Vulnerabilities

Hyland OnBase 19.x and below – Hardcoded PKI Certificates And AES Key Material

September 8, 2020

Posted by AdaptiveSecurity Consulting via Fulldisclosure on Sep 07CVSSv3.1 Score ------------------------------------------------- AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Vendor ------------------------------------------------- Hyland Software - (https://www.hyland.com/en/ and https://www.onbase.com/en/)...

Hyland OnBase 19.x and below – Log Injection And Denial Of Service

September 8, 2020

Posted by AdaptiveSecurity Consulting via Fulldisclosure on Sep 07CVSSv3.1 Score ------------------------------------------------- AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H Vendor ------------------------------------------------- Hyland Software - (https://www.hyland.com/en/ and https://www.onbase.com/en/)...

Open Source Tool | vPrioritization | Risk Prioritization Framework

September 4, 2020

Posted by Pramod Rana on Sep 04It is no secret that today we have more vulnerabilities than we can assess...

Pulse Secure Windows Client <9.1.6 (CVE-2020-13162) – exploit

September 4, 2020

Posted by Red Timmy Security on Sep 04Hi, we have just released an exploit for CVE-2020-13162. This vulnerability affects the...

Noise-Java ChaChaPolyCipherState.encryptWithAd() insufficient boundary checks

September 4, 2020

Posted by Pietro Oliva via Fulldisclosure on Sep 04Vulnerability title: Noise-Java ChaChaPolyCipherState.encryptWithAd() insufficient boundary checks Author: Pietro Oliva CVE: CVE-2020-25021...

Noise-Java AESGCMOnCtrCipherState.encryptWithAd() insufficient boundary checks

September 4, 2020

Posted by Pietro Oliva via Fulldisclosure on Sep 04Vulnerability title: Noise-Java AESGCMOnCtrCipherState.encryptWithAd() insufficient boundary checks Author: Pietro Oliva CVE: CVE-2020-25023...

Noise-Java AESGCMFallbackCipherState.encryptWithAd() insufficient boundary checks

September 4, 2020

Posted by Pietro Oliva via Fulldisclosure on Sep 04Vulnerability title: Noise-Java AESGCMFallbackCipherState.encryptWithAd() insufficient boundary checks Author: Pietro Oliva CVE: CVE-2020-25022...

SEC Consult SA-20200902-0 :: Multiple Vulnerabilities in Red Lion N-Tron 702-W, Red Lion N-Tron 702M12-W

September 3, 2020

Posted by SEC Consult Vulnerability Lab on Sep 02SEC Consult Vulnerability Lab Security Advisory < 20200902-0 > ======================================================================= title: Multiple...

[RT-SA-2020-004] Inconsistent Behavior of Go’s CGI and FastCGI Transport May Lead to Cross-Site Scripting

September 2, 2020

Posted by RedTeam Pentesting GmbH on Sep 02Advisory: Inconsistent Behavior of Go's CGI and FastCGI Transport May Lead to Cross-Site...

Kamailio vulnerable to header smuggling possible due to bypass of remove_hf

September 1, 2020

Posted by Sandro Gauci on Sep 01# Kamailio vulnerable to header smuggling possible due to bypass of remove_hf - Fixed...

Sagemcom router insecure deserialization > privilege escalation

September 1, 2020

Posted by Ryan Delaney on Sep 01<!-- # Exploit Title: Sagemcom router insecure deserialization > privilege escalation # Date: 08-31-2020...

Roundcube issue – Auth bypass via Improper Session Management

September 1, 2020

Posted by Balázs Hambalkó on Sep 01Hi, Title: Authentication bypass via Improper Session Management Product: RoundcubeMail Tested version: 1.4.4 -...

Bagisto: Default credentials for admin interface

September 1, 2020

Posted by devsecweb--- via Fulldisclosure on Sep 01Vendor: Bagisto (https://bagisto.com/) Affected version: All Introduction: Bagisto is an open source shop...

Bagisto: Insecure installation in sub-directories

September 1, 2020

Posted by devsecweb--- via Fulldisclosure on Sep 01Vendor: Bagisto (https://bagisto.com/) Affected version: All Introduction: Bagisto is an open source shop...

SUPERAntiSpyware Professional X Trial < 10.0.1206 Local Privilege Escalation

August 29, 2020

Posted by b1nary on Aug 29# Vulnerability Description SUPERAntiSpyware Professional X Trial versions prior to 10.0.1206 are vulnerable to local...

Missing Trust Validation in Visual Studio’s VSIX Installer

August 29, 2020

Posted by Ostovary, Daniel on Aug 29Hi, we have recently discovered a vulnerability in the VSIX Installer of Visual Studio....

