SUSE SLED12: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2021:3748-1)

The remote SUSE Linux SLED12 / SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3748-1 advisory. The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes. The following security bugs...

CVE-2021-43975

An out-of-bounds write flaw was found in the Linux kernel’s Aquantia AQtion Ethernet card Atlantic driver in the way the ethernet card provides malicious input to the driver. This flaw allows a local user to emulate the networking device and crash the system. The highest threat from this...

OPENSUSE-SU-2021:1489-1 Security update for opera

This update for opera fixes the following issues: Update to version 81.0.4196.31: - DNA-95733 Implement the “Manage” menu in card details view - DNA-95736 Update UI for paused card - DNA-95791 Crash at base::operator - DNA-95794 Sometimes the sidebar UI fails to load - DNA-95812 Retrieve cards in...

OPENSUSE-SU-2021:1488-1 Security update for opera

This update for opera fixes the following issues: Opera was updated to version 81.0.4196.31 - DNA-95733 Implement the “Manage” menu in card details view - DNA-95736 Update UI for paused card - DNA-95791 Crash at base::operator - DNA-95794 Sometimes the sidebar UI fails to load - DNA-95812 Retriev...

Talos’ tips for staying safe while shopping online this holiday season

By Jon Munshaw. Attackers will resort to all tactics to trick users into downloading malware, handing over credit card data or completing compromising their machine. No topic is off-limits, and threat actors have resorted to using everything from PlayStation 5 sales, to COVID-19 cures... This is...

SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2021:3675-1)

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3675-1 advisory. - CVE-2021-3542: Fixed heap buffer overflow in firedtv driver bsc1186063. - CVE-2021-3655: Fixed a missing size validations on inbound...

Someone Snuck a Card Skimmer Into Costco to Nab Shopper Data

Plus: A Robinhood breach, NSO Group spyware, and more of the week's top security news...

Weak Password Vulnerability in Golden Dragon Card Water Control Management System

Harbin Xinzhongxin Electronics Co., Ltd. is a leading provider of campus card system solutions in China. A weak password vulnerability exists in the Golden Dragon Card Water Control Management System, which can be exploited by attackers to obtain sensitive information...

Costco Confirms: A Data Skimmer’s Been Ripping Off Customers

Costco has discovered a payment card skimming device at one of its retail stores and has sent out notification letters informing customers that their card data may have been ripped off if they shopped there recently. Some customers have been aware for weeks that something was fishy and have been...

Updated kernel-linus packages fix security vulnerabilities

This kernel-linus update is based on upstream 5.10.78 and fixes at least the following security issues: A use-after-free vulnerability in the NFC stack can lead to a threat to confidentiality, integrity, and system availability CVE-2021-3760. A flaw in the SCTP stack where a blind attacker may be...

CentOS 8 : kernel (CESA-2021:4356)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4356 advisory. - kernel: Intel graphics card information leak. CVE-2019-14615 - kernel: out-of-bounds reads in pinctrl subsystem. CVE-2020-0427 - kernel: Improper inp...

Mozilla Firefox Security Advisory (MFSA2014-33) - Deprecated

This host is missing a security update for Mozilla Firefox. This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Huawei HarmonyOS 安全漏洞

Huawei HarmonyOS is an operating system from Huawei of China. It provides a microkernel-based, fully distributed operating system. The Huawei HarmonyOS SIM dual card management component is vulnerable to sensitive information disclosure. An attacker could exploit the vulnerability to compromise...

Huawei HarmonyOS 安全漏洞

Huawei HarmonyOS is an operating system from Huawei China. The Huawei HarmonyOS HAL card component is vulnerable to unauthorized access, which could be exploited by attackers to compromise confidentiality...

Magecart Credit Card Skimmer Avoids VMs to Fly Under the Radar

A new Magecart threat actor is stealing people’s payment card info from their browsers using a digital skimmer that uses a unique form of evasion to bypass virtual machines VM so it targets only actual victims and not security researchers. The Malwarebytes team discovered the new campaign, which...

CVE-2020-27820

A vulnerability was found in Linux kernel, where a use-after-frees in nouveau's postclose handler could happen if removing device that is not common to remove video card physically without power-off, but same happens if "unbind" the driver...

UBUNTU-CVE-2020-27820

A vulnerability was found in Linux kernel, where a use-after-frees in nouveau's postclose handler could happen if removing device that is not common to remove video card physically without power-off, but same happens if "unbind" the driver...

OracleVM 3.4 : kernel-uek (OVMSA-2021-0036)

The remote OracleVM system is missing necessary patches to address security updates: - Linux Linux kernel version at least v4.8 onwards, probably well before contains a Insufficient input validation vulnerability in bnx2x network card driver that can result in DoS: Network card firmware assertion...

SmartStoreNET - Malicious Message leading to E-Commerce Takeover

SmartStoreNET is the leading open-source e-commerce platform for .NET, which makes it suitable for companies running Windows Server. Next to the operation of an online business, it offers advanced features, such as CRM tools, a blog and a forum. As a result, a SmartStoreNET instance handles highl...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2021-9534)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9534 advisory. - Bluetooth: hciuart: check for missing tty operations Vladis Dronov Orabug: 30244627 CVE-2019-10207 CVE-2019-10207 - Bluetooth: hciuart: Add basic...