CVE-2020-7370

Danyil Vasilenko Bolt Browser Address Bar Spooofing

User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of Danyil Vasilenko's Bolt Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects the Bolt Browser version 1.4 and prior versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Boltbrowser

Products

Bolt Browser

CVE-2020-7369

Yandex Browser Address Bar Spooofing

User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of the Yandex Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects the Yandex Browser version 20.8.3 and prior versions, and was fixed in version 20.8.4 released October 1, 2020.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Yandex

Products

Yandex Browser

CVE-2020-7364

UCWeb UC Browser Address Bar Spooofing

User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of UCWeb's UC Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects UCWeb's UC Browser version 13.0.8 and prior versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ucweb

Products

Uc Browser

CVE-2020-7363

UCWeb UC Browser Address Bar Spooofing

User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of UCWeb's UC Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects UCWeb's UC Browser version 13.0.8 and prior versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ucweb

Products

Uc Browser

CVE-2020-7361

ZenTao Pro Command Injection

The EasyCorp ZenTao Pro application suffers from an OS command injection vulnerability in its '/pro/repo-create.html' component. After authenticating to the ZenTao dashboard, attackers may construct and send arbitrary OS commands via the POST parameter 'path', and those commands will run in an elevated SYSTEM context on the underlying Windows operating system.

CVSS 3.1 · 9.6 Critical EPSS 17.2% KEV · Not listed

Vendors

Easycorp

Products

Zentao Pro

CVE-2020-7360

Philips SmartControl DLL Hijacking

An Uncontrolled Search Path Element (CWE-427) vulnerability in SmartControl version 4.3.15 and versions released before April 15, 2020 may allow an authenticated user to escalate privileges by placing a specially crafted DLL file in the search path. This issue was fixed in version 1.0.7, which was released after April 15, 2020. (Note, the version numbering system changed significantly between version 4.3.15 and version 1.0.7.)

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Philips

Products

Smartcontrol

CVE-2020-7358

Code Injection in Rapid7 AppSpider Pro Installer

In AppSpider installer versions prior to 7.2.126, the AppSpider installer calls an executable which can be placed in the appropriate directory by an attacker with access to the local machine. This would prevent the installer from distinguishing between a valid executable called during an installation and any arbitrary code executable using the same file name.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Rapid7

Products

Appspider

CVE-2020-7357

Cayin CMS Command Injection

Cayin CMS suffers from an authenticated OS semi-blind command injection vulnerability using default credentials. This can be exploited to inject and execute arbitrary shell commands as the root user through the 'NTP_Server_IP' HTTP POST parameter in system.cgi page. This issue affects several branches and versions of the CMS application, including CME-SE, CMS-60, CMS-40, CMS-20, and CMS version 8.2, 8.0, and 7.5.

CVSS 3.1 · 9.6 Critical EPSS 32.1% KEV · Not listed

Vendors

Cayintech

Products

Cms Cms-20 Cms-20 Firmware and 8 more

CVE-2020-7356

Cayin xPost SQL Injection

CAYIN xPost suffers from an unauthenticated SQL Injection vulnerability. Input passed via the GET parameter 'wayfinder_seqid' in wayfinder_meeting_input.jsp is not properly sanitized before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code and execute SYSTEM commands.

CVSS 3.1 · 10 Critical EPSS 14.0% KEV · Not listed

Vendors

Cayintech

Products

Xpost

CVE-2020-7355

Rapid7 Metasploit Pro Stored XSS in 'notes' field

Cross-site Scripting (XSS) vulnerability in the 'notes' field of a discovered scan asset in Rapid7 Metasploit Pro allows an attacker with a specially-crafted network service of a scan target store an XSS sequence in the Metasploit Pro console, which will trigger when the operator views the record of that scanned host in the Metasploit Pro interface. This issue affects Rapid7 Metasploit Pro version 4.17.1-20200427 and prior versions, and is fixed in Metasploit Pro version 4.17.1-20200514. See also CVE-2020-7354, which describes a similar issue, but involving the generated 'host' field of a discovered scan asset.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Rapid7

Products

Metasploit

CVE-2020-7354

Rapid7 Metasploit Pro Stored XSS in 'host' field

Cross-site Scripting (XSS) vulnerability in the 'host' field of a discovered scan asset in Rapid7 Metasploit Pro allows an attacker with a specially-crafted network service of a scan target to store an XSS sequence in the Metasploit Pro console, which will trigger when the operator views the record of that scanned host in the Metasploit Pro interface. This issue affects Rapid7 Metasploit Pro version 4.17.1-20200427 and prior versions, and is fixed in Metasploit Pro version 4.17.1-20200514. See also CVE-2020-7355, which describes a similar issue, but involving the generated 'notes' field of a discovered scan asset.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Rapid7

