Summary: Recently cyber-security researchers from Zecops disclosed a new critical vulnerability affecting SMB(Server Message Block)v3 protocol that may allow an attacker to leak kernel memory remotely, also when combined with a previously disclosed SMBGhost(CVE-2020-0796) bug, the flaw can further be exploited to achieve remote code execution on the target system.This issue was assigned under CVE-2020-1206. … Continue reading “Microsoft Windows SMBv3 SMBleed Vulnerability (CVE-2020-1206)”
Apache Tomcat Remote Code Execution Vulnerability(CVE-2020-9484)
Summary: Recently a new remote code execution vulnerability was disclosed for Apache Tomcat. Apache Tomcat is prone to by a Java deserialization vulnerability. However successful exploitation of this vulnerability requires the attacker to be able to upload an arbitrary file onto the server. This issue was assigned under CVE-2020-9484. Description: There are number of prerequisites … Continue reading “Apache Tomcat Remote Code Execution Vulnerability(CVE-2020-9484)”
Universal Plug and Play (UPnP) CallStranger Vulnerability(CVE-2020-12695)
Overview: On 8 June 2020, A new vulnerability has been disclosed in public domain for Universal Plug and Play (UPnP). The vulnerability has been given a name CallStranger. Exploitation of this bug, could result into exfiltration of data, distributed denial of service (DDoS) attack or scanning your network etc. Universal Plug and Play (UPnP) is a … Continue reading “Universal Plug and Play (UPnP) CallStranger Vulnerability(CVE-2020-12695)”
Zoom path traversal into remote code execution vulnerabilities (CVE-2020-6109, CVE-2020-6110)
Update June 5, 2020: Qualys’ standard procedure is to give proper credit to the security research teams working diligently to discover and report vulnerabilities. In our rush to deliver this article to customers, we missed giving credit to the talented Cisco Talos team, who are the original authors of this research. After additional review with a … Continue reading “Zoom path traversal into remote code execution vulnerabilities (CVE-2020-6109, CVE-2020-6110)”
VMware Cloud Director Remote Code Execution Vulnerability
On May 19,2020 VMware released an advisory to address Remote Code Execution vulnerability in VMware Cloud Director. CVE-2020-3956 has assigned to track this vulnerability. vCloud Director VMware Cloud Director (formerly known as vCloud Director) is a popular deployment, automation, and management software that’s used to operate and manage cloud resources, allowing businesses to data centers distributed … Continue reading “VMware Cloud Director Remote Code Execution Vulnerability”
ISC BIND NXNSAttack Vulnerability (CVE-2020-8616,CVE-2020-8617)
Summary: Two critical vulnerabilities were observed as CVE-2020-8616 and CVE-2020-8617 for ISC BIND in May 2020. To address those vulnerabilities patches were released. ISC Berkeley Internet Name Domain (BIND) is the most widely used Domain Name System (DNS) software on the Internet. This vulnerability can be exploited when an unwanted user get an access of … Continue reading “ISC BIND NXNSAttack Vulnerability (CVE-2020-8616,CVE-2020-8617)”
eG Manager Remote Code Execution Vulnerability(CVE-2020-8591)
Overview: On January 2020, an Improper Access Control vulnerability had discovered in eG manager. Exploitation leads to Remote Code Execution. Improper Access Control describes failure in AAA (Authentication, Authorization, Accounting) security model. The eG Manager is a central web portal which provides administrators with authenticated access over the web to the performance statistics stored in … Continue reading “eG Manager Remote Code Execution Vulnerability(CVE-2020-8591)”
FusionAuth Remote Code Execution Vulnerability(CVE-2020-7799)
Overview A Remote Code Execution (RCE) vulnerability had discovered in FusionAuth. An authencated attacker can execute commands on system using the Apache FreeMarker Expression language. What is FusionAuth? FusionAuth is an identity access management application. It provides features like registration, login, SSO, MFA, password hashing, password constraints, password reset, email templates, OAuth, OpenID Connect and others. All … Continue reading “FusionAuth Remote Code Execution Vulnerability(CVE-2020-7799)”
Docker Desktop Privilege Escalation Vulnerability(CVE-2020-11492)
Vulnerability Overview: Recently, a vulnerability has been discovered in Docker Desktop. This flaw allows a local user to escalate privilege on the system. Vulnerability exist in the docker Desktop service. Before looking into vulnerability, understand few concepts Docker Desktop and named pipe. Docker Desktop for Windows provides an environment for building, shipping, and running dockerized … Continue reading “Docker Desktop Privilege Escalation Vulnerability(CVE-2020-11492)”
CISCO ANYCONNECT secure mobility client on Windows Privilege Escalation Vulnerability (CVE-2020-3153)
Summary: Recently,a critical vulnerability was observed in wild in Cisco AnyConnect Secure Mobility Client on Windows. Its a privilege escalation vulnerability occurs with a manipulation with an unknown input. Classified as CWE-427 impacting the CIA triad. Description: This vulnerability is exploitable only by an authenticated as well as local attacker. It allows an attacker to … Continue reading “CISCO ANYCONNECT secure mobility client on Windows Privilege Escalation Vulnerability (CVE-2020-3153)”
