CVE-2020-3235

Improper Input Validation (CWE-20)

Published: Jun 3, 2020 / Updated: 38mo ago

Supported versions that are affected are 16.1, 16.2, 17.7-17.12, 18.8 and 19.12.\n Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier. Supported versions that are affected are 16.1, 16.2, 17.7-17.12, 18.8 and 19.12.\n Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to\n compromise Primavera Unifier.

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. (CVE-2020-9488) Impact There is no impact; F5 products are not affected by this...

A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become...

[3.0.0-7.0.1] - Backport jQuery CVE-2020-11023 fixes from jQuery v3.5.0 to bundled v1.10.2 [Orabug:...

A freshly discovered variant of the Golang crypto-worm was recently spotted dropping Monero-mining malware on victim machines; in a switch-up of tactics, the payload binaries are capable of speeding up the mining process by 15 percent, researchers said. According to research from Uptycs, the worm scans for and exploits various known vulnerabilities in popular Unix and Linux-based web servers, including CVE-2020-14882 in the Oracle WebLogic Server, and CVE-2017-11610, a remote code-execution (RCE) bug which affects XML-RPC servers. XML-RPC is an interface provided by WordPress. “CVE-2020-14882 [is a] classic path-traversal vulnerability used for exploiting vulnerable web logic servers,” according to Uptycs. “It seemed like the attacker tried to bypass the authorization mechanism by changing the URL and performing a path traversal using double encoding on /console/images.” The exploit for CVE-2017-11610 meanwhile contains an encoded payload in one of the parameters, researchers added. Golang Cryptomining Attack Kill Chain After initial exploitation, the attack begins with a shell script which downloads the worm using the curl utility, researchers noted, adding that the script uses several defense-evasion techniques like firewall altering and disabling monitoring agents. That initial script then downloads the first-stage worm sample, which was compiled in Golang (hence its name) and UPX-packed, the report noted. The worm uses the go-bindata package to embed off-the-shelf...