On November 11, 2020, Google Chrome issued an update announcement for the browser across all platforms. Google confirmed that the “stable channel” desktop Chrome browser is being updated to version 86.0.4240.198 across Windows, Mac, and Linux platforms. As per Google’s official sources, this urgent update will start rolling out over the coming few days or weeks. About … Continue reading “Two Zero-days in Google Chrome”
Author: Neelam Kadbane
Google Chrome Actively Attacked In the Wild
On October 20, 2020, Google Chrome issued an update announcement for the browser across all platforms. Google confirmed that the “stable channel” desktop Chrome browser is being updated to version 86.0.4240.111 across Windows, Mac, and Linux platforms. As per Google’s official sources, this urgent update will start rolling out over the coming few days or … Continue reading “Google Chrome Actively Attacked In the Wild”
Multiple Vulnerabilities in Openfire Admin Console
Openfire is a group chat server for the Extensible Messaging and Presence Protocol (XMPP). It is written in Java and licensed under the Apache License 2.0. Two vulnerabilities, CVE-2019-18394 and CVE-2019-18393, were reported in Openfire Admin Console by a Penetration Testing Expert, Alexandr Shvetsov. Vulnerability Details CVE-2019-18394 – Full Read SSRF Vulnerability A Server-Side Request … Continue reading “Multiple Vulnerabilities in Openfire Admin Console”
Zero-Day Vulnerabilities in Microsoft (CVE-2020-1464, CVE-2020-1380)
For August 2020 Patch Tuesday, Microsoft has rolled out 120 security updates across 13 different products including Windows, Edge (EdgeHTML-based and Chromium-based), Office, Internet Explorer (IE), ChakraCore and Developer Tools such as .NET Framework, ASP.NET, and Visual Studio. Out of these vulnerabilities, 17 are classified as Critical and 103 are classified as Important. The 17 … Continue reading “Zero-Day Vulnerabilities in Microsoft (CVE-2020-1464, CVE-2020-1380)”
Artica Proxy Multiple Security Vulnerabilities
Artica Proxy is a system that provides a Web Ajax console in order to manage a full Proxy server with latest Squid technology. Security Researcher Amar Kaldate, and Pratiksha Dhone from Qualys have reported multiple vulnerabilities in Artica Proxy Project. Vulnerability Details CVE-2020-13158 – Directory Traversal Artica Proxy Community Edition allows Directory Traversal via the … Continue reading “Artica Proxy Multiple Security Vulnerabilities”
Grafana SSRF Vulnerability (CVE-2020-13379)
On 3rd June 2020, Grafana published a security advisory addressing CVE-2020-13379, SSRF (Server-side request forgery) Incorrect Access Control issue. This is a high-severity vulnerability with a CVSS score of 6.4. Vulnerability Details The avatar feature in Grafana has an SSRF Incorrect Access Control issue. This allows unauthenticated attackers to force Grafana to send HTTP requests … Continue reading “Grafana SSRF Vulnerability (CVE-2020-13379)”
GRUB2 Boothole Buffer Overflow Vulnerability (CVE-2020-10713)
On 29th July 2020, a team of security researchers disclosed a high priority bug in GRUB2(GRand Unified Bootloader version 2) , affecting billions of Linux and Windows systems using secure boot. CVE-2020-10713 is assigned to this buffer overflow vulnerability, termed as “Boothole”. “Boothole” Secure Boot is designed to verify all the firmware of the computer … Continue reading “GRUB2 Boothole Buffer Overflow Vulnerability (CVE-2020-10713)”
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Path Traversal Vulnerability
On 22nd July 2020, Cisco published an high-severity advisory (CVE-2020-3452) with CVSS score of 7.5. Vulnerability Details Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software contains a vulnerability in web services that can allow unauthenticated, remote attackers to perform directory traversal attacks to read sensitive information on the system. The vulnerability … Continue reading “Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Path Traversal Vulnerability”
Zoom Client for Windows Remote Code Execution Vulnerability
Earlier this week a report published for remote code execution vulnerability in Zoom Client for Windows. This bug is reported to 0patch Team by a researcher who wants to keep their identity private. Vulnerability Details A vulnerability has been discovered in Zoom Client that could allow for arbitrary code execution. It is affected to any … Continue reading “Zoom Client for Windows Remote Code Execution Vulnerability”
VMware Multiple Vulnerabilities (VMSA-2020-0015)
VMware issued a new security advisory on 23rd June,2020. VMSA-2020-0015 Addressed the ten security vulnerabilities in various VMware products. Among these multiple vulnerabilities, a bug, CVE-2020-3962 is a critical vulnerability with a 9.3 CVSSv3 base score. Rest nine flaws are of Important and Moderate severity. Affected VMware Products: VMware ESXi VMware Workstation Pro/Player (Workstation) VMware … Continue reading “VMware Multiple Vulnerabilities (VMSA-2020-0015)”