CVE-2021-3384

A vulnerability in Stormshield Network Security could allow an attacker to trigger a protection related to ARP/NDP tables management, which would temporarily prevent the system to contact new hosts via IPv4 or IPv6. This affects versions 2.0.0 to 2.7.7, 2.8.0 to 2.16.0, 3.0.0 to 3.7.16, 3.8.0 to...

CVE-2021-3384

Stormshield Network Security is affected by CVE-2021-3384, a vulnerability in ARP/NDP table management that can temporarily prevent contacting new hosts over IPv4/IPv6. Impacted versions include 2.0.0–2.7.7, 2.8.0–2.16.0, 3.0.0–3.7.16, 3.8.0–3.11.4, and 4.0.0–4.1.5. Fixed in 2.7.8, 3.7.17, 3.11.5...

CVE-2021-3384

A vulnerability in Stormshield Network Security could allow an attacker to trigger a protection related to ARP/NDP tables management, which would temporarily prevent the system to contact new hosts via IPv4 or IPv6. This affects versions 2.0.0 to 2.7.7, 2.8.0 to 2.16.0, 3.0.0 to 3.7.16, 3.8.0 to...

PT-2021-20341 · Stormshield · Stormshield Network Security

Name of the Vulnerable Software and Affected Versions: Stormshield Network Security versions 2.0.0 through 2.7.7 Stormshield Network Security versions 2.8.0 through 2.16.0 Stormshield Network Security versions 3.0.0 through 3.7.16 Stormshield Network Security versions 3.8.0 through 3.11.4...

Stormshield Network Security 安全漏洞

Stormshield Network Security is a next-generation UTM Unified Threat Management firewall from Stormshield France. Stormshield Network Security suffers from a denial of service vulnerability, which can be exploited by an attacker who can trigger a fatal error via an IPv6 NDP timeout in Stormshield...

SUSE SLES12 Security Update : ImageMagick (SUSE-SU-2021:0600-1)

This update for ImageMagick fixes the following issues : CVE-2021-20243 bsc1182336: Division by zero in GetResizeFilterWeight in MagickCore/resize.c CVE-2021-20244 bsc1182325: Division by zero in ImplodeImage in MagickCore/visual-effects.c CVE-2021-20246 bsc1182337: Division by zero in...

[SECURITY] Fedora 33 Update: rygel-0.40.1-1.fc33

Rygel is a home media solution that allows you to easily share audio, video and pictures, and control of media player on your home network. In technical te rms it is both a UPnP AV MediaServer and MediaRenderer implemented through a pl ug-in mechanism. Interoperability with other devices in the...

CVE-2021-20328

Specific versions of the Java driver that support client-side field level encryption CSFLE fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffi...

CVE-2021-20328

CVE-2021-20328 affects specific versions of the MongoDB Java driver that support Field Level Encryption (CSFLE). The root cause is improper host name verification on the KMS server’s certificate, enabling a privileged MITM attacker to intercept traffic between the Java driver and the KMS service ...

Arbitrary File Download Vulnerability in Renzi Network Security Management System

hereinafter referred to as Renzihang was founded in May 2000, and is committed to escorting the network information security of state management organizations, operators, enterprises and institutions, and individuals. An arbitrary file download vulnerability exists in Renzihang's network security...

[SECURITY] Fedora 33 Update: wireshark-3.4.3-1.fc33

Wireshark allows you to examine protocol data stored in files or as it is captured from wired or wireless WiFi or Bluetooth networks, USB devices, and many other sources. It supports dozens of protocol capture file formats and understands more than a thousand protocols. It has many powerful...

CVE-2021-1231

Cisco Nexus 9000 Series Fabric Switches in ACI mode are affected by CVE-2021-1231 due to incomplete validation of the LLDP source, enabling an unauthenticated adjacent attacker to disable switching on an SFP interface and disrupt traffic. Affected components are LLDP handling on Nexus 9000 device...

SUSE SLED15 / SLES15 Security Update : avahi (SUSE-SU-2021:0551-1)

This update for avahi fixes the following issues : CVE-2021-26720: drop privileges when invoking avahi-daemon-check-dns.sh bsc1180827 Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d. Add sudo to requires: used to drop privileges. Note that...

Shadow Attacks Let Attackers Replace Content in Digitally Signed PDFs

Researchers have demonstrated a novel class of attacks that could allow a bad actor to potentially circumvent existing countermeasures and break the integrity protection of digitally signed PDF documents. Called "Shadow attacks" by academics from Ruhr-University Bochum, the technique uses the...

Weak Password Vulnerability in Tianqing Intrusion Prevention System

SkyQuest Intrusion Prevention System is a network-based intrusion prevention product independently developed by Qixing, which is based on the core concept of deep defense and precise blocking. Through deep analysis of network traffic, it can accurately discover various types of intrusion attacks ...

EulerOS 2.0 SP2 : mesa (EulerOS-SA-2021-1328)

According to the version of the mesa packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - An exploitable shared memory permissions vulnerability exists in the functionality of X11 Mesa 3D Graphics Library 19.1.2. An attacker can access the...

EulerOS 2.0 SP2 : php-pear (EulerOS-SA-2021-1345)

According to the version of the php-pear package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - ArchiveTar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack such as file:// to...

Debian DLA-2570-1 : screen security update

encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service invalid write access and application crash or possibly have unspecified other impact via a crafted UTF-8 character sequence. For Debian 9 stretch, this problem has been fixed in version 4.5.0-6+deb9u1. We...

EulerOS 2.0 SP2 : python-rtslib (EulerOS-SA-2021-1355)

According to the version of the python-rtslib package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Open-iSCSI rtslib-fb through 2.1.72 has weak permissions for /etc/target/saveconfig.json because shutil.copyfile instead of shutil.copy is...

McAfee Endpoint Security Improper Access Control Vulnerability

McAfee Endpoint Security ENS is McAfee's antivirus product that provides comprehensive protection against network security threats. An improper access control vulnerability exists in McAfee Endpoint Security for Windows. An attacker could exploit the vulnerability to prevent the installation of...