CVE-2020-7842

Improper Input validation vulnerability exists in Netis Korea D'live AP which could cause arbitrary command injection and execution when the time setting using ntpServerlp1 parameter for the users. This affects D'live set-top box APWF2429TB v1.1.10...

Input validation

Improper Input validation vulnerability exists in Netis Korea D'live AP which could cause arbitrary command injection and execution when the time setting using ntpServerlp1 parameter for the users. This affects D'live set-top box APWF2429TB v1.1.10...

CVE-2020-7842 D'live AP command injection vulnerability

Improper Input validation vulnerability exists in Netis Korea D'live AP which could cause arbitrary command injection and execution when the time setting using ntpServerlp1 parameter for the users. This affects D'live set-top box APWF2429TB v1.1.10...

GaussDB Kernel: Enabling the Auditing of Database Login and Logout

The parameter auditloginlogout specifies whether to audit user login and logout. After this parameter is set to on, users logged in to the database and the time when they logged out are traced. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced...

GaussDB Kernel: Setting database for host Entries in the pg_hba.conf File

If database is set to all for host entries, connected users are allowed to access any database. You are advised to set database for host entries to the database to be Connected. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are...

GaussDB Kernel: Setting Source IP Address for host Entries in the pg_hba.conf File

If source IP address is set to all or 0.0.0.0/0 for host entries, any IP addresses can access the database. You are advised to set source IP address for host entries to the IP address that needs to connect to the database. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be...

Kerberos authentication and ticket renewal issues on Windows Server 2012 R2 - Out-of-band

Kerberos authentication and ticket renewal issues on Windows Server 2012 R2 - Out-of-band Applies to: Windows Server 2012 R2 Windows Server 2012 R2 Server Core installation NEW 11/17/20 For information about Windows update terminology, see the article about the types of Windows updates and the...

CVE-2020-8897: Use of a Broken or Risky Cryptographic Algorithm

A weak robustness vulnerability exists in the AWS Encryption SDKs for Java, Python, C and Javalcript prior to versions 2.0.0. Due to the non-committing property of AES-GCM and other AEAD ciphers such as AES-GCM-SIV or XChaCha20Poly1305 used by the SDKs to encrypt messages, an attacker can craft a...

CVE-2020-8352

In some Lenovo Desktop models, the Configuration Change Detection BIOS setting failed to detect SATA configuration changes...

CVE-2020-13927

The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at...

CVE-2020-13927

The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at...

systemd security, bug fix, and enhancement update

239-40.0.1 - backport upstream pstore tmpfiles patch Orabug: 31420486 - udev rules: fix memory hot add and remove Orabug: 31310273 - fix to enable systemd-pstore.service Orabug: 30951066 - journal: change support URL shown in the catalog entries Orabug: 30853009 - fix to generate...

CVE-2020-13927

The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at...

Rapid7 Announces Improvements to Goals and SLAs in InsightVM

We know that proving the efficacy of your vulnerability management program is no easy task. But with the Goals and SLAs feature in InsightVM, you can ensure you’re making and tracking progress toward your goals and service-level agreements SLAs at an appropriate place, as well as maintaining...

Lax Security Exposes Smart-Irrigation Systems to Attack Across the Globe

More than 100 smart-irrigation systems deployed across the globe were installed without changing the factory’s default, passwordless setting, leaving them vulnerable to malicious attacks, according to recent findings from Israeli security research firm Security Joes. The researchers immediately...

'Among Us' Mobile Game Under Siege by Attackers

The meteoric rise of the game Among Us appears to be outpacing its developer’s ability to keep up with malicious actors. On Sunday night, a specific ongoing attack forced InnerSloth, the company behind the game, to hastily roll out an update designed to kick bad actors off the game’s servers —...

CVE-2020-27603

BigBlueButton before 2.2.27 has an unsafe JODConverter setting in which LibreOffice document conversions can access external files...

Improper access control

BigBlueButton before 2.2.27 has an unsafe JODConverter setting in which LibreOffice document conversions can access external files...

CVE-2020-27603

BigBlueButton before 2.2.27 has an unsafe JODConverter setting in which LibreOffice document conversions can access external files...

CVE-2020-27197

TAXII libtaxii through 1.1.117, as used in EclecticIQ OpenTAXII through 0.2.0 and other products, allows SSRF via an initial http:// substring to the parse method, even when the nonetwork setting is used for the XML parser. NOTE: the vendor points out that the parse method "wraps the lxml library...