CVE-2020-11925

The CVE-2020-11925 entry applies to Luvion Grand Elite 3 Connect prior to or through 2020-02-25. The root cause is a shared root credential across all devices, enabling authentication based on a username/password without unique per-device credentials. Documented impact indicates high risk due to ...

Luvion Grand Elite 3 Connect 安全漏洞

Luvion Grand Elite 3 Connect Plus HD baby monitor is a smart monitor from Luvion, Netherlands. It monitors the baby's activity A security vulnerability exists in the Luvion Grand Elite 3 Connect through 2020-02-25, which stems from the device's authentication method being a username and password,...

PT-2021-9431 · Luvion · Luvion Grand Elite 3 Connect

Name of the Vulnerable Software and Affected Versions: Luvion Grand Elite 3 Connect versions through 2020-02-25 Description: An issue was discovered where authentication to the device is based on a username and password, with the root credentials being the same across all devices of this model...

SharpDPAPI - A C# Port Of Some Mimikatz DPAPI Functionality

SharpDPAPI is a C port of some DPAPI functionality from @gentilkiwi's Mimikatz project. I did not come up with this logic, it is simply a port from Mimikatz in order to better understand the process and operationalize it to fit our workflow. The SharpChrome subproject is an adaptation of work fro...

Seatbelt - A C# Project That Performs A Number Of Security Oriented Host-Survey "Safety Checks" Relevant From Both Offensive And Defensive Security Perspectives

Seatbelt is a C project that performs a number of security oriented host-survey "safety checks" relevant from both offensive and defensive security perspectives. @andrewchiles' HostEnum.ps1 script and @tifkin's Get-HostProfile.ps1 provided inspiration for many of the artifacts to collect. @harmj0...

PT-2021-18072 · Synology · Synology Diskstation Manager

Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 6.2.3-25426-3 Description: The issue is related to the improper neutralization of special elements used in an OS command in SYNO.Core.Network.PPPoE, allowing remote authenticated users to...

Rubeus - C# Toolset For Raw Kerberos Interaction And Abuses

Rubeus is a C toolset for raw Kerberos interaction and abuses. It is heavily adapted from Benjamin Delpy's Kekeo project CC BY-NC-SA 4.0 license and Vincent LE TOUX's MakeMeEnterpriseAdmin project GPL v3.0 license. Full credit goes to Benjamin and Vincent for working out the hard components of...

Debian: Security Advisory (DSA-4878-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2020-35521 affecting package libtiff 4.1.0-3

CVE-2020-35521 affecting package libtiff 4.1.0-3. A patched version of the package is available...

[SECURITY] Fedora 34 Update: webkit2gtk3-2.32.0-1.fc34

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. This package contains WebKit2 based WebKitGTK for GTK 3...

Fedora: Security Advisory for webkit2gtk3 (FEDORA-2021-8070916f7a)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] [DSA 4878-1] pygments security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4878-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff March 27, 2021 https://www.debian.org/security/faq -...

Oracle Linux 8 : python2 (ELSA-2021-9128)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-9128 advisory. python2 2.7.17-2.0.2 - Fix buffer overflow in PyCArgrepr Orabug: 32551171CVE-2021-3177 Tenable has extracted the preceding description block directly from the...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : QEMU regression (USN-4467-3)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4467-3 advisory. USN-4467-1 fixed vulnerabilities in QEMU. The fix for CVE-2020-13754 introduced a regression in certain environments. This update fixes th...

Oracle Linux 8 : python36 (ELSA-2021-9129)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-9129 advisory. python36 3.6.8-2.0.1 - Rebuild with python containing fix for Orabug: 32551171CVE-2021-3177 Tenable has extracted the preceding description block directly from...

Updated glibc packages fixes security vulnerabilities

Updated glibc packages fix a security vulnerabilities: The iconv function in the GNU C Library aka glibc or libc6 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance the input state, which could lead t...

[SECURITY] Fedora 34 Update: gnome-calendar-40~rc-1.fc34

Calendar is a simple and beautiful calendar application designed to fit GNOME 3. Features: Week, month and year views Basic editing of events Evolution Data Server integration Search support...

Django Channels leakage of session identifiers using legacy AsgiHandler

Django Channels 3.x before 3.0.3 allows remote attackers to obtain sensitive information from a different request scope. The legacy channels.http.AsgiHandler class, used for handling HTTP type requests in an ASGI environment prior to Django 3.0, did not correctly separate request scopes in Channe...

Session fixation

A vulnerability was found in the Quay web application. Sessions in the Quay web application never expire. An attacker, able to gain access to a session, could use it to control or delete a user's container repository. Red Hat Quay 2 and 3 are vulnerable to this issue...

CVE-2021-28667

StackStorm before 3.4.1, in some situations, has an infinite loop that consumes all available memory and disk space. This can occur if Python 3.x is used, the locale is not utf-8, and there is an attempt to log Unicode data from an action or rule name...