CVE-2021-20999

The CVE-2021-20999 issue affects Weidmüller u-controls and IoT-Gateways (versions up to 1.12.1). A network port intended for device-internal use is reachable via external interfaces, enabling manipulation of the device or disruption of operation. The vulnerability is documented with high/critical...

SUSE SLES12 Security Update : xen (SUSE-SU-2021:1580-1)

This update for xen fixes the following issues : A recent systemd update caused a regression in 'xenstored.service' systemd now fails to track units that use systemd-notify. bsc1183790 Add a fix to delay between the call to 'systemd-notify' and the final exit of the wrapper script. bsc1185021,...

SUSE SLED15 / SLES15 Security Update : openvpn (SUSE-SU-2021:1577-1)

This update for openvpn fixes the following issues : CVE-2020-15078: Fixed authentication bypass with deferred authentication bsc1185279. CVE-2020-11810: Fixed race condition between allocating peer-id and initializing data channel key bsc1169925. CVE-2018-7544: Fixed cross-protocol scripting iss...

‘FragAttacks’: Wi-Fi Bugs Affect Millions of Devices

A Belgian security researcher specializing in Wi-Fi bugs has unearthed a clutch of new ones, which he called FragAttacks, that affect the Wi-Fi standard itself. The name is short for “fragmentation and aggregation attacks.” Some bugs date back to 1997, meaning that computers, smartphones or other...

Debian DLA-2654-1 : composer security update

It was discovered that composer, a dependency manager for PHP, did not properly sanitize Mercurial URLs, which could lead to arbitrary code execution. For Debian 9 stretch, this problem has been fixed in version 1.2.2-1+deb9u1. We recommend that you upgrade your composer packages. For the detaile...

CVE-2020-26142

An issue was discovered in the kernel in OpenBSD 6.6. The WEP, WPA, WPA2, and WPA3 implementations treat fragmented frames as full frames. An adversary can abuse this to inject arbitrary network packets, independent of the network configuration...

Design/Logic Flaw

An issue was discovered in the kernel in OpenBSD 6.6. The WEP, WPA, WPA2, and WPA3 implementations treat fragmented frames as full frames. An adversary can abuse this to inject arbitrary network packets, independent of the network configuration...

CVE-2020-26142

CVE-2020-26142 is an OpenBSD kernel issue (OpenBSD 6.6) where the WEP, WPA, WPA2, and WPA3 implementations incorrectly treat fragmented frames as full frames. This misbehavior can allow an adversary to inject arbitrary network packets, independent of network configuration, by abusing fragmented f...

CVE-2020-26140

The CVE-2020-26140 entry is covered in ARISTA Security Advisory 0063, which groups it under the FragAttacks fragmentation/aggregation vulnerabilities. The advisory states that plaintext data frames are accepted on encrypted networks, enabling packet injection. Fixes are provided as platform-speci...

CVE-2020-26140

Removed by vendor...

CVE-2020-26144

CVE-2020-26144 describes that plaintext A-MSDU frames starting with an RFC1042 (LLC/SNAP) header can be accepted on encrypted Wi‑Fi networks, enabling packet injection. The vulnerability is part of the FragAttacks family affecting 802.11 frame aggregation/fragmentation implementations. Connected ...

Siemens Mendix Database Replication Module

1. EXECUTIVE SUMMARY CVSS v3 4.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: Mendix Database Replication Module Vulnerability: Generation of Error Message Containing Sensitive Information 2. RISK EVALUATION Successful exploitation of this vulnerability could...

JetBrains WebStorm 加密问题漏洞

JetBrains WebStorm is an application from the Czech company JetBrains. Provides an IDE for programming. A security vulnerability exists in JetBrains WebStorm versions prior to 2021.1. The vulnerability stems from the program's use of HTTP requests instead of HTTPS.No detailed vulnerability detail...

CVE-2020-24588

The CVE-2020-24588 entry relates to the 802.11 Wi‑Fi fragmentation/ A‑MSDU handling issue where the plaintext QoS header flag isn’t authenticated, enabling an attacker to inject packets by sending non‑SSP A‑MSDU frames (FragAttacks). Connected Astra Linux advisories describe this as a variant of ...

Command Execution Vulnerability in LeadSec NetGuard Security Gateway

Beijing Nethub Information Technology Co., Ltd. was renamed from Lenovo Nethub Technology Beijing Co., Ltd. and its predecessor was the Information Security Division of Lenovo Group. For more than twenty years, Netnifty Nebula insists on being the defender of network security order and adheres to...

Command Execution Vulnerability in NETSYS

Founded in 2004, Shenzhen Domain Technology Co., Ltd. is a national high-tech enterprise specializing in the research and development, production, sales and service of products in the field of network information security. NETSYS has a command execution vulnerability that can be exploited by an...

Trend Micro Home Network Security Denial of Service Vulnerability (CNVD-2021-34349)

Trend Micro Home Network Security is a network appliance from Trend Micro, Inc. It is used to scan all incoming and outgoing traffic to and from the home network to prevent intrusions, block hacking and cyber threats, and protect privacy. A denial of service vulnerability exists in Trend Micro Ho...

Beijing AnTian Network Security Technology Co., Ltd. shadow chasing threat analysis system has logic flaws ask vulnerabilities

Chasing Shadow Threat Analysis System is a file depth analysis device independently developed by Antenna. There is a logic flaw vulnerability in the Chasing Shadow Threat Analysis System of Beijing AnTian Network Security Technology Co., Ltd. that can be exploited by attackers to obtain sensitive...

Trend Micro Home Network Security Denial of Service Vulnerability

Trend Micro Home Network Security is a network appliance from Trend Micro, Inc. It is used to scan all incoming and outgoing traffic to and from the home network to prevent intrusions, block hacking and cyber threats, and protect privacy. A denial of service vulnerability exists in Trend Micro Ho...

Aruba ClearPass Policy Manager Information Disclosure Vulnerability

Aruba ClearPass Policy Manager is an application that provides a wireless network security access management system. An information disclosure vulnerability exists in versions prior to Aruba ClearPass Policy Manager 6.9.5, 6.8.9, 6.7.14-HF1, which can be exploited by a remote attacker to submit a...