Apache Struts Security Team has addressed two possible RCE bugs – CVE-2019-0230 and CVE-2019-0233 in their latest advisories published on August 13, 2020. Description Struts 2 is an open source coding framework for companies to create Java-based applications. The installations of Apache Struts 2, which are outdated, can be tentatively used to exploit CVE-2019-0230 as … Continue reading “Apache Struts 2 Remote Code Execution Vulnerability (CVE-2019-0230, CVE-2019-0233)”
Windows Print Spooler Elevation of Privilege Vulnerability (CVE-2020-1337)
On Aug 11th 2020, Microsoft issued a security advisory addressing the Elevation of Privilege vulnerability (CVE-2020-1337) in Windows Print Spooler service. The vulnerability has a CVSS score of 7.8 and severity marked as Important. Vulnerability Details: Windows Print Spooler is a service that participates in the Print Services system. Windows Print Spooler service was found … Continue reading “Windows Print Spooler Elevation of Privilege Vulnerability (CVE-2020-1337)”
Zero-Day Vulnerabilities in Microsoft (CVE-2020-1464, CVE-2020-1380)
For August 2020 Patch Tuesday, Microsoft has rolled out 120 security updates across 13 different products including Windows, Edge (EdgeHTML-based and Chromium-based), Office, Internet Explorer (IE), ChakraCore and Developer Tools such as .NET Framework, ASP.NET, and Visual Studio. Out of these vulnerabilities, 17 are classified as Critical and 103 are classified as Important. The 17 … Continue reading “Zero-Day Vulnerabilities in Microsoft (CVE-2020-1464, CVE-2020-1380)”
vBulletin pre-auth Remote Code Execution Vulnerability
vBulletin is a well-known forum software worldwide. Recently a pre-auth RCE was observed that bypasses CVE-2019-16759, September 2019 vBulletin patch. Security researcher Amir Etemadieh (Zenfox) has discovered this zero day and has published POC in various formats in his blog on 9th Aug,2020. Description The vulnerability exists in the dynamic creation of widgets at ajax/render/widget_tabbedcontainer_tab_panel. … Continue reading “vBulletin pre-auth Remote Code Execution Vulnerability”
Google Chrome CSP Bypass Vulnerability (CVE-2020-6519)
Overview A Content Security Policy bypass vulnerability (CVE-2020-6519) exists in Google’s Chromium-based browsers, which could allow attackers to steal data and execute arbitrary codes. Content Security Policy (CSP) is a set of rules that helps detect which content sources can be trusted and which ones should be blocked. CSP helps detect and mitigate certain types of … Continue reading “Google Chrome CSP Bypass Vulnerability (CVE-2020-6519)”
Artica Proxy Multiple Security Vulnerabilities
Artica Proxy is a system that provides a Web Ajax console in order to manage a full Proxy server with latest Squid technology. Security Researcher Amar Kaldate, and Pratiksha Dhone from Qualys have reported multiple vulnerabilities in Artica Proxy Project. Vulnerability Details CVE-2020-13158 – Directory Traversal Artica Proxy Community Edition allows Directory Traversal via the … Continue reading “Artica Proxy Multiple Security Vulnerabilities”
Microsoft Windows Elevation of Privilege Vulnerability (CVE-2020-1313)
On June 9th 2020, Microsoft issued a security advisory addressing Elevation of Privilege vulnerability (CVE-2020-1313) in Windows Update Orchestrator Service that has a CVSS score of 7.8 and severity marked as Important. Vulnerability Details: Windows Update Orchestrator Service is a DCOM service which is used by other components to install windows updates that are already … Continue reading “Microsoft Windows Elevation of Privilege Vulnerability (CVE-2020-1313)”
Grafana SSRF Vulnerability (CVE-2020-13379)
On 3rd June 2020, Grafana published a security advisory addressing CVE-2020-13379, SSRF (Server-side request forgery) Incorrect Access Control issue. This is a high-severity vulnerability with a CVSS score of 6.4. Vulnerability Details The avatar feature in Grafana has an SSRF Incorrect Access Control issue. This allows unauthenticated attackers to force Grafana to send HTTP requests … Continue reading “Grafana SSRF Vulnerability (CVE-2020-13379)”
Zero-days of Pandemic Year till August, 2020
With more than half of 2020 behind us, Google Security Researchers of Google’s Project Zero security team compared the vulnerability stats of the year with the stats from 2019. Interestingly, by this month last year, the same numbers of zero-days were detected in the wild as this year. Qualys has been uptodate with all the … Continue reading “Zero-days of Pandemic Year till August, 2020”
GRUB2 Boothole Buffer Overflow Vulnerability (CVE-2020-10713)
On 29th July 2020, a team of security researchers disclosed a high priority bug in GRUB2(GRand Unified Bootloader version 2) , affecting billions of Linux and Windows systems using secure boot. CVE-2020-10713 is assigned to this buffer overflow vulnerability, termed as “Boothole”. “Boothole” Secure Boot is designed to verify all the firmware of the computer … Continue reading “GRUB2 Boothole Buffer Overflow Vulnerability (CVE-2020-10713)”