Scientific Linux Security Update : httpd on SL7.x x86_64 (20190806)

Security Fixes : - httpd: modauthdigest: access control bypass due to race condition CVE-2019-0217 - httpd: URL normalization inconsistency CVE-2019-0220 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid128223;...

Scientific Linux Security Update : udisks2 on SL7.x x86_64 (20190806)

Security Fixes : - udisks: Format string vulnerability in udiskslog in udiskslogging.c CVE-2018-17336 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid128267; scriptversion"1.4";...

Scientific Linux Security Update : systemd on SL7.x x86_64 (20190806)

Security Fixes : - systemd: line splitting via fgets allows for state injection during daemon-reexec CVE-2018-15686 - systemd: out-of-bounds read when parsing a crafted syslog message CVE-2018-16866 - systemd: kills privileged process if unprivileged PIDFile was tampered CVE-2018-16888 C Tenable...

Security vulnerabilities fixed in Thunderbird 68 — Mozilla

When an inner window is reused, it does not consider the use of document.domain for cross-origin protections. If pages on different subdomains ever cooperatively use document.domain, then either page can abuse this to inject script into arbitrary pages on the other subdomain, even those that did...

Delta Controls enteliBUS Controllers

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Delta Controls Equipment: enteliBUS Controllers Vulnerability: Buffer Overflow 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker on the same network to gain...

CVE-2019-15556

Pvanloon1983 socialnetwork before 2019-07-03 allows SQL injection in includes/formhandlers/registerhandler.php...

Fedora 30 : libmodbus (2019-4942e01cdc)

Addresses CVE-2019-14462 and CVE-2019-14463 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C...

Debian DLA-1895-1 : libmspack security update

JsHuang found an issue in libmspack, a library for Microsoft compression format. Opening a crafted chm file might result in a buffer overflow which might disclose confidential information. For Debian 8 'Jessie', this problem has been fixed in version 0.5-1+deb8u4. We recommend that you upgrade yo...

Fedora 29 : 1:nodejs (2019-6a2980de56) (0-Length Headers Leak) (Empty Frames Flood) (Internal Data Buffering) (Ping Flood) (Reset Flood) (Resource Loop) (Settings Flood)

Update to Node.js 10.6.13 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network...

Trend Micro Named A Leader in 2019 Gartner Magic Quadrant for Endpoint Protection Platforms

Leadership. It’s a weighty term, although frequently it is used too lightly and all too often it’s a self-declared position. We believe, leaders can come and go, and leadership can be fleeting depending on the factors for long term success. It is for all these reasons, that we are proud, not only...

U.S. Dept Of Defense: Command Injection (via CVE-2019-11510 and CVE-2019-11539)

Summary: The Navy has a Pulse Secure SSL VPN https://████████/dana-na/auth/urldefault/welcome.cgi that is vulnerable to: CVE-2019-11510 - Pre-auth Arbitrary File Reading CVE-2019-11539 - Post-auth Command Injection vulnerable hostname from ssl certificate: ██████████.navy.mil The pre-auth arbitra...

Internet Bug Bounty: mod_http2, read-after-free in h2 connection shutdown (CVE-2019-10082)

Using fuzzed network input, the http/2 session handling could be made to read memory after being freed, during connection shutdown. This is made possible by a race condition in which nghttp2 maintains a reference to a stream after modhttp2 has destroyed it. This vulnerability has been fixed in...

Virtuozzo 6 : openssl / openssl-devel / openssl-perl / etc (VZLSA-2019-2471)

An update for openssl is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

EulerOS 2.0 SP5 : exiv2 (EulerOS-SA-2019-1804)

According to the versions of the exiv2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Exiv2::isoSpeed in easyaccess.cpp in Exiv2 v0.27-RC2 allows remote attackers to cause a denial of service NULL pointer dereference and application...

In Conversation: The Women in Network Security

Why does network security matter? On average, there is a hacker attack every 39 seconds. If any of these attacks result in a data breach, they could cost over $150 million, with research suggesting that cyber-attacks could cost businesses over...

SUSE SLES12 Security Update : postgresql96 (SUSE-SU-2019:2159-1)

This update for postgresql96 fixes the following issues : Security issue fixed : CVE-2019-10208: Fixed arbitrary SQL execution via suitable SECURITY DEFINER function under the identity of the function owner bsc1145092. Note that Tenable Network Security has extracted the preceding description blo...

Fedora 29 : mgetty (2019-732b5488c2)

Security fix for CVE-2019-1010189 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Networ...

Fedora 30 : 1:libreoffice (2019-dd9d207c17)

CVE-2019-9850 Insufficient url validation allowing LibreLogo script execution - CVE-2019-9851 LibreLogo global-event script execution - CVE-2019-9852 Insufficient URL encoding flaw in allowed script location check - latest stable version Note that Tenable Network Security has extracted the...

Fedora 30 : python-django (2019-647f74ce51)

fixes for CVE-2019-14232 to 14235 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Networ...

Fedora 29 : 3:mariadb / mariadb-connector-c / mariadb-connector-odbc (2019-f873e2799f)

MariaDB 10.3.17 Release notes : https://mariadb.com/kb/en/mariadb-10317-release-notes/ MariaDB Connector/C 3.1.3 Release notes : https://mariadb.com/kb/en/mariadb-connector-c-313-release-notes/ MariaDB Connector/ODBC 3.1.2 Release notes :...