Making Sense of Security

Securing your Digital World.

Making Sense of Security

DHS Warns of Increasing Emotet Risk

Enterprise Vulnerabilities
From DHS/US-CERT’s National Vulnerability Database CVE-2020-7964
PUBLISHED: 2020-01-24

An issue was discovered in Mirumee Saleor 2.x before 2.9.1. Incorrect access control in the checkoutCustomerAttach mutations allows attackers to attach their checkouts to any user ID and consequently leak user data (e.g., name, address, and previous orders of any other customer).

CVE-2020-5224
PUBLISHED: 2020-01-24

In Django User Sessions (django-user-sessions) before 1.7.1, the views provided allow users to terminate specific sessions. The session key is used to identify sessions, and thus included in the rendered HTML. In itself this is not a problem. However if the website has an XSS vulnerability, the sess…

CVE-2020-7052
PUBLISHED: 2020-01-24

CODESYS Control V3, Gateway V3, and HMI V3 before 3.5.15.30 allow uncontrolled memory allocation which can result in a remote denial of service condition.

CVE-2014-4172
PUBLISHED: 2020-01-24

A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the (1) service paramet…

CVE-2013-1597
PUBLISHED: 2020-01-24

A Directory Traversal vulnerability exists in Vivotek PT7135 IP Cameras 0300a and 0400a via a specially crafted GET request, which could let a malicious user obtain user credentials.

View Original Source Article HERE