FireEye Announces New Bug-Bounty Program

Enterprise VulnerabilitiesFrom DHS/US-CERT's National Vulnerability Database CVE-2020-17505PUBLISHED: 2020-08-12

Artica Web Proxy 4.30.000000 allows an authenticated remote attacker to inject commands via the service-cmds parameter in cyrus.php. These commands are executed with root privileges via service_cmds_peform.

CVE-2020-17506PUBLISHED: 2020-08-12

Artica Web Proxy 4.30.00000000 allows remote attacker to bypass privilege detection and gain web backend administrator privileges through SQL injection of the apikey parameter in fw.login.php.

CVE-2020-2035PUBLISHED: 2020-08-12

When SSL/TLS Forward Proxy Decryption mode has been configured to decrypt the web transactions, the PAN-OS URL filtering feature inspects the HTTP Host and URL path headers for policy enforcement on the decrypted HTTPS web transactions but does not consider Server Name Indication (SNI) field within ...

CVE-2020-5415PUBLISHED: 2020-08-12

Concourse, versions prior to 6.3.1 and 6.4.1, in installations which use the GitLab auth connector, is vulnerable to identity spoofing by way of configuring a GitLab account with the same full name as another user who is granted access to a Concourse team. GitLab groups do not have this vulnerabilit...

CVE-2020-6653PUBLISHED: 2020-08-12

Eaton's Secure connect mobile app v1.7.3 & prior stores the user login credentials in logcat file when user create or register the account on the Mobile app. A ..

Support the originator by clicking the read the rest link below.