Read the original article: Vulnerability Summary for the Week of December 28, 2020
Original release date: January 4, 2021
The CISA Weekly Vulnerability Summary Bulletin is created using information from the NIST NVD. In some cases, the vulnerabilities in the Bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.
High Vulnerabilities
| Primary Vendor — Product |
Description | Published | CVSS Score | Source & Patch Info |
|---|---|---|---|---|
| 3ds — teamwork_cloud | An incorrect permission assignment (chmod 777) of /etc/environment during the installation script of No Magic TeamworkCloud 18.0 through 19.0 allows any local unprivileged user to write to /etc/environment. An attacker can escalate to root by writing arbitrary code to this file, which would be executed by root during the next login, reboot, or sourcing of the environment. | 2020-12-28 | 7.2 | CVE-2020-25507 MISC MISC |
| agentejo — cockpit | Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function. | 2020-12-30 | 7.5 | CVE-2020-35848 MISC MISC MISC MISC |
| agentejo — cockpit | Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function. | 2020-12-30 | 7.5 | CVE-2020-35847 MISC MISC MISC MISC |
| agentejo — cockpit | Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function. | 2020-12-30 | 7.5 | CVE-2020-35846 MISC MISC MISC MISC |
| backblaze — backblaze | Backblaze for Windows before 7.0.1.433 and Backblaze for macOS before 7.0.1.434 suffer from improper certificate validation in `bztransmit` helper due to hardcoded whitelist of strings in URLs where validation is disabled leading to possible remote code execution via client update functionality. | 2020-12-27 | 9.3 | CVE-2020-8289 FULLDISC FULLDISC MISC MISC MISC MISC |
| deep-set_project — deep-set | Prototype pollution vulnerability in ‘deep-set’ versions 1.0.0 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution. | 2020-12-29 | 7.5 | CVE-2020-28276 MISC CONFIRM |
| dset_project — dset | Prototype pollution vulnerability in ‘dset’ versions 1.0.0 through 2.0.1 allows attacker to cause a denial of service and may lead to remote code execution. | 2020-12-29 | 7.5 | CVE-2020-28277 MISC CONFIRM |
| esri — arcgis_server | Esri ArcGIS Server before 10.8 is vulnerable to SSRF in some configurations. | 2020-12-26 | 9.3 | CVE-2020-35712 MISC MISC |
| flamingo_project — flamingo | Flamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager::addGroup. | 2020-12-26 | 7.5 | CVE-2020-35244 MISC |
| flamingo_project — flamingo | Flamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager::updateUserTeamInfoInDbAndMemory. | 2020-12-26 | 7.5 | CVE-2020-35242 MISC |
| flamingo_project — flamingo | Flamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager::updateUserInfoInDb. | 2020-12-26 | 7.5 | CVE-2020-35243 MISC |
| flamingo_project — flamingo | Flamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager::addUser. | 2020-12-26 | 7.5 | CVE-2020-35245 MISC |
| flattenizer_project — flattenizer | Prototype pollution vulnerability in ‘flattenizer’ versions 0.0.5 through 1.0.5 allows an attacker to cause a denial of service and may lead to remote code execution. | 2020-12-29 | 7.5 | CVE-2020-28279 MISC CONFIRM |
| foscammall — foscam_x1_firmware | FOSCAM FHD X1 1.14.2.4 devices allow attackers (with physical UART access) to login via the ipc.fos~ password. | 2020-12-28 | 7.2 | CVE-2020-28096 MISC |
| gdatasoftware — g_data | An issue was discovered in G-Data before 25.5.9.25 using Symbolic links, it is possible to abuse the infected-file restore mechanism to achieve arbitrary write that leads to elevation of privileges. | 2020-12-28 | 7.5 | CVE-2020-27172 MISC |
| getobject_project — getobject | Prototype pollution vulnerability in ‘getobject’ version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution. | 2020-12-29 | 7.5 | CVE-2020-28282 MISC CONFIRM |
| huorong — internet_security | Beijing Huorong Internet Security 5.0.55.2 allows a non-admin user to escalate privileges by injecting code into a process, and then waiting for a Huorong services restart or a system reboot. | 2020-12-26 | Become a supporter of IT Security News and help us remove the ads.
Read the original article: Vulnerability Summary for the Week of December 28, 2020
Post navigation |