Debian DLA-2522-1 : coturn security update

A flaw was discovered in coturn, a TURN and STUN server for VoIP. By default coturn does not allow peers on the loopback addresses 127.x.x.x and ::1. A remote attacker can bypass the protection via a specially crafted request using a peer address of '0.0.0.0' and trick coturn in relaying to the...

SUSE SLES15 Security Update : kernel (SUSE-SU-2021:0095-1)

The SUSE Linux Enterprise 15 SP1 RT kernel was updated to receive various security and bugfixes. The following security bugs were fixed : CVE-2020-36158: Fixed a potential remote code execution in the Marvell mwifiex driver bsc1180559. CVE-2020-27825: Fixed a race in the traceopen and buffer resi...

The vulnerability in the NSS web security service of browsers Firefox, Firefox ESR, and the email client Thunderbird allows attackers to influence data integrity.

The vulnerability of the NSS network security service for Firefox browsers, Firefox ESR, and the Thunderbird email client is related to incorrect bit transmission. Exploiting this vulnerability allows a remote attacker to compromise data integrity...

Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to a security vulnerability (CVE-2019-11745)

Summary IBM has announced a release for IBM Security Identity Governance and Intelligence IGI in response to security vulnerability. The vulnerability concerns Network Security Services Softoken Cryptographic Module that could allow an attacker to execute arbitrary code on the system or cause a...

CVE-2020-15799

CVE-2020-15799 affects Siemens SCALANCE X-200 switch family (incl. SIPLUS NET) < v5.2.5 and SCALANCE X-200IRT

CVE-2020-14341

The "Test Connection" available in v7.x of the Red Hat Single Sign On application console can permit an authorized user to cause SMTP connections to be attempted to arbitrary hosts and ports of the user's choosing, and originating from the RHSSO installation. By observing differences in the timin...

CVE-2021-21469

When security guidelines for SAP NetWeaver Master Data Management running on windows have not been thoroughly reviewed, it might be possible for an external operator to try and set custom paths in the MDS server configuration. When no adequate protection has been enforced on any level e.g., MDS...

Debian DLA-2520-1 : golang-websocket security update

There was an integer overflow vulnerability concerning the length of websocket frames received via a websocket connection. An attacker could use this flaw to cause a denial of service attack on an HTTP Server allowing websocket connections. For Debian 9 stretch, this problem has been fixed in...

Microsoft Teams < 1.3.0.13000 Remote Code Execution

The version of Microsoft Teams installed on the remote Windows host is a version prior to 1.3.0.13000. It is, therefore, affected by remote code execution vulnerability. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number....

Fedora 32 : mingw-binutils (2020-28c78a6ac3)

Backport patches for CVE-2020-35493, CVE-2020-35494, CVE-2020-35495, CVE-2020-35496. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible...

Denial of Service Vulnerability in Mercuery X18G Routers

The business scope of Shenzhen Meike Star Communication Technology Co., Ltd. includes the technical development of computer wireless LAN products, computer hardware and software, communication equipment, electronic products and network security equipment. A denial of service vulnerability exists ...

Russia’s SolarWinds Attack and Software Security

The information that is emerging about Russias extensive cyberintelligence operation against the United States and other countries should be increasingly alarming to the public. The magnitude of the hacking, now believed to have affected more than 250 federal agencies and businesses -- ­primarily...

Waychar enrollment system suffers from SQL injection vulnerability (CNVD-2021-03387)

Guangzhou City Huadu District Xinhua Weichuang Advertising Design Service Department business scope includes: advertising, network information technology promotion services, network security information consulting. Waychar enrollment system has a SQL injection vulnerability, which can be exploite...

Waychar enrollment system suffers from SQL injection vulnerability (CNVD-2021-03395)

Guangzhou City Huadu District Xinhua Weichuang Advertising Design Service Department business scope includes: advertising, network information technology promotion services, network security information consulting. Waychar enrollment system has a SQL injection vulnerability, which can be exploite...

NSA Urges SysAdmins to Replace Obsolete TLS Protocols

The National Security Agency NSA is lighting a fire under system administrators who are dragging their feet to replace insecure and outdated Transport Layer Security TLS protocol instances. The agency this week released new guidance and tools to equip companies to update from obsolete older...

McAfee Network Security Manager Cross-Site Request Forgery Vulnerability

McAfee Network Security Manager NSM is a network security solution from McAfee that enables real-time monitoring of deployed McAfee intrusion prevention systems across the network. A cross-site request forgery vulnerability exists in McAfee Network Security Manager. An attacker could exploit this...

SUSE SLED15 / SLES15 Security Update : ceph (SUSE-SU-2021:0023-1)

This update for ceph fixes the following issues : Security issues fixed : CVE-2020-27781: Fixed a privilege escalation via the cephvolumeclient Python interface bsc1179802 bsc1180155. Non-security issues fixed : Fixes an issue when check in legacy collection reaches end. bsc1179139 Fixes an issue...

SUSE SLES12 Security Update : java-1_8_0-ibm (SUSE-SU-2021:0032-1)

This update for java-180-ibm fixes the following issues : Update to Java 8.0 Service Refresh 6 Fix Pack 20 bsc1180063,bsc1177943 CVE-2020-14792 CVE-2020-14797 CVE-2020-14781 CVE-2020-14779 CVE-2020-14798 CVE-2020-14796 CVE-2020-14803 - Class libraries : - SOCKETADAPTOR$SOCKETINPUTSTREAM.READ is...

CVE-2020-7336

Cross Site Request Forgery vulnerability in McAfee Network Security Management NSM prior to 10.1.7.35 and NSM 9.x prior to 9.2.9.55 may allow an attacker to change the configuration of the Network Security Manager via a carefully crafted HTTP request...

CVE-2020-7336

Cross Site Request Forgery vulnerability in McAfee Network Security Management NSM prior to 10.1.7.35 and NSM 9.x prior to 9.2.9.55 may allow an attacker to change the configuration of the Network Security Manager via a carefully crafted HTTP request...