CVE-2020-8864

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.10B04. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP login...

Debian DLA-2152-1 : graphicsmagick security update

A vulnerability was discovered in graphicsmagick, a collection of image processing tools, that allows allows an attacker to read arbitrary files via a crafted image because of TranslateTextEx for SVG. For Debian 8 'Jessie', this problem has been fixed in version 1.3.20-3+deb8u9. We recommend that...

Debian DLA-2151-1 : icu security update

It was discovered that an integer overflow in the International Components for Unicode ICU library could result in denial of service and potentially the execution of arbitrary code. For Debian 8 'Jessie', this problem has been fixed in version 52.1-8+deb8u8. We recommend that you upgrade your icu...

EulerOS 2.0 SP5 : webkitgtk4 (EulerOS-SA-2020-1328)

According to the version of the webkitgtk4 packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - WebCore/platform/network/soup/SocketStreamHandleImplSou p.cpp in the libsoup network backend of WebKit, as used in WebKitGTK+ prior to version...

Debian DLA-2149-1 : rails security update

In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers. Views that use the j or escapejavascript methods may be susceptible to XSS attacks. For Debian 8 'Jessie', this problem has been fixed in version...

Work-from-Home Security Advice

SANS has made freely available its "Work-from-Home Awareness Kit." When I think about how COVID-19's security measures are affecting organizational networks, I see several interrelated problems: One, employees are working from their home networks and sometimes from their home computers. These...

McAfee Network Security Management Cross-Site Scripting Vulnerability (CNVD-2020-21065)

McAfee Network Security Management NSM is a suite of network security solutions from McAfee that enables real-time monitoring of deployed McAfee intrusion prevention systems across the network. A cross-site scripting vulnerability exists in McAfee Network Security Management 9.1 and prior version...

McAfee Network Security Management Cross-Site Scripting Vulnerability (CNVD-2020-20985)

McAfee Network Security Management NSM is a suite of network security solutions from McAfee that enables real-time monitoring of deployed McAfee intrusion prevention systems across the network. A cross-site scripting vulnerability exists in McAfee NSM versions prior to 9.1. The vulnerability stem...

CVE-2020-7258

Cross site scripting vulnerability in McAfee Network Security Management NSM Prior to 9.1 update 6 Mar 2020 Update allows attackers to unspecified impact via unspecified vectors...

CVE-2020-7258

Cross site scripting vulnerability in McAfee Network Security Management NSM Prior to 9.1 update 6 Mar 2020 Update allows attackers to unspecified impact via unspecified vectors...

CVE-2020-7256

Cross site scripting vulnerability in McAfee Network Security Management NSM Prior to 9.1 update 6 Mar 2020 Update allows attackers to unspecified impact via unspecified vectors...

Cross site scripting

Cross site scripting vulnerability in McAfee Network Security Management NSM Prior to 9.1 update 6 Mar 2020 Update allows attackers to unspecified impact via unspecified vectors...

CVE-2020-7256 Network Security Management (NSM) - Cross site scripting vulnerability

Cross site scripting vulnerability in McAfee Network Security Management NSM Prior to 9.1 update 6 Mar 2020 Update allows attackers to unspecified impact via unspecified vectors...

CVE-2020-7256

The CVE-2020-7256 entry concerns a Cross-Site Scripting vulnerability in McAfee Network Security Management (NSM) prior to version 9.1. The available connected documents confirm the affected product (NSM) and the vulnerability class (XSS) but do not provide concrete exploit vectors, affected comp...

CVE-2020-7258 Network Security Management (NSM) - Cross site scripting vulnerability

Cross site scripting vulnerability in McAfee Network Security Management NSM Prior to 9.1 update 6 Mar 2020 Update allows attackers to unspecified impact via unspecified vectors...

Hunting APTs with YARA

For the past few years, we have been spreading our knowledge and experience of using YARA, often called a pattern matching swiss knife for malware researchers and everyone else. Most of the time, this took the form of the Kaspersky training course titled, "Hunting APTs with YARA Like a GReAT...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM Spectrum Protect Backup-Archive Client NetApp Services (CVE-2019-1547, CVE-2019-1549, CVE-2019-1563, CVE-2019-1552)

Summary OpenSSL vulnerabilities were disclosed on July 30, 2019 and September 10, 2019 by the OpenSSL Project. OpenSSL is used by the IBM Spectrum Protect Backup-Archive Client for network connections with NetApp services. Vulnerability Details CVEID: CVE-2019-1547 DESCRIPTION: OpenSSL could allo...

GLSA-202003-37 : Mozilla Network Security Service: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202003-37 Mozilla Network Security Service: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Mozilla Network Security Service NSS. Please review the CVE identifiers referenced below for details. Impact : A...

Fedora 30 : php-horde-Horde-Form (2020-a69f99bc67)

HordeForm 2.0.20 - mjr SECURITY: Prevent ability to specify temporary filename CVE-2020-8866, Reported By: Andrea Cardaci working with Trend Micro Zero Day Initiative. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website...

Fedora 31 : php-horde-Horde-Form (2020-a55b70b4ab)

HordeForm 2.0.20 - mjr SECURITY: Prevent ability to specify temporary filename CVE-2020-8866, Reported By: Andrea Cardaci working with Trend Micro Zero Day Initiative. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website...