CISA Releases Guidance: TIC 3.0 Remote User Use Case

In coordination with the Office of Management and Budget OMB, the Federal Chief Information Security Officer Council FCISO Trusted Internet Connections TIC Subcommittee, and the General Services Administration, CISA has released Trusted Internet Connections 3.0 Remote User Use Case. The Remote Us...

Stormshield Network Security 安全漏洞

Stormshield Network Security is a next-generation UTM Unified Threat Management firewall from the French company Stormshield. A security vulnerability exists in Stormshield Network Security Netasq that originates from an overload that can be triggered by an attacker through a proxy to trigger a...

Enhance Network Security for AWS Transit Gateway

Increase security and visibility for lateral and outbound network-loads using the look-aside inspection architecture...

Enhance Network Security for AWS Transit Gateway

Increase security and visibility for lateral and outbound network-loads using the look-aside inspection architecture...

[SECURITY] Fedora 35 Update: openssh-8.7p1-2.fc35

SSH Secure SHell is a program for logging into and executing commands on a remote machine. SSH is intended to replace rlogin and rsh, and to provide secure encrypted communications between two untrusted hosts over an insecure network. X11 connections and arbitrary TCP/IP ports can also be forward...

CVE-2021-22946

A user can tell curl = 7.20.0 and = 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server --ssl-reqd on the command line orCURLOPTUSESSL set to CURLUSESSLCONTROL or CURLUSESSLALL withlibcurl. This requirement could be bypassed if the server would return a...

CVE-2021-22946

CVE-2021-22946 affects curl before 7.82.0 (and within 7.20.0–7.78.0 per description) where the --ssl-reqd option or CURLUSESSL controls could be bypassed if a server crafts a legitimate response, allowing curl to continue without TLS. Connected sources confirm this flaw exists across multiple eco...

FatPipe Networks WARP/IPVPN/MPVPN 10.2.2 - Remote Privilege Escalation

Exploit Title: FatPipe Networks MPVPN 10.2.2 - Remote Privilege Escalation Date: 25.07.2021 Exploit Author: LiquidWorm Vendor Homepage: https://www.fatpipeinc.com !/usr/bin/env python3 FatPipe Networks WARP/IPVPN/MPVPN 10.2.2 Remote Privilege Escalation Vendor: FatPipe Networks Inc. Product web...

StreamDivert - Redirecting (Specific) TCP, UDP And ICMP Traffic To Another Destination

StreamDivert is a tool to man-in-the-middle or relay in and outgoing network connections on a system. It has the ability to, for example, relay all incoming SMB connections to port 445 to another server, or only relay specific incoming SMB connections from a specific set of source IP's to another...

5 Steps to Securing Your Network Perimeter

When it comes to security, some of tomorrow’s biggest threats will come from yesterday’s vulnerabilities. In that regard, the network perimeter is a primary concern. Network security has been discussed for years, and many best practices are well documented. And yet, according to Positive...

CVE-2021-34416

The CVE-2021-34416 vulnerability affects Zoom on‑premise products: Meeting Connector, Meeting Connector MMR, Recording Connector, Virtual Room Connector, and Virtual Room Connector Load Balancer. The issue is an input validation failure in the network address administrative settings web portal wh...

Trend Micro ServerProtect Authorization Issues Vulnerability

Trend Micro ServerProtect is an enterprise-grade anti-virus program from Trend Micro, Inc. It is used to protect network-connected storage systems and block threats at the source. Trend Micro ServerProtect suffers from an authorization problem vulnerability that originates from an error in the...

EulerOS 2.0 SP9 : binutils (EulerOS-SA-2021-2521)

According to the versions of the binutils package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An out of bounds flaw was found in GNU binutils objdump utility version 2.36. An attacker could use this flaw and pass a large section to...

EulerOS 2.0 SP8 : systemd (EulerOS-SA-2021-2487)

According to the versions of the systemd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value involving strdupa an...

CVE-2021-22017

Summary of CVE-2021-22017 : VMware vCenter Server’s rhttp proxy (rhttproxy) has an improper URI normalization implementation that can be exploited by a remote attacker with network access to port 443 to bypass proxy restrictions and access internal endpoints. The vulnerability affects vCenter Ser...

CVE-2021-22012

CVE-2021-22012 affects VMware vCenter Server. An information-disclosure vulnerability exists due to an unauthenticated appliance management API that allows a remote attacker with network access to port 443 to access sensitive information. Connected sources corroborate an unauthenticated API endpo...

Race condition

A vulnerability in the Layer 2 punt code of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a queue wedge on an interface that receives specific Layer 2 frames, resulting in a denial of service DoS condition. This vulnerability is due to improper handling of certa...

Security Bulletin: Vulnerability in nss and nspr CVE-2019-17006.

Summary Network Security Services NSS & Netscape Portable Runtime NSPR is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2019-17006 DESCRIPTION: Mozilla Network Security Services NSS, as used in Mozilla Firefox is vulnerable t...

Security Bulletin: Vulnerability in nss, nss-softokn, nss-util vulnerability (CVE-2019-11729 and CVE-2019-11745)

Summary Network Security Services NSS is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. The nss-softokn package provides the Network Security Services Softoken Cryptographic Module. The nss-util packages provide utilities...

Cring Ransomware Gang Exploits 11-Year-Old ColdFusion Bug

Unidentified threat actors breached a server running an unpatched, 11-year-old version of Adobe's ColdFusion 9 software in minutes to remotely take over control and deploy file-encrypting Cring ransomware on the target's network 79 hours after the hack. The server, which belonged to an unnamed...