CVE-2020-3564

CVE-2020-3564 affects Cisco ASA/FTD FTP inspection engine. Root cause: ineffective flow tracking of FTP traffic allows an unauthenticated, remote attacker to bypass FTP inspection and complete FTP connections. Affected products include Cisco ASA Software and Cisco FTD Software. In practice, explo...

CVE-2020-3564 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software FTP Inspection Bypass Vulnerability

A vulnerability in the FTP inspection engine of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass FTP inspection. The vulnerability is due to ineffective flow tracking of FTP traffic. An attacke...

CVE-2020-3564 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software FTP Inspection Bypass Vulnerability

A vulnerability in the FTP inspection engine of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass FTP inspection. The vulnerability is due to ineffective flow tracking of FTP traffic. An attacke...

Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software SIP Denial of Service Vulnerability

Update from October 22nd, 2020: Cisco has become aware of a new Cisco Adaptive Security Appliance vulnerability that could affect the fixed releases recommended for code trains 9.13 and 9.14 in the Fixed Software "fs" section of this advisory. See the Cisco Adaptive Security Appliance Software...

Cisco Firepower 2100 Series SSL/TLS Inspection Denial of Service Vulnerability

A vulnerability in the SSL/TLS inspection of Cisco Firepower Threat Defense FTD Software for Cisco Firepower 2100 Series firewalls could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to improper input validatio...

Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software FTP Inspection Bypass Vulnerability

Update from October 22nd, 2020: Cisco has become aware of a new Cisco Adaptive Security Appliance vulnerability that could affect the fixed releases recommended for code trains 9.13 and 9.14 in the Fixed Software "fs" section of this advisory. See the Cisco Adaptive Security Appliance Software...

HUAWEI Taurus-AN00B Information Disclosure Vulnerability

Huawei Mate 305G Taurus-AN00B is the official firmware for Huawei Mate 305G. A security vulnerability exists in HUAWEI Taurus-AN00B. The vulnerability stems from the device's failure to adequately examine the contents of the log output in a particular scenario, which allows an attacker to obtain...

What's New in Web Security

With Akamai's web security portfolio, the top focus this October is on the web application firewall WAF, with exciting new capabilities: API Discovery and Adaptive Security Profiles. Along with the rest of the industry, Akamai has observed a long-term shift in the applications that we're...

API Discovery and Profiling -- Visibility to Protection

APIs have become a dominant mechanism in the modern web, allowing organizations to create powerful web and mobile experiences, while exposing back-end data and logic to create new and innovative offerings. Protecting internet-facing APIs -- an emerging practice over the past few years -- is the...

[SECURITY] Fedora 33 Update: skopeo-1.2.0-3.fc33

Command line utility to inspect images and repositories directly on Docker registries without the need to pull them...

[SECURITY] Fedora 33 Update: seamonkey-2.53.4-1.fc33

SeaMonkey is an all-in-one Internet application suite previously made popular by Netscape and Mozilla. It includes an Internet browser, advanced e-mail, newsgroup and feed client, a calendar, IRC client, HTML editor and a tool to inspect the DOM for web pages. It is derived from the application...

SNIcat - Server Name Indication Concatenator

SNIcat is a proof of concept tool that performs data exfiltration, utilizing a covert channel method via. Server Name Indication , a TLS Client Hello Extension. The tool consists of an agent which resides on the compromised internal host, and a Command &Control Server which controls the agent and...

Debian: Security Advisory (DLA-2354-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openapi-python-client Arbitrary Code Generation vulnerability

Impact Clients generated with a maliciously crafted OpenAPI Document can generate arbitrary Python code. Subsequent execution of this malicious client is arbitrary code execution. Giving this a CVSS of 8.0 high with CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:P/RL:U/RC:C . Patches Fix will be...

Path Traversal in openapi-python-client

Impact Path traversal vulnerability. If a user generated a client using a maliciously crafted OpenAPI document, it is possible for generated files to be placed in arbitrary locations on disk. Giving this a CVSS score of 3.0 Low with CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N/E:P/RL:U/RC:C Patch...

SQL Injection Vulnerability in Off-site Facial Modeling Recognition Annual Inspection System of Shanxi Shangpin Youchuang Technology Co.

Shanxi Shangpin Youchuang Technology Co., Ltd. is a business incubation technology service provider, providing entrepreneurs with a full range of business technology services and more. A SQL injection vulnerability exists in the off-site facial modeling recognition annual inspection system of...

Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Treck Tcp\/Ip

Treck20-Related PoC for CVE-2020-11896 Treck TCP/IP stack and...

The vulnerability of the Deep Packet Inspection (DPI) implementation in the SD-WAN vEdge 5000 Series and SD-WAN vEdge Cloud software allows a attacker to trigger a service failure.

The vulnerability of the Deep Packet Inspection DPI implementation in SD-WAN vEdge 5000 Series and SD-WAN vEdge Cloud software lies in state management errors. Exploiting this vulnerability could allow a malicious actor to cause service interruptions remotely...

The vulnerability of the Deep Packet Inspection (DPI) implementation in the SD-WAN vEdge 5000 Series and SD-WAN vEdge Cloud software allows a attacker to trigger a service failure.

The vulnerability of the Deep Packet Inspection DPI implementation in SD-WAN vEdge 5000 Series and SD-WAN vEdge Cloud software lies in unauthorized access to the indexed source. Exploiting this vulnerability could allow a malicious actor to cause service interruptions remotely...

Cisco SD-WAN vEdge 5000 Series Routers and SD-WAN vEdge Cloud Router Denial of Service Vulnerability

Cisco SD-WAN vEdge 5000 Series Routers are Cisco's SD-WAN solution routing devices. A denial-of-service vulnerability in the deep packet inspection DPI engine in Cisco SD-WAN vEdge 5000 Series Routers and SD-WAN vEdge Cloud Router, which stems from the program's failure to properly handle FTP...