CVE-2020-25235

Siemens LOGO! 8 BM (incl. SIPLUS variants) is affected by CVE-2020-25235 in all versions prior to 8.3. The vulnerability, categorized as Insufficiently Protected Credentials (CWE-522), allows an attacker with network access to derive valid logins because the authentication password used for the L...

CVE-2019-19287

Siemens XHQ Operations Intelligence prior to version 6.1 contains a relative path traversal vulnerability in the web interface that could allow an unauthenticated remote attacker to traverse the server file system by sending specially crafted packets over the network. Affected: XHQ, all versions

CVE-2020-8169

CVE-2020-8169 affects curl/libcurl 7.62.0–7.70.0. Root cause: libcurl could be tricked into prepending part of a password to the host name before DNS resolution, potentially leaking a partial password over the network and to DNS servers. Impact: information disclosure of partial credentials. Affe...

Code injection

GE Healthcare Imaging and Ultrasound Products may allow specific credentials to be exposed during transport over the network...

U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise

Communications at the U.S. Treasury and Commerce Departments were reportedly compromised by a supply chain attack on SolarWinds, a security vendor that helps the federal government and a range of Fortune 500 companies monitor the health of their IT networks. Given the breadth of the companys...

CVE-2020-25179

CVE-2020-25179 affects GE Healthcare Imaging and Ultrasound Products. The issue involves unprotected transport of credentials and exposure of sensitive system information to an unauthorized control sphere, enabling credential exposure during network transport. Impact described in ICS advisory inc...

Customer Guidance on Recent Nation-State Cyber Attacks

Note: we are updating as the investigation continues. Revision history listed at the bottom. This post contains technical details about the methods of the actor we believe was involved in Recent Nation-State Cyber Attacks, with the goal to enable the broader security community to hunt for activit...

Fedora 32 : libslirp (2020-331e1318dd)

Fix CVE-2020-29129 CVE-2020-29130 out-of-bounds access while processing ARP/NCSI packets Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible...

EulerOS 2.0 SP8 : squid (EulerOS-SA-2020-2534)

According to the versions of the squid package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Squid before 4.9, when certain web browsers are used, mishandles HTML in the host aka hostname parameter to cachemgr.cgi.CVE-2019-18860 - An issue...

Fedora 33 : 1:nodejs (2020-43d5a372fc)

Update to 14.15.1 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network Security, Inc...

CVE-2020-13986

CVE-2020-13986 affects Contiki (through v3.0) with an infinite loop in the uIP TCP/IP stack when processing IPv6 RPL extension headers in net/rpl/rpl-ext-header.c (rpl_remove_header). This is a memory/loop vulnerability in the uIP stack used by Contiki and related ports (e.g., Contiki-NG, PicoTCP...

CVE-2020-5948 — F5 TMUI XSS vulnerability

On BIG-IP versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of the BIG-IP system if the victim user is granted the...

Fedora 32 : pam (2020-bd83344365)

fix CVE-2020-27780: authentication bypass when the user doesn't exist Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Debian DLA-2489-1 : minidlna security update

It was discovered that missing input validation in minidlna, a lightweight DLNA/UPnP-AV server could result in the execution of arbitrary code. In addition minidlna was susceptible to the 'CallStranger' UPnP vulnerability. For Debian 9 stretch, these problems have been fixed in version...

Debian DLA-2488-2 : python-apt regression update

The update for python-apt released as 2488-1 introduced a regression by causing a segmentation fault, which is now fixed with this update. For Debian 9 stretch, this problem has been fixed in version 1.4.3. We recommend that you upgrade your python-apt packages. For the detailed security status o...

Virtuozzo 7 : patch (VZLSA-2019-2964)

An update for patch is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

Fedora 33 : spice-gtk (2020-79a7a31fea)

Update to v0.39 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network Security, Inc. T...

Debian DLA-2486-1 : xorg-server security update

Jan-Niklas Sohn discovered that the XKB extension of the Xorg X server performed incomplete input validation, which could result in privilege escalation. For Debian 9 stretch, these problems have been fixed in version 2:1.19.2-1+deb9u7. We recommend that you upgrade your xorg-server packages. For...

Virtuozzo 7 : java-1.8.0-openjdk / etc (VZLSA-2019-3128)

An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2020-26830

CVE-2020-26830 applies to SAP Solution Manager 7.2 (User Experience Monitoring). The common thread across connected sources is a missing authorization check for authenticated users, enabling a regular user to perform operations restricted to administrators (change UX monitoring config, view agent...