CVE-2020-5535

OpenBlocks IoT VX2 is affected by CVE-2020-5535 (OS command injection). The vulnerabilities affect the VX2 prior to Ver.4.0.0 (Ver.3 Series). An attacker connected on the same network segment can execute arbitrary OS commands with root privileges, via unspecified vectors. Affected component is th...

Simplicity is the Key to Enterprise Cybersecurity

Editor’s Note: Sam Bocetta, a guest author on the VMware Carbon Black blog, is a freelance journalist specializing in U.S. diplomacy and national security, with emphases on technology trends in cyber warfare, cyber defense, and cryptography. In today’s digital environment, companies are...

Microsoft identity acronyms—what do they mean and how do they relate to each other?

As a security advisor working with one to three Chief Information Security Officers CISOs each week, the topic of identity comes up often. These are smart people who have often been in industry for decades. They have their own vocabulary of acronyms that only security professionals know such as...

SUSE SLED15 / SLES15 Security Update : permissions (SUSE-SU-2020:0547-1)

This update for permissions fixes the following issues : Security issues fixed : CVE-2019-3687: Fixed a privilege escalation which could allow a local user to read network traffic if wireshark is installed bsc1148788 CVE-2020-8013: Fixed an issue where chkstat set unintended setuid/capabilities f...

Debian DLA-2131-2 : rrdtool regression update

It was discovered that there was a regression in a previous fix, which resulted in the following error : ERROR: cannot compile regular expression: Error while compiling regular expression ^?:^%+|%%%+- 0?0-9.0-9+?leEfF%s?:^%+|%%$ at char 18: range out of order in character class ^?:^%+|%%%+-...

Photon OS 1.0: Unzip PHSA-2020-1.0-0281

An update of the unzip package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-1.0-0281. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid134208...

Fedora 31 : PyYAML (2020-3162499159)

Security fix for CVE-2019-20477 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network...

Fedora 31 : rubygem-loofah (2020-03c0964b6a)

Fix XXS when a crafted SVG element is republished. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues....

TP LINK TL-WR849N - Remote Code Execution

Exploit Title: TP LINK TL-WR849N - Remote Code Execution Date: 2019-11-20 Exploit Author: Elber Tavares Vendor Homepage: https://www.tp-link.com/ Software Link: https://www.tp-link.com/br/support/download/tl-wr849n/Firmware Version: TL-WR849N 0.9.1 4.16 Tested on: linux, windows CVE : CVE-2020-93...

Fedora 30 : rubygem-loofah (2020-1ebc4b8284)

Fix XXS when a crafted SVG element is republished. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues....

Fedora 31 : golang-github-gorilla-websocket (2020-0ae6297680)

Update to latest version. Fix GHSA-jf24-p9p9-4rjh. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues....

Fedora 31 : firejail (2020-7f6e0e6e00)

Rebase to version 0.9.62 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network Securit...

Fedora 30 : firejail (2020-0fb484d7f7)

Rebase to version 0.9.62 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network Securit...

SUSE SLES12 Security Update : mariadb (SUSE-SU-2020:0505-1)

This update for mariadb fixes the following issues : MariaDB was updated to version 10.2.31 GA bsc1162388. Security issues fixed : CVE-2020-2574: Fixed a difficult to exploit vulnerability that allowed an attacker to crash the client bsc1162388. CVE-2019-18901: Fixed an unsafe path handling...

Fedora 30 : mingw-libpng (2020-512f0121dc)

Update to libpng-1.6.37, see https://sourceforge.net/projects/libpng/files/libpng16/1.6.37/ for details. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as...

CVE-2018-8878

CVE-2018-8878 affects Asuswrt-Merlin firmware on ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470. The vulnerability allows remote attackers to read the custom_id variable on the blocking.asp page, enabling information disclosure of internal network hostnames and MAC addre...

Fedora 31 : python-waitress (2020-65a7744e38)

Update to 1.4.3, fixing CVE-2019-16786 CVE-2019-16785 CVE-2019-16789 and adding various other hardening features. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and forma...

SUSE SLES12 Security Update : nodejs6 (SUSE-SU-2020:0488-1)

This update for nodejs6 fixes the following issues : Security issues fixed : CVE-2019-15604: Fixed a remotely triggerable assertion in the TLS server via a crafted certificate string CVE-2019-15604, bsc1163104. CVE-2019-15605: Fixed an HTTP request smuggling vulnerability via malformed...

Fedora 31 : NetworkManager-ssh (2020-28ae68ec60)

Fix privilege escalation https://bugzilla.redhat.com/showbug.cgi?id=1803499 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without...

New LTE Network Flaw Could Let Attackers Impersonate 4G Mobile Users

A group of academics from Ruhr University Bochum and New York University Abu Dhabi have uncovered security flaws in 4G LTE and 5G networks that could potentially allow hackers to impersonate users on the network and even sign up for paid subscriptions on their behalf. The impersonation attack —...