Django's standard form rendering helpers such as form.as_p, any HTML tags used within a form field's help text will be rendered unescaped in the page. Allowing HTML within help text is an intentional design decision by Django; however, as a matter of policy Wagtail does not allow editors to insert arbitrary HTML by default, as this could potentially be used to carry out cross-site scripting attacks, including privilege escalation. This functionality should therefore not have been made available to editor-level users. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. Patched versions have been released as Wagtail 2.7.4 (for the LTS 2.7 branch) and Wagtail 2.9.3 (for the current 2.9 branch). In these versions, help text will be escaped to prevent the inclusion of HTML tags. Site owners who wish to re-enable the use of HTML within help text (and are willing to accept the risk of this being exploited by editors) may set WAGTAILFORMS_HELP_TEXT_ALLOW_HTML = True in their configuration settings. Site owners who are unable to upgrade to the new versions can secure their form page templates by rendering forms field-by-field as per Django's documentation, but omitting the |safe filter when outputting the help text. 2020-07-20 not yet calculated CVE-2020-15118MISCMISCMISCMISCCONFIRM ubuntu -- ubuntu   In Ubuntu's trust-store, if a user revokes location access from an application, the location is still available to the application because the application will honour incorrect, cached permissions. This is because the cache was not ordered by creation time by the Select struct in src/core/trust/impl/sqlite3/store.cpp. Fixed in trust-store (Ubuntu) version 1.1.0+15.04.20150123-0ubuntu1 and trust-store (Ubuntu RTM) version 1.1.0+15.04.20150123~rtm-0ubuntu1. 2020-07-22 not yet calculated CVE-2014-1422CONFIRMCONFIRM wildfly -- enterprise_java_beans   A vulnerability was found in Wildfly's Enterprise Java Beans (EJB) versions shipped with Red Hat JBoss EAP 7, where SessionOpenInvocations are never removed from the remote InvocationTracker after a response is received in the EJB Client, as well as the server. This flaw allows an attacker to craft a denial of service attack to make the service unavailable. 2020-07-24 not yet calculated CVE-2020-14307CONFIRM wildfly -- enterprise_java_beans   A flaw was discovered in Wildfly's EJB Client as shipped with Red Hat JBoss EAP 7, where some specific EJB transaction objects may get accumulated over the time and can cause services to slow down and eventaully unavailable. An attacker can take advantage and cause denial of service attack and make services unavailable. 2020-07-24 not yet calculated CVE-2020-14297CONFIRM wind_river -- vxworks   httpRpmFs in WebCLI in Wind River VxWorks 5.5 through 7 SR0640 has no check for an escape from the web root. 2020-07-23 not yet calculated CVE-2020-11440MISCMISC Back to top This product is provided subject to this Notification and this Privacy & Use policy.

Read more »

Thinking of a Cybersecurity Career? Read This
Thousand of people graduate from colleges and universities each year with cybersecurity or computer science degrees only to find employers are less than thrilled about their hands-on, foundational skills. Here's a look at a recent survey that identified some of the bigger skills gaps, and some thoughts about how those seeking a career in these fields can better stand out from the crowd.

Read more »

Are smart locks really that smart? – Intego Mac Podcast Ep...
We follow up on the great Twitter hack of 2020, we discuss how a Cloudflare outage brought down many major websites, and Kirk tells a story of a suspicious email from his local government. We then examine whether smart locks are really safe. Cloudflare had a (non-security) outage IsItDownRightNow? Hackers Tell the Story of the […] The post Are smart locks really that smart? – Intego Mac Podcast Episode 145 appeared first on The Mac Security Blog.

Read more »

Expercom offers $320 discount on the 6-core 16″ MacBook Pr...
Apple reseller Expercom has the Silver 16″ 6-core MacBook Pro on sale for a limited time for $2079 shipped. Their price is $320 off Apple’s MSRP for this model, and it’s the cheapest price currently available for a new 16″ MacBook Pro from any Apple reseller. For the latest prices and sales, keep an eye on our 16″ MacBook Pro Price Tracker, → Read More...

