Overview On November 11, 2020 (local time), Adobe released security updates which address multiple vulnerabilities in Adobe Connect and Adobe Reader Mobile. (more…)
Category: Emergency Response
SaltStack Multiple Vulnerabilities (CVE-2020-16846, CVE-2020-17490, CVE-2020-25592) Threat Alert
Overview Recently, SaltStack released a security update to address multiple vulnerabilities (CVE-2020-16846, CVE-2020-17490, CVE-2020-25592). These vulnerabilities can cause authentication bypass and command execution. SaltStack recommends users upgrade as soon as possible. Salt is an open-source IP architecture management solution written in Python. It has been widely used in data centers...
Windows Kernel cng.sys Privilege Escalation 0-day Vulnerability CVE-2020-17087 Threat Alert
Overview Recently, Google Project Zero published an article about the Windows cng.sys privilege escalation vulnerability (CVE-2020-17087). The vulnerability allows attackers without authentication to trick users into running crafted malicious programs to escalate privileges. At present, this vulnerability has been exploited in the wild, and Microsoft has not released patches to...
WebLogic Console HTTP Remote Code Execution Vulnerability (CVE-2020-14882) Protection Solution
Overview The Critical Patch Update (CPU) for October 2020 released by Oracle contains a high-risk WebLogic Consoleremote code execution vulnerability (CVE-2020-14882). The vulnerability can be triggered without authentication and has an extensive impact. Unauthenticated attackers might construct special HTTP GET requests to exploit this vulnerability to execute arbitrary code on...
VMware ESXi Remote Code Execution Vulnerability (CVE-2020-3992) Threat Alert
Vulnerability Description On October 21, 2020, NSFOCUS detected that VMware released a security advisory that fixes a VMware ESXi remote code execution vulnerability (CVE-2020-3992). This vulnerability exists because OpenSLP as used in VMware ESXi has a use-after-free issue. An attacker residing in the management network who has access to port...
WebLogic High-Risk Vulnerabilities (CVE-2020-14841, CVE-2020-14825, CVE-2020-14859) Threat Alert
Overview On October 21, 2020, Beijing time, Oracle released Critical Patch Update (CPU) for October 2020 that fixes 402 vulnerabilities of different risk levels. The WebLogic Server Core component is prone to three severe vulnerabilities with a CVSS base score of 9.8, which are assigned CVE-2020-14841, CVE-2020-14825, and CVE-2020-14859 respectively....
