9626 matches found
EvilQuest Mac Ransomware Has Keylogger, Crypto Wallet-Stealing Abilities
A rare new ransomware strain targeting macOS users has been discovered, called EvilQuest. Researchers say the ransomware is being distributed via various versions of pirated software. EvilQuest, first discovered by security researcher Dinesh Devadoss, goes beyond the normal encryption capabilitie...
CVE-2020-4452
IBM API Connect V2018.4.1.0 through 2018.4.1.11 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 181324...
CVE-2020-10769
A buffer over-read flaw was found in RH kernel versions before 5.0 in cryptoauthencextractkeys in crypto/authenc.c in the IPsec Cryptographic algorithm's module, authenc. When a payload longer than 4 bytes, and is not following 4-byte alignment boundary guidelines, it causes a buffer over-read...
CVE-2020-10769
A buffer over-read flaw was found in RH kernel versions before 5.0 in cryptoauthencextractkeys in crypto/authenc.c in the IPsec Cryptographic algorithm's module, authenc. When a payload longer than 4 bytes, and is not following 4-byte alignment boundary guidelines, it causes a buffer over-read...
Popular Techniques Used by Cybercriminals Amid COVID-19
Editor's Note: Gary Stevens, a technology writer, is posting as a guest author to carbonblack.com. Cybercriminals constantly leverage fear and confusion by launching cyberattacks during major world events. Such attacks are mostly carried out with social engineering campaigns using malicious email...
Misconfigured Kubeflow workloads are a security risk
Azure Security Center ASC monitors and defends thousands of Kubernetes clusters running on top of AKS. Azure Security Center regularly searches for and research for new attack vectors against Kubernetes workloads. We recently published a blog post about a large scale campaign against Kubernetes...
freerdp: Out-of-bounds write in crypto_rsa_common in libfreerdp/crypto/crypto.c
An issue was found in freerdp's libfreerdp/crypto/crypto.c, in versions before 2.1.1, where buffer access with an incorrect length value, leads to an out-of-bounds write. This flaw allows a remote, unauthenticated, attacker running an RDP server, or a local attacker, using a specially crafted...
Oracle Linux 6 : freerdp (ELSA-2020-2406)
The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-2406 advisory. 1.0.2-7 - CVE-2020-13398: Fix out-of-bounds write in crypto.c 1841980 Tenable has extracted the preceding description block directly from the Oracle Linux...
RHEL 6 : freerdp (RHSA-2020:2406)
The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2406 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to RDP server...
freerdp: Out-of-bounds write in crypto_rsa_common in libfreerdp/crypto/crypto.c
An issue was found in freerdp's libfreerdp/crypto/crypto.c, in versions before 2.1.1, where buffer access with an incorrect length value, leads to an out-of-bounds write. This flaw allows a remote, unauthenticated, attacker running an RDP server, or a local attacker, using a specially crafted...
CVE-2020-3220
A vulnerability in the hardware crypto driver of Cisco IOS XE Software for Cisco 4300 Series Integrated Services Routers and Cisco Catalyst 9800-L Wireless Controllers could allow an unauthenticated, remote attacker to disconnect legitimate IPsec VPN sessions to an affected device. The...
Design/Logic Flaw
A vulnerability in the hardware crypto driver of Cisco IOS XE Software for Cisco 4300 Series Integrated Services Routers and Cisco Catalyst 9800-L Wireless Controllers could allow an unauthenticated, remote attacker to disconnect legitimate IPsec VPN sessions to an affected device. The...
CVE-2020-3220
The CVE-2020-3220 issue affects Cisco IOS XE Software on Cisco 4300 Series ISRs and Cisco Catalyst 9800-L Wireless Controllers, where the hardware crypto driver fails to properly verify ESP packet authenticity. This can allow an unauthenticated, remote attacker to perform a man-in-the-middle tamp...
Cisco IOS XE Software IPsec VPN Denial of Service Vulnerability
A vulnerability in the hardware crypto driver of Cisco IOS XE Software for Cisco 4300 Series Integrated Services Routers and Cisco Catalyst 9800-L Wireless Controllers could allow an unauthenticated, remote attacker to disconnect legitimate IPsec VPN sessions to an affected device. The...
RHEL 8 : openvswitch2.11 (RHSA-2020:2297)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2297 advisory. Open vSwitch provides standard network bridging functions and support for the OpenFlow protocol for remote per-flow control of traffic...
Security Bulletin: IBM Spectrum Scale GUI is affected by weak crypto algorithm (CVE-2020-4349)
Summary A security vulnerability has been identified in all levels of IBM Spectrum Scale GUI. A fix for this vulnerability is available. Vulnerability Details CVEID: CVE-2020-4349 DESCRIPTION: IBM Spectrum Scale uses weaker than expected cryptographic algorithms that could allow an attacker to...
dpdk: librte_vhost Missing inputs validation in Vhost-crypto
A vulnerability was found in DPDK versions 18.11 and above. The vhost-crypto library code is missing validations for user-supplied values, potentially allowing an information leak through an out-of-bounds memory read...
dpdk: librte_vhost Missing inputs validation in Vhost-crypto
A vulnerability was found in DPDK versions 18.11 and above. The vhost-crypto library code is missing validations for user-supplied values, potentially allowing an information leak through an out-of-bounds memory read...
FreeRDP Buffer Overflow Vulnerability (CNVD-2020-31441)
FreeRDP is an open source implementation of the Remote Desktop Protocol RDP from the FreeRDP team. A buffer overflow vulnerability exists in the libfreerdp/crypto/crypto.c file, cryptorsacommon, in versions of FreeRDP prior to 2.1.1. The vulnerability stems from a network system or product...