Read more »

Apple announces Education pricing for new 2020 iMacs, up to ...
Purchase a new 2020 iMac or iMac Pro at Apple using Apple’s Education discount, and take up to $400 off MSRP. All teachers, students, and staff of any educational institution with a .edu email address qualify for the discount. In addition, as part of their Back to School promotion for 2020, Apple will include one free pair Apple AirPods (with charging case) with the purchase of a 2020 iMac or iMac Pro. You can optionally choose Apple AirPods with the Wireless Charging Case for only $40 (regularly $199) or Apple AirPods Pro for only $90 (regularly $249). Promotion runs through early September: – 27″ 10-Core iMac Pro: $4599 $400 off – 27″ 3.8GHz 5K iMac: $2099 $200 off – 27″ 3.3GHz 5K iMac: $1899 $100 off – 27″ 3.1GHz 5K iMac: $1699 $100 off – 21″ 3.0GHz 4K iMac: $1399 $100 off – 21″ 3.6GHz 4K iMac: $1249 $50 off – 21″ 2.3GHz iMac: $1049 $50 off Not in the US? Click for the Canada or the → Read More...

Read more »

Apple reseller Expercom offers $256 discount on new 2020 10-...
Expercom has Apple’s new 2020 10-core iMac Pro available for order and on sale for $4743 shipped. Their price is $256 off Apple’s MSRP for this new model, and it’s the cheapest price we’ve seen so far for a 10-core iMac Pro. Keep an eye on our iMac Pro Price Tracker the latest prices & deals from Apple and → Read More...

Read more »

Apple releases refreshed 2020 27″ iMacs with 10th generati...
Apple today released updated versions of their 27″ iMacs featuring 10th generation Intel processors, SSDs across the board, a better 5K display, and improvements to the camera, speakers, and mic. According to Apple, “By far the most powerful and capable iMac ever, it features faster Intel processors up to 10 cores, double the memory capacity, next-generation AMD graphics, superfast SSDs across the line with four times the storage capacity, a new nano-texture glass option for an even more stunning Retina 5K display, a 1080p FaceTime HD camera, higher fidelity speakers, and studio-quality mics. For the consumer using their iMac all day, every day, to the aspiring creative looking for inspiration, to the serious pro pushing the limits of their creativity, the new 27-inch iMac delivers the ultimate desktop experience that is now better in every way.” Price points and base configurations are similar to previous models: – 27″ 3.1GHz 6-Core iMac 8GB RAM/256GB SSD/Radeon Pro 5300 4GB: $1799 – 27″ 3.3GHz 6-Core iMac 8GB RAM/512GB SSD/Radeon Pro 5300 4GB: $1999 – 27″ 3.8GHz 8-Core iMac 8GB RAM/512GB SSD/Radeon Pro 5500 XT 8GB: $2299 All three models are in stock today at Apple. Build-to-order options range up to 3.6GHz 10-core CPUs, 128GB RAM, 8TB SSDs, and 16GB of video memory. Apple also released minor updates to the 21″ iMac and iMac Pro: “Apple today also announced that its 21.5-inch iMac will come standard with SSDs across the line for the first time. Customers can also choose to configure their 21.5-inch iMac with a Fusion Drive. iMac Pro now comes standard with a 10-core Intel Xeon processor. Designed for pro users who require workstation-class performance, iMac Pro features Xeon processors up to 18 cores, graphics performance up to 22 teraflops, up to 256GB quad-channel ECC memory, and a brilliant 27-inch Retina 5K display.” We’ll be updating our iMac Price Tracker with the latest prices and deals on these new models as information comes in from Apple and → Read More...

Read more »

Xfinity Mobile promo: Take $200-$350 off Apple’s iPhone 11...
New customers can take $200 off the purchase of any new Apple iPhone model at Xfinity Mobile through 8/17/20. Service plan required. Existing customers can purchase an iPhone and receive $200 back in the form of a prepaid card. While supplies last, Xfinity Mobile is offering an additional $150 off the purchase of the 512GB iPhone 11 Pro, in Space Gray, for a total of $350 off MSRP. This deal is live today at → Read More...

Read more »

B&H now offering $100-$200 discount on Apple’s 2020 13...
B&H Photo has new 2020 13″ 2.0GHz MacBook Pros on sale for $100-$200 off Apple’s MSRP, starting at $1649. These are the same MacBook Pros sold by Apple in their retail and online stores, and B&H’s prices are the among lowest available for these models from any Apple reseller: – 13″ 2.0GHz/512GB MacBook Pro Space Gray: $1649 $150 off MSRP – 13″ 2.0GHz/512GB MacBook Pro Silver: $1699 $100 off MSRP – 13″ 2.0GHz/1TB MacBook Pro Space Gray: $1799 $200 off MSRP – 13″ 2.0GHz/1TB MacBook Pro Silver: $1799 $200 off MSRP For the latest prices and sales, keep an eye on our 13″ MacBook Pro Price Tracker, → Read More...

