January 2021

CVE-2021-23329

The package nested-object-assign before 1.0.4 are vulnerable to Prototype Pollution via the default function, as demonstrated by running the PoC below.
Source: NIST
CVE-2021-23329

CVE-2020-14418

A TOCTOU vulnerability exists in madCodeHook before 2020-07-16 that allows local attackers to elevate their privileges to SYSTEM. This occurs because path redirection can occur via vectors involving directory junctions.
Source: NIST
CVE-2020-14418

CVE-2020-17380

A heap-based buffer overflow was found in QEMU through 5.0.0 in the SDHCI device emulation support. It could occur while doing a multi block SDMA transfer via the sdhci_sdma_transfer_multi_blocks() routine in hw/sd/sdhci.c. A guest user or process could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition, or potentially execute arbitrary code with privileges of the QEMU process on the host.
Source: NIST
CVE-2020-17380

CVE-2020-15568

TerraMaster TOS before 4.1.29 has Invalid Parameter Checking that leads to code injection as root. This is a dynamic class method invocation vulnerability in include/exportUser.php, in which an attacker can trigger a call to the exec method with (for example) OS commands in the opt parameter.
Source: NIST
CVE-2020-15568

CVE-2021-21254

CKEditor 5 is an open source rich text editor framework with a modular architecture. The CKEditor 5 Markdown plugin (@ckeditor/ckeditor5-markdown-gfm) before version 25.0.0 has a regex denial of service (ReDoS) vulnerability. The vulnerability allowed to abuse link recognition regular expression, which could cause a significant performance drop resulting in browser tab freeze. It affects all users using CKEditor 5 Markdown plugin at version <= 24.0.0. The problem has been recognized and patched. The fix will be available in version 25.0.0.
Source: NIST
CVE-2021-21254

Cyber-Cop Charged with Forgery and Bigamy

Cyber-Cop Charged with Forgery and Bigamy

A retired Nevada cop who headed up a Cyber Crimes Unit has been charged with burglary, bigamy, and forgery. 



Former Washoe County Sheriff’s deputy Dennis Carry was arrested on Tuesday on seven different felony counts following a two-year investigation by the Reno Police Department. 



The 46-year-old was previously in charge of the Cyber Crimes Unit at the Washoe County Sheriff’s Office before being placed on administrative leave in March 2019. During the course of the investigation by Reno police, Carry formally retired from WCSO.



Court documents show that Carry was already married when he walked down the aisle with Carla Baldwin, a federal magistrate judge for the United States District Court for the District of Nevada. 



Carry wed his first wife, Wendy, in South Lake Tahoe in 1996. Then, in late May 2018, Carry tied the knot with Baldwin in California despite not having obtained a divorce from his first wife.



In March 2019, both of the former deputy’s wives sought to sever their matrimonial bonds with Carry. Wendy filed for divorce about two weeks after Baldwin formally began annulment proceedings.



In July 2019, former Washoe County family court judge David Humke said that RPD investigators had spoken to him concerning allegations that Carry had broken into his office and hacked into his computer. The RPD were looking into claims that Carry had illegally accessed Humke’s computer in order to create fake court documents he could use to convince Baldwin that he was no longer married to his first wife.



The allegedly forged documents, dated May 9, 2018, divided up Wendy and Dennis Carry’s mortgage debt while assigning the bulk of the couple’s credit card debt to Dennis Carry. 



No mention is made in the allegedly fake paperwork of the 2018 Tesla or the $608k home that Carla Baldwin Carry and Dennis Carry bought months before Wendy Carry filed for divorce. Wendy Carry’s attorneys are claiming for both these purchases since they were made while Dennis Carry was still married to her.



WCSO spokesperson Bob Harmon said in July 2019 that he didn’t know if the department was aware that their former deputy was simultaneously going through two separate marriage-ending proceedings. 


Source: Infosecurity
Cyber-Cop Charged with Forgery and Bigamy

CVE-2021-25646

Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments, and is disabled by default. However, in Druid 0.20.0 and earlier, it is possible for an authenticated user to send a specially-crafted request that forces Druid to run user-provided JavaScript code for that request, regardless of server configuration. This can be leveraged to execute code on the target machine with the privileges of the Druid server process.
Source: NIST
CVE-2021-25646

CVE-2020-29557

An issue was discovered on D-Link DIR-825 R1 devices through 3.0.1 before 2020-11-20. A buffer overflow in the web interface allows attackers to achieve pre-authentication remote code execution.
Source: NIST
CVE-2020-29557