Products

Metasploit

CVE-2020-7352

GOG Galaxy GalaxyClientService Privilege Escalation

The GalaxyClientService component of GOG Galaxy runs with elevated SYSTEM privileges in a Windows environment. Due to the software shipping with embedded, static RSA private key, an attacker with this key material and local user permissions can effectively send any operating system command to the service for execution in this elevated context. The service listens for such commands on a locally-bound network port, localhost:9978. A Metasploit module has been published which exploits this vulnerability. This issue affects the 2.0.x branch of the software (2.0.12 and earlier) as well as the 1.2.x branch (1.2.64 and earlier). A fix was issued for the 2.0.x branch of the affected software.

CVSS 3.1 · 8.4 High EPSS 3.8% KEV · Not listed

Vendors

Gog

Products

Galaxy

CVE-2020-7351

Fonality Trixbox CE Post-Authentication Command Injection

An OS Command Injection vulnerability in the endpoint_devicemap.php component of Fonality Trixbox Community Edition allows an attacker to execute commands on the underlying operating system as the "asterisk" user. Note that Trixbox Community Edition has been unsupported by the vendor since 2012. This issue affects: Fonality Trixbox Community Edition, versions 1.2.0 through 2.8.0.4. Versions 1.0 and 1.1 are unaffected.

CVSS 3.1 · 7.3 High EPSS 64.2% KEV · Not listed

Vendors

Netfortris

Products

Trixbox

CVE-2020-7350

Metasploit Framework Plugin Libnotify Command Injection

Rapid7 Metasploit Framework versions before 5.0.85 suffers from an instance of CWE-78: OS Command Injection, wherein the libnotify plugin accepts untrusted user-supplied data via a remote computer's hostname or service name. An attacker can create a specially-crafted hostname or service name to be imported by Metasploit from a variety of sources and trigger a command injection on the operator's terminal. Note, only the Metasploit Framework and products that expose the plugin system is susceptible to this issue -- notably, this does not include Rapid7 Metasploit Pro. Also note, this vulnerability cannot be triggered through a normal scan operation -- the attacker would have to supply a file that is processed with the db_import command.

CVSS 3.1 · 6.1 Medium EPSS 5.0% KEV · Not listed

Vendors

Rapid7

Products

Metasploit

CVE-2020-7343

Improper Authorization vulnerability in MA

Missing Authorization vulnerability in McAfee Agent (MA) for Windows prior to 5.7.1 allows local users to block McAfee product updates by manipulating a directory used by MA for temporary files. The product would continue to function with out-of-date detection files.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Mcafee

Products

Agent

CVE-2020-7339

Database Security(DBS)-Use of a Broken or Risky Cryptographic Algorithm

Use of a Broken or Risky Cryptographic Algorithm vulnerability in McAfee Database Security Server and Sensor prior to 4.8.0 in the form of a SHA1 signed certificate that would allow an attacker on the same local network to potentially intercept communication between the Server and Sensors.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mcafee

Products

Database Security

CVE-2020-7337

Incorrect Permission Assignment for Critical Resource

Incorrect Permission Assignment for Critical Resource vulnerability in McAfee VirusScan Enterprise (VSE) prior to 8.8 Patch 16 allows local administrators to bypass local security protection through VSE not correctly integrating with Windows Defender Application Control via careful manipulation of the Code Integrity checks.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Mcafee

Products

Virusscan Enterprise

CVE-2020-7336

Network Security Management (NSM) - Cross Site Request Forgery vulnerability

Cross Site Request Forgery vulnerability in McAfee Network Security Management (NSM) prior to 10.1.7.35 and NSM 9.x prior to 9.2.9.55 may allow an attacker to change the configuration of the Network Security Manager via a carefully crafted HTTP request.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Mcafee

Products

Network Security Management

CVE-2020-7335

Privilege Escalation vulnerability in McAfee Total Protection (MTP)

Privilege Escalation vulnerability in Microsoft Windows client McAfee Total Protection (MTP) prior to 16.0.29 allows local users to gain elevated privileges via careful manipulation of a folder by creating a junction link. This exploits a lack of protection through a timing issue and is only exploitable in a small time window.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Mcafee

Products

Total Protection

CVE-2020-7334

Improper privilege assignment vulnerability in the installer component of MACC

Improper privilege assignment vulnerability in the installer McAfee Application and Change Control (MACC) prior to 8.3.2 allows local administrators to change or update the configuration settings via a carefully constructed MSI configured to mimic the genuine installer. This version adds further controls for installation/uninstallation of software.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Mcafee

Products

Application And Change Control