Read more »

Apple’s 6-Core Mac mini is on sale at Amazon for $173 off ...
Amazon has Apple’s new 2020 6-Core Mac mini on sale for $926.25 for a limited time. Their price is $173 off Apple’s $1099 MSRP for this model and includes a $48.75 instant discount available on their product page. Shipping is free. You won’t find a cheaper price for the 6-Core Mac mini anywhere else. See our Mac mini Price Tracker for the latest prices & sales from Apple and its resellers, → Read More...

Read more »

New 2020 11″ iPad Pros on sale for $50-$75 off Apple’s M...
Apple reseller Expercom has new 2020 11″ Apple iPad Pros on sale for $50-$75 off MSRP, with prices starting at $749. These are the same iPad Pros sold by Apple in their retail and online stores: – 11″ 128GB WiFi iPad Pro: $749 $50 off – 11″ 256GB WiFi iPad Pro: $844 $55 off – 11″ 512GB WiFi iPad Pro: $1034 $65 off – 11″ 1TB WiFi iPad Pro: $1229 $70 off – 11″ 128GB WiFi + Cell iPad Pro: $894 $55 off – 11″ 256GB WiFi + Cell iPad Pro: $989 $60 off – 11″ 512GB WiFi + Cell iPad Pro: $1179 $70 off – 11″ 1TB WiFi + Cell iPad Pro: $1374 $75 off Configurations not in stock today are still available for order at the discounted price. Some of their prices are the lowest currently available for these iPads from any Apple reseller. Keep an eye on our 11″ iPad Pro Price Tracker for the latest → Read More...

Read more »

Switch to US Cellular and get a new Apple iPhone SE for as l...
US Cellular has Apple’s 2020 iPhone SE on sale for $350 off for new lines of service and a US Cellular unlimited plan. Promotion comes via monthly bill credits over a 30 month period. Their deal lowers the price of the 64GB iPhone SE to only $1.63 per month (normally $13.30), the 128GB SE to $3.29 per month (normally $14.96), and the 256GB iPhone SE down to $6.63 (normally $18.30) per month. US Cellular’s deal is live on their → Read More...

Read more »

Apple AirPods with Wireless Charging Case on sale today for ...
Amazon has Apple’s AirPods with Wireless Charging Case on sale today for only $139.98 shipped. That’s $60 off Apple’s MSRP and the lowest price we’ve ever seen for these AirPods. Sale valid for a limited time only. For the latest prices and sales, see our Apple AirPods Price Tracker, → Read More...

Read more »

Apple’s 2020 Back to School promotion: Get a free set of A...
As part of their Back to School promotion for 2020, Apple will include one free pair Apple AirPods (with charging case) with the purchase of a MacBook Air, MacBook Pro, iMac, iMac Pro (Mac Pro and Mac mini excluded), iPad Pro, or iPad Air. You can optionally choose Apple AirPods with the Wireless Charging Case for only $40 (regularly $199) or Apple AirPods Pro for only $90 (regularly $249). Promotion runs through early September. In addition, when you purchase a new Mac using Apple’s Education discount, take up to $400 off MSRP. All teachers, students, and staff of any educational institution with a .edu email address qualify for the discount: – 2019 16″ 2.3GHz 8-Core Touch Bar MacBook Pro: $2599 $200 off – 2019 16″ 2.6GHz 6-Core Touch Bar MacBook Pro: $2199 $200 off – 2020 13″ 2.0GHz/1TB 4-Core Touch Bar MacBook Pro: $1899 $100 off – 2020 13″ 2.0GHz/512GB 4-Core Touch Bar MacBook Pro: $1699 $100 off – 2020 13″ 1.4GHz/512GB 4-Core Touch Bar MacBook Pro: $1399 $100 off – 2020 13″ 1.4GHz/256GB 4-Core Touch Bar MacBook Pro: $1199 $100 off – 2020 13″ Dual-Core MacBook Air: $899 $100 off – 2020 13″ Quad-Core MacBook Air: $1199 $100 off – 8-Core Mac Pro: $5599 $400 off – Pro Display XDR (standard): $4599 $400 off – Pro Display XDR (nano glass): $5599 $400 off – Pro Stand: $5599 $100 off – 27″ 8-Core iMac Pro: $4599 $400 off – 27″ 3.7GHz 5K iMac: $2099 $200 off – 27″ 3.1GHz 5K iMac: $1899 $100 off – 27″ 3.0GHz 5K iMac: $1699 $100 off – 21″ 3.0GHz 4K iMac: $1399 $100 off – 21″ 3.6GHz 4K iMac: $1249 $50 off – 21″ 2.3GHz iMac: $1049 $50 off – 3.6GHz Mac mini: $779 $20 → Read More...

Read more »