Three vulnerabilities found in MikroTik’s RouterOS

August 29, 2020

Posted by Q C on Aug 29Advisory: three vulnerabilities found in MikroTik's RouterOS Details ======= Product: MikroTik's RouterOS Vendor URL:...

SEC Consult SA-20200827-0 :: Multiple Vulnerabilities in ZTE mobile Hotspot MS910S

August 28, 2020

Posted by SEC Consult Vulnerability Lab on Aug 27SEC Consult Vulnerability Lab Security Advisory < 20200827-0 > ======================================================================= title: Multiple...

SEC Consult SA-20200826-0 :: Extensive file permissions on service executable in Eikon Thomson Reuters

August 28, 2020

Posted by SEC Consult Vulnerability Lab on Aug 27SEC Consult Vulnerability Lab Security Advisory < 20200826-0 > ======================================================================= title: Extensive...

A Tale of Escaping a Hardened Docker container

August 25, 2020

Posted by Red Timmy Security on Aug 25Hello, in a recent security assessment we have managed to escape out of...

NEProfile – Host Header Injection

August 25, 2020

Posted by ghost on Aug 25 Exploit Title: NEProfile - Host Header Injection Date: 5/13/2020 Vendor Homepage: https://seczetta.com Software Link:...

Google Chromecast Auth Bypass/RCE

August 25, 2020

Posted by Benjamin Floyd on Aug 25Problem: Most modern Google-based smart devices run some form of Chromecast (and a version...

CVE-2020-24548 / Ericom Access Server for (AccessNow & Ericom Blaze) v9.2.0 / Server Side Request Forgery

August 25, 2020

Posted by hyp3rlinx on Aug 25 Credits: John Page (aka hyp3rlinx) Website: hyp3rlinx.altervista.org Source:http://hyp3rlinx.altervista.org/advisories/ERICOM-ACCESS-SERVER-ACCESS-NOW-BLAZE-9.2.0-SERVER-SIDE-REQUEST-FORGERY.txt twitter.com/hyp3rlinx ISR: ApparitionSec www.ericom.com Ericom Access...

Open-Xchange Security Advisory 2020-08-20

August 21, 2020

Posted by Open-Xchange GmbH via Fulldisclosure on Aug 21Dear subscribers, we're sharing our latest advisory with you and like to...

Vulnerabilities

Hyland OnBase 19.x and below – Hardcoded PKI Certificates And AES Key Material

Hyland OnBase 19.x and below – Log Injection And Denial Of Service

Open Source Tool | vPrioritization | Risk Prioritization Framework

Pulse Secure Windows Client <9.1.6 (CVE-2020-13162) – exploit

Noise-Java ChaChaPolyCipherState.encryptWithAd() insufficient boundary checks

Noise-Java AESGCMOnCtrCipherState.encryptWithAd() insufficient boundary checks

Noise-Java AESGCMFallbackCipherState.encryptWithAd() insufficient boundary checks

SEC Consult SA-20200902-0 :: Multiple Vulnerabilities in Red Lion N-Tron 702-W, Red Lion N-Tron 702M12-W

[RT-SA-2020-004] Inconsistent Behavior of Go’s CGI and FastCGI Transport May Lead to Cross-Site Scripting

Kamailio vulnerable to header smuggling possible due to bypass of remove_hf

Sagemcom router insecure deserialization > privilege escalation

Roundcube issue – Auth bypass via Improper Session Management

Bagisto: Default credentials for admin interface

Bagisto: Insecure installation in sub-directories

SUPERAntiSpyware Professional X Trial < 10.0.1206 Local Privilege Escalation

Missing Trust Validation in Visual Studio’s VSIX Installer

Three vulnerabilities found in MikroTik’s RouterOS

SEC Consult SA-20200827-0 :: Multiple Vulnerabilities in ZTE mobile Hotspot MS910S

SEC Consult SA-20200826-0 :: Extensive file permissions on service executable in Eikon Thomson Reuters

A Tale of Escaping a Hardened Docker container

NEProfile – Host Header Injection

Google Chromecast Auth Bypass/RCE

CVE-2020-24548 / Ericom Access Server for (AccessNow & Ericom Blaze) v9.2.0 / Server Side Request Forgery

Open-Xchange Security Advisory 2020-08-20

CISA: CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA: CISA Releases Eight Industrial Control Systems Advisories

CISA: CISA Releases Six Industrial Control Systems Advisories

CISA: CISA and Partners Release Joint Guidance on PRC-Affiliated Threat Actor Compromising Networks of Global Telecommunications Providers

CISA: CISA Adds One Known Exploited Vulnerability to Catalog

You may have missed