Malicious code in azure-network-security (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4b818dbe2f71342bdb38b29f300a263defa9b5fbb29e98b5c8e6eeceee0fab68 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1359 Malicious code in azure-network-security (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4b818dbe2f71342bdb38b29f300a263defa9b5fbb29e98b5c8e6eeceee0fab68 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EulerOS 2.0 SP5 : vim (EulerOS-SA-2022-1918)

According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Out-of-bounds Read in vim/vim prior to 8.2. CVE-2022-0319 - Use After Free in GitHub repository vim/vim prior to 8.2. CVE-2022-0413, CVE-2022-0443 ...

CVE-2018-18907

The CVE-2018-18907 entry concerns the D-Link DIR-850L router (firmware 1.21WW) where an attacker can gain full access to the wireless network by exploiting a partially completed WPA handshake. A client can send Data Frame packets to the AP without encryption to access the network. Affected produc...

CISA Requests Public Comment on CISA’s TIC 3.0 Cloud Use Case

CISA has released Trusted Internet Connections TIC 3.0 Cloud Use Case for public comment. TIC is a federal cybersecurity initiative intended to secure federal data, networks, and boundaries while providing visibility into agency traffic, including cloud communications. TIC use cases provide...

EulerOS 2.0 SP9 : httpd (EulerOS-SA-2022-1843)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP...

EulerOS 2.0 SP9 : bind (EulerOS-SA-2022-1857)

According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - BIND 9.11.0 - 9.11.36 9.12.0 - 9.16.26 9.17.0 - 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 - 9.11.36-S1 9.16.8-S1 - 9.16.26-S1 Versions of...

EulerOS 2.0 SP9 : openjpeg2 (EulerOS-SA-2022-1872)

According to the versions of the openjpeg2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In OpenJPEG 2.3.1, there is excessive iteration in the opjt1encodecblks function of openjp2/t1.c. Remote attackers could leverage this...

libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation.

...

Siemens Apache HTTP Server

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: Apache HTTP Server Vulnerabilities: NULL Pointer Dereference, Out-of-bounds Write, Server-side Request Forgery SSRF 2. UPDATE INFORMATION This updated advisory is a follow-up to the...

EulerOS 2.0 SP10 : flac (EulerOS-SA-2022-1826)

According to the versions of the flac package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In appendtoverifyfifointerleaved of streamencoder.c, there is a possible out of bounds write due to a missing bounds check. This could lead to loca...

Protect

An improper certificate validation vulnerability CWE-295 in FortiOS, FortiAnalyzer, FortiManager, and FortiSandbox may allow a network adjacent and unauthenticated attacker to man-in-the-middle the communication between the listed products and some external peers...

Microsoft Autopatch is here…but can you use it?

Updating endpoints on a network can be a daunting task. Testing before rollout can take time. Delays to patches going live can cause all manner of headaches. Windows Autopatch aims to tackle some of these issues, and is now live for public preview. The release comes with a few caveats which youll...

EulerOS 2.0 SP10 : bind (EulerOS-SA-2022-1800)

According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - BIND 9.11.0 - 9.11.36 9.12.0 - 9.16.26 9.17.0 - 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 - 9.11.36-S1 9.16.8-S1 - 9.16.26-S1 Versions of...

CVE-2022-30232

CVE-2022-30232 describes a CWE-20 improper input validation vulnerability that could enable remote code execution when an attacker can intercept/modify a request on the same network or has configuration access to an ION device. Affected products listed include Wiser Smart, EER21000 & EER21001 (V4...

AZL-9890 CVE-2022-27781 affecting package curl for versions less than 7.83.1-1

libcurl provides the CURLOPTCERTINFO option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation...

3 ways DNS filtering can save SMBs from cyberattacks

If you’re an SMB, chances are that you’re already well-aware of the fact that cyber threats can wreak havoc on your business. Everything from rootkits to ransomware threaten not just financial losses, but also significant network downtime and reputational damage as well. Couple this with the fact...

OESA-2022-1675 curl security update

cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: libcurl would reuse a previously created connection even when a TLS or SSH related option had been changed that should have prohibited reuse...

Critical Flaws in Popular ICS Platform Can Trigger RCE

Critical flaws in a popular platform used by industrial control systems ICS that allow for unauthorized device access, remote code execution RCE or denial of service DoS could threaten the security of critical infrastructure. OAS—offered by a company of the same name–makes it easy to transfer dat...

EulerOS 2.0 SP3 : ceph-common (EulerOS-SA-2022-1708)

According to the versions of the ceph-common packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in the Red Hat Ceph Storage RadosGW Ceph Object Gateway. The vulnerability is related to the injection of HTTP headers via...