EulerOS 2.0 SP2 : mysql-connector-java (EulerOS-SA-2021-1331)

According to the version of the mysql-connector-java package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Vulnerability in the MySQL Connectors component of Oracle MySQL subcomponent: Connector/J. Supported versions that are affected are...

McAfee Endpoint Security Improper Access Control Vulnerability

McAfee Endpoint Security ENS is McAfee's antivirus product that provides comprehensive protection against network security threats. An improper access control vulnerability exists in McAfee Endpoint Security for Windows. An attacker could exploit the vulnerability to prevent the installation of...

McAfee Endpoint Security Improper Access Control Vulnerability (CNVD-2021-12621)

McAfee Endpoint Security ENS is McAfee's antivirus product that provides comprehensive protection against network security threats. An improper access control vulnerability exists in McAfee Endpoint Security for Windows. An attacker could exploit the vulnerability by running a specific command to...

SUSE SLED15 / SLES15 Security Update : python3 (SUSE-SU-2021:0529-1)

This update for python3 fixes the following issues : CVE-2021-3177: Fixed buffer overflow in PyCArgrepr in ctypes/callproc.c, which may lead to remote code execution bsc1181126. Provide the newest setuptools wheel bsc1176262, CVE-2019-20916 in their correct form bsc1180686. Note that Tenable...

EulerOS 2.0 SP2 : squid (EulerOS-SA-2021-1363)

According to the versions of the squid packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A Request Smuggling and Poisoning attack c...

Debian DLA-2560-1 : qemu security update

Several vulnerabilities were discovered in QEMU, a fast processor emulator notably used in KVM and Xen HVM virtualization. An attacker could trigger a denial of service DoS, information leak, and possibly execute arbitrary code with the privileges of the QEMU process on the host. CVE-2020-15469 A...

Foxit PhantomPDF < 4.1.3 PDF Spoofing (macOS)

The version of Foxit PhantomPDF for Mac installed on the remote macOS host is prior to 4.1.3. It is, therefore, affected by a PDF spoofing vulnerability. An Evil Annotation Attack may deliver incorrect validation results when validating certain certified PDF files whose visible content was...

Buffer overflow

Improper buffer restrictions in firmware for IntelR 7360 Cell Modem before UDE version 9.4.370 may allow unauthenticated user to potentially enable denial of service via network access...

nss: ECDSA timing attack mitigation bypass

A flaw was found in nss. Using the EM side-channel, it is possible to extract the position of zero and non-zero wNAF digits while nss-certutil tool performs scalar multiplication during the ECDSA signature generation, leaking partial information about the ECDSA nonce. Given a small number of ECDS...

nss: Side channel attack on ECDSA signature generation

A flaw was found in nss. Using the EM side-channel, it is possible to extract the position of zero and non-zero wNAF digits while nss-certutil tool performs scalar multiplication during the ECDSA signature generation, leaking partial information about the ECDSA nonce. Given a small number of ECDS...

nss: CHACHA20-POLY1305 decryption with undersized tag leads to out-of-bounds read

A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 which was not functioning correctly and strictly enforcing tag length. The highest threat from...

RLSA-2021:0538 Moderate: nss security and bug fix update

Network Security Services NSS is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Security Fixes: nss: Side channel attack on ECDSA signature generation CVE-2020-6829 nss: P-384 and P-521 implementation uses a side-channel...

SUSE SLES12 Security Update : python (SUSE-SU-2021:0432-1)

This update for python fixes the following issues : buffer overflow in PyCArgrepr in ctypes/callproc.c, which may lead to remote code execution bsc1181126, CVE-2021-3177. Provide the newest setuptools wheel bsc1176262, CVE-2019-20916 in their correct form bsc1180686. Note that Tenable Network...

SUSE SLED15 / SLES15 Security Update : openvswitch (SUSE-SU-2021:0436-1)

This update for openvswitch fixes the following issues : CVE-2020-35498: Fixed a denial of service related to the handling of Ethernet padding bsc1181742. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempt...

Web shell attacks continue to rise

One year ago, we reported the steady increase in the use of web shells in attacks worldwide. The latest Microsoft 365 Defender data shows that this trend not only continued, it accelerated: every month from August 2020 to January 2021, we registered an average of 140,000 encounters of these threa...

CVE-2020-25493

The CVE-2020-25493 entry concerns Oclean Mobile Application 2.1.2, which communicates with an external site over HTTP. The vulnerability description states that HTTP payloads are encrypted with a hardcoded XOR key, creating a pathway for potential traffic decoding and eavesdropping. Connected sou...

SUSE SLES15 Security Update : kernel (SUSE-SU-2021:0427-1)

The SUSE Linux Enterprise 15 SP2 realtime kernel was updated to receive various security and bugfixes. The following security bugs were fixed : CVE-2021-3347: A use-after-free was discovered in the PI futexes during fault handling, allowing local users to execute code in the kernel bnc1181349...

CVE-2021-27170

Technical details about CVE-2021-27170 are not publicly provided in the connected documents. Monitor for updates.

SUSE SLES12 Security Update : kernel (SUSE-SU-2021:0348-1)

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes. The following security bugs were fixed : CVE-2021-3347: A use-after-free was discovered in the PI futexes during fault handling, allowing local users to execute code in the kernel bnc1181349...

SUSE SLES12 Security Update : kernel (SUSE-SU-2021:0353-1)

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : CVE-2021-3347: A use-after-free was discovered in the PI futexes during fault handling, allowing local users to execute code in the kernel bnc1181349...