Huawei EulerOS: Security Advisory for krb5 (EulerOS-SA-2021-1487)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for krb5 (EulerOS-SA-2021-1403)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for krb5 (EulerOS-SA-2021-1414)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 33 Update: screen-4.8.0-5.fc33

The screen utility allows you to have multiple logins on just one terminal. Screen is useful for users who telnet into a machine or are connected via a dumb terminal, but want to use more than just one login. Install the screen package if you need a screen manager that can support multiple logins...

EulerOS Virtualization for ARM 64 3.0.6.0 : krb5 (EulerOS-SA-2021-1544)

According to the version of the krb5 packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - MIT Kerberos 5 aka krb5 before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos...

[SECURITY] Fedora 32 Update: screen-4.8.0-5.fc32

The screen utility allows you to have multiple logins on just one terminal. Screen is useful for users who telnet into a machine or are connected via a dumb terminal, but want to use more than just one login. Install the screen package if you need a screen manager that can support multiple logins...

VMware Carbon Black Named to the 2021 CRN Security 100 List

We are proud to announce that CRN®, a brand of The Channel Company, has named VMware Carbon Black to its annual Security 100 list. The Security 100 list features leading IT channel security vendors and is compiled by a panel of CRN editors, recognizing channel-focused security vendors across five...

Huawei EulerOS: Security Advisory for samba (EulerOS-SA-2021-1357)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2020-35592

Pi-hole 5.0, 5.1, and 5.1.1 allows XSS via the Options header to the admin/ URI. A remote user is able to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and achieve a Reflected Cross-Site Scripting attack against other users and steal the session cookie...

Vulnerability Spotlight: Two vulnerabilities in Advantech WebAccess/SCADA

Yuri Kramarz of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw. Cisco Talos recently discovered two vulnerabilities in the Advantech WebAccess/SCADA software package. An adversary could exploit each of these vulnerabilities to disclose sensitive information and elevate their...

Security fix for the ALT Linux 9 package dotnet-aspnetcore-5.0 version 5.0.3-alt1

5.0.3-alt1 built Feb. 18, 2021 Vitaly Lipatov in task 266508 Feb. 17, 2021 Vitaly Lipatov - ASP.NET 5.0.3 - CVE-2021-1721: .NET Core Denial of Service Vulnerability - CVE-2021-24112: .NET 5 and .NET Core Remote Code Execution Vulnerability...

Apple Security Update: watchOS 7.3.1

Apple recommends to install security update watchOS 7.3.1 on devices Apple Watch Series 5 and Apple Watch SE...

Apple Security Update: watchOS 7.3.1

Apple recommends to install security update watchOS 7.3.1 on devices Apple Watch Series 5 and Apple Watch SE...

Squid 5.x < 5.0.3 Multiple Vulnerabilities

According to its self-reported version number, the version of Squid installed on the remote host is 5.x 5.0.3 or prior to 4.12. It is, therefore, affected by multiple vulnerabilities: - Due to an incorrect synchronization, Squid is vulnerable to a denial of service attack when processing objects ...

Squid 5.x < 5.0.4 Multiple Vulnerabilities

According to its self-reported version number, the version of Squid installed on the remote host is 5.x 5.0.4 or prior to 4.13. It is, therefore, affected by multiple vulnerabilities: - Due to incorrect data validation Squid is vulnerable to HTTP request splitting and HTTP request smuggling attac...

Threat Roundup for January 29 to February 5

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Jan. 29 and Feb. 5. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threatsx we've observed by highlighting key behavioral characteristics...

[SECURITY] [DLA 2544-1] openldap security update

----------------------------------------------------------------------- Debian LTS Advisory DLA-2544-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta February 03, 2021 https://wiki.debian.org/LTS -...

Apache ActiveMQ 5.x < 5.15.14 / 5.16.x < 5.16.1 Multiple Vulnerabilities

The version of Apache ActiveMQ running on the remote host is 5.x prior to 5.15.14 or 5.16.x prior to 5.16.1. It is, therefore, affected by multiple vulnerabilities including the following: - An authentication bypass vulnerability. The optional ActiveMQ LDAP login module can be configured to use...

Design/Logic Flaw

In the rcp client in MIT krb5-appl through 1.0.3, malicious servers could bypass intended access restrictions via the filename of . or an empty filename, similar to CVE-2018-20685 and CVE-2019-7282. The impact is modifying the permissions of the target directory on the client side. NOTE: MIT...

CVE-2019-25018

In the rcp client in MIT krb5-appl through 1.0.3, malicious servers could bypass intended access restrictions via the filename of . or an empty filename, similar to CVE-2018-20685 and CVE-2019-7282. The impact is modifying the permissions of the target directory on the client side. NOTE: MIT...