Fedora 30 : php-robrichards-xmlseclibs1 (2020-1b95d7a131)

1.4.3 12, Nov 2019 Security Improvements : - Insure only a single SignedInfo element exists within a signature during verification. Refs CVE-2019-3465. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has...

Fedora 31 : drupal7-ckeditor (2020-71ebbd64dc)

https://www.drupal.org/project/ckeditor/releases/7.x-1.19 - https://www.drupal.org/sa-contrib-2020-007 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as...

CVE-2020-8430

Stormshield Network Security 310 3.7.10 devices have an auth/lang.html?rurl= Open Redirect vulnerability on the captive portal. For example, the attacker can use rurl=//example.com instead of rurl=https://example.com in the query string...

CVE-2020-8430

Stormshield Network Security 310 3.7.10 devices have an auth/lang.html?rurl= Open Redirect vulnerability on the captive portal. For example, the attacker can use rurl=//example.com instead of rurl=https://example.com in the query string...

Open redirect

Stormshield Network Security 310 3.7.10 devices have an auth/lang.html?rurl= Open Redirect vulnerability on the captive portal. For example, the attacker can use rurl=//example.com instead of rurl=https://example.com in the query string...

CVE-2020-8430

Stormshield Network Security 310 3.7.10 devices have an auth/lang.html?rurl= Open Redirect vulnerability on the captive portal. For example, the attacker can use rurl=//example.com instead of rurl=https://example.com in the query string...

CVE-2020-8430

The CVE-2020-8430 entry concerns Stormshield Network Security model 310 with version 3.7.10 and an Open Redirect vulnerability in the captive portal due to the auth/lang.html?rurl parameter. The issue allows an attacker to redirect users by supplying a crafted rurl value (e.g., rurl=//example.com...

Unbreakable Enterprise kernel security update

4.14.35-1902.301.1 - vhost: Check docket skfamily instead of call getname Eugenio Perez Orabug: 31085991 CVE-2020-10942 - uek-rpm: config-mips64-embedded misc pruning Eric Saint-Etienne Orabug: 31079017 - ubifs: Check for name being NULL while mounting Richard Weinberger Orabug: 29410897 - team:...

Travelex Pays $2.3M in Bitcoin to Hackers Who Hijacked Network in January

Travelex has paid out $2.3 million in Bitcoin to hackers to regain access to its global network after a malware attack at the new year knocked the global currency exchange offline and crippled its business during the month of January. The move—reported by the Wall Street Journal—may seem...

Arbitrary Code Execution

thunderbird is vulnerable to arbitrary code execution. Two buffer overflow flaws were found in the Network Security Services NSS code for processing the SSLv2 protocol. Connecting to a malicious secure web server could cause the execution of arbitrary code as the user running Thunderbird...

Arbitrary Code Execution

mozilla nss is vulnerable to arbitrary code execution. Two buffer overflow flaws were found in the Network Security Services NSS code for processing the SSLv2 protocol. Connecting to a malicious secure web server could cause the execution of arbitrary code as the user running Thunderbird...

SUSE SLED15 / SLES15 Security Update : python-PyYAML (SUSE-SU-2020:0959-1)

This update for python-PyYAML fixes the following issues : CVE-2020-1747: Fixed an arbitrary code execution when YAML files are parsed by FullLoader bsc1165439. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has...

Symantec Data Center Security Manager Privilege Escalation

Symantec Data Center Security Manager Component, with versions earlier than 6.8.2 aka 6.8 MP2, are found to be susceptible to a privilege escalation vulnerability, where an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected...

Fedora 30 : glibc (2020-7f625c5ea8)

This update incorporates fixes from the upstream glibc 2.29 stable release branch, including 3 fixes for medium severity security vulnerabilities. CVE-2020-10029, CVE-2020-1752, CVE-2020-1751 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora...

Fedora 31 : rubygem-puma (2020-fd87f90634)

Security fix for CVE-2020-5247, CVE-2020-5249 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C...

Session Hijacking Vulnerability in ProxySG and ASG

Summary The ASG and ProxySG management consoles are susceptible to a session hijacking vulnerability. A remote attacker, with access to the appliance management interface, can hijack the session of a currently logged-in user and access the management console. Affected Products Advanced Secure...

[SECURITY] Fedora 32 Update: nss-3.51.0-1.fc32

Network Security Services NSS is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSL v2 and v3, TLS, PKCS 5, PKCS 7, PKCS 11, PKCS 12, S/MIME, X.509 v3 certificates, and other security...

Richkit - Domain Enrichment Toolkit

Richkit is a python3 package that provides tools taking a domain name as input, and returns addtional information on that domain. It can be an analysis of the domain itself, looked up from data-bases, retrieved from other services, or some combination thereof. The purpose of richkit is to provide...

CVE-2020-1637

CVE-2020-1637 concerns a bypass of Unified Access Control (UAC) on Juniper Networks SRX Series running Junos OS Enforcer. The root cause is when the Infranet Controller IP range is configured as an IP address range instead of an IP address/netmask, which can allow a user to access network resourc...

CVE-2020-1629

CVE-2020-1629 describes a race-condition vulnerability in Juniper Networks Junos OS where the Routing Protocol Daemon (RPD) may crash and restart while processing a BGP NOTIFICATION message. Affected versions include Junos OS 16.1 prior to 16.1R7-S6; 16.2 prior to 16.2R2-S11; 17.1 prior to 17.1R2...