VMware Flaw a Vector in SolarWinds Breach?

U.S. government cybersecurity agencies warned this week that the attackers behind the widespread hacking spree stemming from the compromise at network software firm SolarWinds used weaknesses in other, non-SolarWinds products to attack high-value targets. According to sources, among those was a...

SUSE SLES12 Security Update : python36 (SUSE-SU-2020:3865-1)

This update for python36 fixes the following issues : CVE-2019-18348: Fixed a CRLF injection via the host part of the url passed to urlopen bsc1155094 CVE-2019-20916: Fixed a directory traversal in downloadhttpurl bsc1176262. CVE-2020-27619: Fixed an issue where the CJK codec tests call eval on...

Virtuozzo 7 : librepo / librepo-devel / python-librepo (VZLSA-2020-5012)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:5012 advisory. - librepo: missing path validation in repomd.xml may lead to directory traversal CVE-2020-14352 Note that Nessus has not tested for this issue but ha...

SyncBreeze 10.0.28 Denial Of Service

Exploit Title: SyncBreeze 10.0.28 - 'login' Denial of Service Poc Data: 18-Dec-2020 Exploit Author: Ahmed Elkhressy Vendor Homepage: http://www.syncbreeze.com Software Link: http://www.syncbreeze.com/setups/syncbreezeentsetupv10.0.28.exe Version: 10.0.28 Tested on: Windows 7, Windows 10...

SyncBreeze 10.0.28 - (login) Denial of Service Exploit

Exploit Title: SyncBreeze 10.0.28 - 'login' Denial of Service Poc Exploit Author: Ahmed Elkhressy Vendor Homepage: http://www.syncbreeze.com Software Link: http://www.syncbreeze.com/setups/syncbreezeentsetupv10.0.28.exe Version: 10.0.28 Tested on: Windows 7, Windows 10 !/usr/bin/python import...

Virtuozzo 7 : fence-agents-aliyun / fence-agents-all / etc (VZLSA-2020-5003)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:5003 advisory. - python-httplib2: CRLF injection via an attacker controlled unescaped part of uri for httplib2.Http.request function CVE-2020-11078 Note that Nessus...

How to Increase Your Security Posture with Fewer Resources

With the number of COVID-19 cases increasing, another round of attacks is looming over schools and universities as they move into holiday break and prepare for the spring semester. According to a recent article the Wall Street Journal, there have been “nearly three dozen ransomware attacks agains...

VideoBytes: Brute force attacks increase due to more open RDP ports

Hello Folks! In this Videobyte, we’re talking about why brute force attacks are increasing and why that is a problem for everyone. The number of RDP ports exposed to the Internet grew from about three million in January 2020 to over four and a half million in March. The reason for this increase i...

SUSE SLED15 / SLES15 Security Update : PackageKit (SUSE-SU-2020:3845-1)

This update for PackageKit fixes the following issue : CVE-2020-16121: Fixed an Information disclosure in InstallFiles, GetFilesLocal and GetDetailsLocal bsc1176930. Notify service manager when it shutdown and cleanup temporary files when PackageKit quits. bsc1169739 Note that Tenable Network...

The SolarWinds Perfect Storm: Default Password, Access Sales and More

SECOND UPDATE A perfect storm may have come together to make SolarWinds such a successful attack vector for the global supply-chain cyberattack discovered this week. Researchers said that includes its use of a default password “SolarWinds123” that gave attackers an open door into its...

SUSE SLED15 / SLES15 Security Update : Test update for SUSE:SLE-15-SP3:Update (security) (SUSE-SU-2020:3830-1)

This is a security test update for SUSE:SLE-15-SP3:Update Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

45 Million Medical Images Left Exposed Online

More than 45 million medical images—and the personally identifiable information PII and personal healthcare information PHI associated with them–have been left exposed online due to unsecured technology that’s typically used to store, send and receive medical data, new research has found. A team...

Virtuozzo 7 : java-1.8.0-openjdk / etc (VZLSA-2019-1815)

An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Virtuozzo 7 : wget (VZLSA-2019-1228)

An update for wget is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

EulerOS 2.0 SP5 : nss (EulerOS-SA-2020-2572)

According to the versions of the nss packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in the way NSS handled CCS ChangeCipherSpec messages in TLS 1.3. This flaw allows a remote attacker to send multiple CCS messages,...

EulerOS 2.0 SP5 : pki-core (EulerOS-SA-2020-2560)

According to the versions of the pki-core packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A vulnerability was found in all pki-core 10.x.x versions, where the Key Recovery Authority KRA Agent Service did not properly sanitize recove...

Fedora 33 : curl (2020-ceaf490686)

curl: Inferior OCSP verification CVE-2020-8286 - libcurl: FTP wildcard stack overflow CVE-2020-8285 - curl: trusting FTP PASV responses CVE-2020-8284 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has...

Virtuozzo 7 : http-parser / http-parser-devel (VZLSA-2019-2258)

An update for http-parser is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

Mozilla Firefox < 84.0

The version of Firefox installed on the remote Windows host is prior to 84.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-54 advisory. - The lifecycle of IPC Actors allows managed actors to outlive their manager actors; and the former must ensure that they...

Zilliqa: Using gossip to drain miner wallets

Summary: Using a flaw in the gossip protocol, a malicious shard member can trick any other fellow shard member into signing an arbitrary message. One way this can be exploited is by creating a transaction transferring funds from the account corresponding to a target node's public key; having the...