{"vulnerability": "CVE-2020-2858", "sightings": [{"uuid": "5b90e4cb-1179-4f67-8d8c-b7b11eb06e15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-28589", "type": "seen", "source": "https://t.me/cibsecurity/27152", "content": "\u203c CVE-2020-28589 \u203c\n\nAn improper array index validation vulnerability exists in the LoadObj functionality of tinyobjloader v2.0-rc1 and tinyobjloader development commit 79d4421. A specially crafted file could lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-11T16:38:43.000000Z"}, {"uuid": "5f87e08f-7f45-4a39-ad95-f70ae005ecd6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-28587", "type": "seen", "source": "https://t.me/cibsecurity/24025", "content": "\u203c CVE-2020-28587 \u203c\n\nA specially crafted document can cause the document parser to copy data from a particular record type into a static-sized buffer within an object that is smaller than the size used for the copy, which will cause a heap-based buffer overflow. An attacker can entice the victim to open a document to trigger this vulnerability. This affects SoftMaker Software GmbH SoftMaker Office PlanMaker 2021 (Revision 1014).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-02-23T22:35:16.000000Z"}, {"uuid": "3f7b48b8-9aa4-418a-8762-5c54843630e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-28581", "type": "seen", "source": "https://t.me/cibsecurity/17389", "content": "\u203c CVE-2020-28581 \u203c\n\nA command injection vulnerability in ModifyVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send specially crafted HTTP messages and execute arbitrary OS commands with elevated privileges.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-09T06:25:11.000000Z"}, {"uuid": "666a6822-2b7e-4975-8dd0-afc659628d32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-28588", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/3236", "content": "#Threat_Research\n1. An information disclosure vulnerability exists in the\n/proc/pid/syscall functionality of Linux Kernel 5.1\nStable and 5.4.66 (PoC for CVE-2020-28588)\nhttps://talosintelligence.com/vulnerability_reports/TALOS-2020-1211\n2. Examining JavaScript Inter-Process Communication in Firefox\nhttps://blog.mozilla.org/attack-and-defense/2021/04/27/examining-javascript-inter-process-communication-in-firefox\n3. Abusing Replication:\nStealing AD FS Secrets Over the Network\nhttps://www.fireeye.com/blog/threat-research/2021/04/abusing-replication-stealing-adfs-secrets-over-the-network.html", "creation_timestamp": "2021-05-05T04:21:55.000000Z"}, {"uuid": "08c06976-d6bb-4665-a4ae-ff8308cea895", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-28582", "type": "seen", "source": "https://t.me/cibsecurity/17004", "content": "\u203c CVE-2020-28582 \u203c\n\nAn improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated user to connect to the product server and reveal number of managed agents.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-01T22:54:15.000000Z"}, {"uuid": "9f507fd8-8ff4-4058-b09c-fbd7ed52509d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-28583", "type": "seen", "source": "https://t.me/cibsecurity/17003", "content": "\u203c CVE-2020-28583 \u203c\n\nAn improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated user to connect to the product server and reveal version, build and patch information.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-01T22:54:14.000000Z"}, {"uuid": "51821bba-c0f7-47fa-9188-2ec5ac1cc59a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-28581", "type": "seen", "source": "https://t.me/cibsecurity/16555", "content": "\u203c CVE-2020-28581 \u203c\n\nA command injection vulnerability in ModifyVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send specially crafted HTTP messages and execute arbitrary OS commands with elevated privileges.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-11-18T22:40:48.000000Z"}, {"uuid": "2886dead-13f6-4763-b506-bd5525c56cf6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-28580", "type": "seen", "source": "https://t.me/cibsecurity/16542", "content": "\u203c CVE-2020-28580 \u203c\n\nA command injection vulnerability in AddVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send specially crafted HTTP messages and execute arbitrary OS commands with elevated privileges.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-11-18T22:40:33.000000Z"}]}