Corporate IoT - a path to intrusion

Several sources estimate that by the year 2020 some 50 billion IoT devices will be deployed worldwide. IoT devices are purposefully designed to connect to a network and many are simply connected to the internet with little management or oversight. Such devices still must be identifiable,...

[SECURITY] Fedora 30 Update: postgresql-11.4-1.fc30

PostgreSQL is an advanced Object-Relational database management system DBM S. The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine ...

Hyland Software Perceptive Content Server Denial of Service Vulnerability

Hyland Software Perceptive Content Server is a suite of content and process management solutions from Hyland Software, USA. The product includes features such as document management, electronic signatures, records and information management.ImageNow Server is one of the ImageNow servers. A denial...

CVE-2018-19629

A Denial of Service vulnerability in the ImageNow Server service in Hyland Perceptive Content Server before 7.1.5 allows an attacker to crash the service via a TCP connection...

PT-2019-11552 · Jetbrains · Kotlin +1

Name of the Vulnerable Software and Affected Versions: JetBrains IntelliJ IDEA versions prior to Kotlin plugin version 1.3.30 Description: The issue allows for a potential MITM attack due to JetBrains IntelliJ IDEA projects created using the Kotlin JS Client/JVM Server IDE Template resolving Grad...

Failed to call RPC function 'Vss.FinishSnapshot'

Article Applicability The first part of the error document in this article, Failed to call RPC function , is common and occurs anytime an RPC function cannot be invoked. This article is specifically related to an issue where the VSS snapshot closes prematurely because the KeepSnapshot RPC calls...

[SECURITY] Fedora 28 Update: postgresql-10.6-1.fc28

PostgreSQL is an advanced Object-Relational database management system DBM S. The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine ...

Network Manager VPNC Username Privilege Escalation

This module exploits an injection vulnerability in the Network Manager VPNC plugin to gain root privileges. This module uses a new line injection vulnerability in the configured username for a VPN network connection to inject a Password helper configuration directive into the connection...

CVE-2018-11455

A vulnerability has been identified in Automation License Manager 5 All versions 5.3.4.4, Automation License Manager 6 All versions 6.0.1. A directory traversal vulnerability could allow a remote attacker to move arbitrary files, which can result in code execution, compromising confidentiality,...

CVE-2018-11455

The vulnerability CVE-2018-11455 affects Siemens Automation License Manager: all versions of 5 before 5.3.4.4 and all versions of 6 before 6.0.1. It is a directory traversal flaw that could allow a remote attacker to move arbitrary files, potentially enabling code execution and impacting confiden...

tlslite-ng off-by-one error on mac checking

tlslite-ng version 0.7.3 and earlier, since commit d7b288316bca7bcdd082e6ccff5491e241305233 contains a CWE-354: Improper Validation of Integrity Check Value vulnerability in TLS implementation, tlslite/utils/constanttime.py: ctcheckcbcmacandpad; line endpos = datalen - 1 - mac.digestsize that can...

GHSA-CWH5-3CW7-4286 tlslite-ng off-by-one error on mac checking

tlslite-ng version 0.7.3 and earlier, since commit d7b288316bca7bcdd082e6ccff5491e241305233 contains a CWE-354: Improper Validation of Integrity Check Value vulnerability in TLS implementation, tlslite/utils/constanttime.py: ctcheckcbcmacandpad; line endpos = datalen - 1 - mac.digestsize that can...

Updated perl-DBD-mysql packages fix security vulnerabilities

Updated perl-DBD-mysql package fixes security vulnerabilities: The DBD::mysql Perl module through 4.043 for Perl allows remote attackers to cause a denial of service use-after-free and application crash or possibly have unspecified other impact by triggering certain error responses from a MySQL...

[SECURITY] Fedora 27 Update: postgresql-9.6.9-1.fc27

PostgreSQL is an advanced Object-Relational database management system DBM S. The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine ...

[SECURITY] Fedora 26 Update: postgresql-9.6.9-1.fc26

PostgreSQL is an advanced Object-Relational database management system DBM S. The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine ...

PT-2018-5669 · Mysql Server · Mysql Multi-Master Replication Manager (Mmm) Mmm Agentd

Name of the Vulnerable Software and Affected Versions: MySQL Multi-Master Replication Manager MMM mmm agentd version 2.2.1 Description: A specially crafted MMM protocol message can cause a shell command injection in the execute function of the MMM::Agent::Helpers module, resulting in arbitrary...

CVE-2018-1000159

tlslite-ng version 0.7.3 and earlier, since commit d7b288316bca7bcdd082e6ccff5491e241305233 contains a CWE-354: Improper Validation of Integrity Check Value vulnerability in TLS implementation, tlslite/utils/constanttime.py: ctcheckcbcmacandpad; line "endpos = datalen - 1 - mac.digestsize" that c...

CVE-2018-1000159

tlslite-ng version 0.7.3 and earlier, since commit d7b288316bca7bcdd082e6ccff5491e241305233 contains a CWE-354: Improper Validation of Integrity Check Value vulnerability in TLS implementation, tlslite/utils/constanttime.py: ctcheckcbcmacandpad; line "endpos = datalen - 1 - mac.digestsize" that c...

CVE-2018-1000159

tlslite-ng

Vulnerability Spotlight: Natus NeuroWorks Multiple Vulnerabilities

Vulnerabilities discovered by Cory Duplantis from Talos Overview Talos has discovered multiple vulnerabilities in Natus NeuroWorks software. This software is used in the Natus Xltek EEG medical products from Natus Medical Inc. The vulnerable devices contain an ethernet connection for data...