Security Bulletin: SMB vulnerabilities in IBM N Series Products

Summary Data ONTAP products implement the SMB protocol. Systems that implement the SMB protocol can be susceptible to one or more man-in-the-middle attacks which when exploited could potentially lead to information disclosure, privilege escalation, or a Denial of Service. Vulnerability Details...

Security Bulletin: May 2016 OpenSSL Vulnerabilities affect Multiple N series Products

Summary OpenSSL vulnerabilities were disclosed on May 3, 2016 by the OpenSSL Project. OpenSSL is used by Multiple N series products. Multiple N series products has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-2107 DESCRIPTION: OpenSSL could allow a remote attacker to obtai...

Security Bulletin: December 2015 OpenSSL Vulnerabilities in Multiple N series Products

Summary Multiple N series products incorporate the OpenSSL software libraries to provide cryptographic capabilities. OpenSSL versions below 1.0.2e, 1.0.1q, 1.0.0t, and 0.9.8zh are susceptible to vulnerabilities that could lead to a denial of service attack or information disclosure. Multiple N...

Security Bulletin: Jnuary 2017 OpenSSL Vulnerabilities affect Multiple N series Products

Summary Multiple N series products incorporate the OpenSSL software libraries to provide cryptographic capabilities. OpenSSL versions below 1.0.2k and 1.1.0d are susceptible to vulnerabilities that could lead to out-of-bound reads, process crashes, Denial of Service DoS attacks, or incorrect...

Security Bulletin: Vulnerability in SSLv3 affects Multiple N series products (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in N series products. Vulnerability Details CVE-ID: CVE-2014-3566 DESCRIPTION: Product could allow a remote attacker to obtain sensitive...

Security Bulletin: CVE-2016-0800 SSLv2 Vulnerability in Multiple N series Products

Summary Multiple N series products incorporate the OpenSSL software libraries to provide cryptographic capabilities. OpenSSL versions below 1.0.2h and 1.0.1t are susceptible to vulnerabilities that could lead to out-of-bound writes, heap corruption, man-in-the-middle attacks, memory exhaustion, o...

Security Bulletin: IBM N Series Data ONTAP SMI-S Agent is affected by vulnerability in OpenSSL

Summary IBM N Series Data ONTAP SMI-S Agent is affected by vulnerability in OpenSSL CVE-2014-0160 Vulnerability Details CVE-ID: CVE-2014-0160 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the TLS/DTLS heartbeat functionality. An attacker...

Security Bulletin: January 2015 OpenSSL security vulnerabilities in Multiple IBM N Series Products

Summary OpenSSL vulnerabilities were disclosed on January 8, 2015 by the OpenSSL Project. This includes “FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability. OpenSSL is used by Multiple IBM N Series Products. Below IBM N Series Products have addressed the applicabl...

Security Bulletin: Vulnerabilities in OpenSSL including ClientHello DoS affect Multiple N series Products

Summary OpenSSL vulnerabilities were disclosed on March 19, 2015 by the OpenSSL Project. This includes OpenSSL ClientHello sigalgs DoS CVE-2015-0291. OpenSSL is used by Multiple N series Products. Multiple N series Products have addressed the applicable CVEs. Vulnerability Details CVEID:...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

CVE-2021-44228-Advisories Please open Issues to include an adv...

Exploit for SQL Injection in Zohocorp Manageengine_Network_Configuration_Manager

CVE-2021-41081 N-DAY VULNERABILITY RESEARCH F...

Abcbot — A New Evolving Wormable Botnet Malware Targeting Linux

Researchers from Qihoo 360's Netlab security team have released details of a new evolving botnet called "Abcbot" that has been observed in the wild with worm-like propagation features to infect Linux systems and launch distributed denial-of-service DDoS attacks against targets. While the earliest...

CVE-2020-23906

CVE-2020-23906 affects FFmpeg (build N-98388-g76a3ee996b). The issue allows a denial of service via a crafted audio file caused by insufficient verification of data authenticity. The connected documents consistently cite the same vulnerability description and reference ecosystem advisories, but d...

FFmpeg 数据伪造问题漏洞

FFmpeg is a complete solution for recording, converting, and streaming audio and video from the FFmpeg Ffmpeg team. FFmpeg N-98388-g76a3ee996b contains a security vulnerability that could be exploited by an attacker to cause a denial of service DoS via a crafted audio file due to insufficient...

GSD-2021-1001618 x86/entry: Clear X86_FEATURE_SMAP when CONFIG_X86_SMAP=n

x86/entry: Clear X86FEATURESMAP when CONFIGX86SMAP=n This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.73 by commit...

Researchers Propose Machine Learning-based Bluetooth Authentication Scheme

A group of academics has proposed a machine learning approach that uses authentic interactions between devices in Bluetooth networks as a foundation to handle device-to-device authentication reliably. Called "Verification of Interaction Authenticity" aka VIA, the recurring authentication scheme...

D-Link DAP-2020 Stack Buffer Overflow Vulnerability

The D-Link DAP-2020 is a wireless N access point. A stack buffer overflow vulnerability exists in the D-Link DAP-2020, which is caused by incorrect boundary checking of the var:page parameter in the webproc endpoint. An attacker could exploit the vulnerability to cause a buffer overflow and execu...

D-Link DAP-2020 Stack Buffer Overflow Vulnerability (CNVD-2021-67523)

The D-Link DAP-2020 is a wireless N access point. The D-Link DAP-2020 is vulnerable to a stack buffer overflow vulnerability caused by incorrect boundary checking of the var:menu parameter in the webproc endpoint, which could be exploited by an attacker to cause a buffer overflow and execute...

D-Link DAP-2020 Stack Buffer Overflow Vulnerability (CNVD-2021-67522)

The D-Link DAP-2020 is a wireless N access point. A stack buffer overflow vulnerability exists in the D-Link DAP-2020, which is caused by a failure to properly boundary check in the webproc endpoint. An attacker could exploit the vulnerability to cause a buffer overflow and execute arbitrary code...

D-Link DSL-2750U Unauthorized Configuration Modification Vulnerability

The D-Link DSL-2750U is a wireless N 300 ADSL2 modem router.An unauthorized configuration modification vulnerability exists in the D-Link DSL-2750U ME1.16 and earlier versions. An attacker could use this vulnerability to modify the configuration without authorization...