The vulnerability of the LTE component of the Android operating system from the CAF repository, which allows a perpetrator to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the LTE component of the Android operating system exists due to insufficient verification of data related to the size of the frequency list. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality, integrity, and accessibility of the...

FAQ: Citrix Virtual Apps and Desktops Long Term Service Release (LTSR)

Table of Contents General LTSR Information LTSR upgrades Mixing LTSR, CR, and Cloud releases Support lifecycles LTSR compliance Citrix Workspace app LTSR Release timing Other considerations and resources General LTSR Information What’s new and what’s changed with the Citrix Virtual Apps and...

Legal Robot: Privilege Escalation to Admin-level Account

A security researcher discovered a potentially serious privilege escalation issue in our system which was ultimately traced to our use of the allow-deny package provided in the open source Meteor framework. We implemented a short-term fix using triggers - not great performance on the same day thi...

Windows 10 & 11 Compatibility with Citrix Virtual Desktops (XenDesktop)

With the release of the Windows 10 & 11 Operating Systems, Microsoft introduced a new way to build, deploy, and service Windows:Windows as a service. New features are packaged into Feature Updates. Bug fixes and security fixes are packaged into Quality/Feature Updates. These updates can be deploy...

DEBIAN-CVE-2017-9526

In Libgcrypt before 1.7.7, an attacker who learns the EdDSA session key from side-channel observation during the signing process can easily recover the long-term secret key. 1.7.7 makes a cipher/ecc-eddsa.c change to store this session key in secure memory, to ensure that constant-time point...

UBUNTU-CVE-2017-9526

In Libgcrypt before 1.7.7, an attacker who learns the EdDSA session key from side-channel observation during the signing process can easily recover the long-term secret key. 1.7.7 makes a cipher/ecc-eddsa.c change to store this session key in secure memory, to ensure that constant-time point...

The Successful CISO: Tips for Paving the Way to Job Security

Seasoned CISOs know that failure to plan past a two-year window is dangerous—to both their company and their job security. But it’s all too common for many security strategies to look only two years out. Imperva CISO Shahar Ben-Hador has been with Imperva for eight-and-a-half years—the last...

Google Patches Android 'Custom Boot Mode' Vulnerability

A high-risk Android custom boot mode vulnerability was one of many bugs patched by Google as part of its January Android Security Bulletin released earlier this week. On Thursday, the IBM security team that discovered the vulnerability disclosed details about the flaw which leaves Nexus 6 and 6P...

USN-3128-2 linux-lts-xenial vulnerability

USN-3128-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement HWE kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. Ondrej Kozina discovered that the keyring interface in the Linux kernel contained a...

Long Term Evolution Network Information Disclosure Vulnerability

Long Term Evolution LTE is a 4G wireless broadband technology developed by the Third Generation Partnership Project 3GPP project team. An information disclosure vulnerability exists in LTE devices. An attacker could exploit this vulnerability to obtain sensitive information and execute a...

USN-3106-2 linux-lts-xenial vulnerability

USN-3106-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement HWE kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. It was discovered that a race condition existed in the memory manager of the Linux...

panorama.es XSS vulnerability

Vulnerable URL: http://www.panorama.es/rentals/results/rentaltype/long%20term%20rentals/?dfa=%5B%27http%3A%2F%2Fwww.panorama.es%2Frentals%2Fresults%2F%27%5D%22%27%3E%20%3C/form%3E%3Cscript%3Ealert%22OPENBUGBOUNTY%22;%3C/script%3E Details: Description| Value ---|--- Patched:| Yes, at 27.07.2017...

Debian DLA-487-1 : debian-security-support - Long term security support update

The Debian Long Term Support LTS Team is unable to continue supporting different packages in the extended life cycle of Wheezy LTS. The debian-security-support package provides the check-support-status tool that helps to warn the administrator about installed packages whose security support is...

CloudBees Jenkins CI and Jenkins LTS redirection vulnerability

CloudBees Jenkins CI formerly known as Hudson Labs is a Java-based continuous integration tool from CloudBees, Inc. It is mainly used to monitor ongoing software releases/testing projects and a number of timed tasks.LTS Long-Term Support is a long-supported version of CloudBees Jenkins CI is a...

CloudBees Jenkins CI and Jenkins LTS Information Disclosure Vulnerability (CNVD-2016-03162)

CloudBees Jenkins CI formerly known as Hudson Labs is a Java-based continuous integration tool from CloudBees, Inc. It is mainly used to monitor ongoing software releases/testing projects and a number of timed tasks.LTS Long-Term Support is a long-supported version of CloudBees Jenkins CI is a...

jenkins: Non-constant time comparison of CSRF crumbs (SECURITY-245)

Jenkins before 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify CSRF tokens, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force approach...

jenkins: CSRF protection ineffective (SECURITY-233)

Jenkins before 1.640 and LTS before 1.625.2 allow remote attackers to bypass the CSRF protection mechanism via unspecified vectors...

Drupal Unsupported Version Detection (deprecated)

This plugin has been deprecated. For plugins which identify unsupported instances of this product, search the plugin feed for Drupal SEoL. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid89684; scriptversion"1.8";...

[SECURITY] Debian 6 Squeeze has reached end-of-life

The Debian Long Term Support LTS Team hereby announces that Debian 6 "Squeeze" support has reached its end-of-life on February 29, 2016, five years after its initial release on February 6, 2011. There will be no further security support for Debian 6.0. The LTS Team will prepare the transition to...

CloudBees Jenkins CI and LTS API Token Vulnerability

CloudBees Jenkins CI is a set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and some of the timed execution of the task . LTS is a long-term support for CloudBees Jenkins CI version . CloudBe...