EulerOS 2.0 SP9 : c-ares (EulerOS-SA-2021-1941)

According to the version of the c-ares package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions...

EulerOS 2.0 SP9 : docker-engine (EulerOS-SA-2021-1922)

According to the version of the docker-engine packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - In Docker before versions 9.03.15, 20.10.3 there is a vulnerability in which pulling an intentionally malformed Docker image manifest crashe...

SUSE SLES12 Security Update : dhcp (SUSE-SU-2021:1822-1)

This update for dhcp fixes the following issues : CVE-2021-25217: A buffer overrun in lease file parsing code can be used to exploit a common vulnerability shared by dhcpd and dhclient bsc1186382 Note that Tenable Network Security has extracted the preceding description block directly from the SU...

SUSE SLES15 Security Update : ceph (SUSE-SU-2021:1835-1)

This update for ceph fixes the following issues : Update to 15.2.12-83-g528da226523 : CVE-2021-3509 fix cookie injection issue bsc1186021 CVE-2021-3531 RGWSwiftWebsiteHandler::iswebdir checks empty subdirname bsc1186020 CVE-2021-3524 sanitize \r in s3 CORSConfigurations ExposeHeader bsc1185619 No...

EulerOS 2.0 SP9 : openssh (EulerOS-SA-2021-1955)

According to the version of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access o...

SUSE SLED15 / SLES15 Security Update : bind (SUSE-SU-2021:1826-1)

This update for bind fixes the following issues : CVE-2021-25214: Fixed a broken inbound incremental zone update IXFR which could have caused named to terminate unexpectedly bsc1185345. CVE-2021-25215: Fixed an assertion check which could have failed while answering queries for DNAME records that...

Arbitrary File Download Vulnerability in Tianrongxin Technology Group Reporter

Founded on August 30, 1985, Skyrun Technology Group is a leading provider of network security, big data and security cloud services in China. An arbitrary file download vulnerability exists in Tianrongxin Technology Group Reporter, which can be exploited by attackers to obtain sensitive informati...

kernel security and bug fix update

4.18.0-305.3.14.OL8 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

Trend Micro Home Network Security elevation of privilege vulnerability (CNVD-2021-39159)

Trend Micro Home Network Security is a network appliance from Trend Micro, Inc. It is used to scan all incoming and outgoing traffic to and from the home network to prevent intrusions, block hacking and cyber threats, and protect privacy. An elevation of privilege vulnerability exists in the...

Command Execution Vulnerability in Blue Ocean Premier Billing Management System

Blue Ocean Premier Billing Management System is a set of network security operation management system which is based on realizing network operation, centering on enhancing global security, and aiming at improving management efficiency. A command execution vulnerability exists in the Blue Ocean...

Trend Micro Home Network Security Elevation of Privilege Vulnerability

Trend Micro Home Network Security is a network appliance from Trend Micro, Inc. It is used to scan all incoming and outgoing traffic to and from the home network to prevent intrusions, block hacking and cyber threats, and protect privacy. An elevation of privilege vulnerability exists in the...

CVE-2021-26111

CVE-2021-26111 affects FortiSwitch memory management: versions 6.4.0–6.4.6, 6.2.0–6.2.6, 6.0.0–6.0.6, 3.6.11 and earlier are vulnerable. A missing release of memory after effective lifetime can allow an attacker on an adjacent network to exhaust available memory by sending specially crafted LLDP/...

Cobalt Strike, a penetration testing tool abused by criminals

If you were to compose a list of tools and software developed by security and privacy defenders that ended up being abused by the bad guys, then Cobalt Strike would unfortunately be near the top of the list. Maybe only Metasploit could give it a run for the first place ranking. Metasploit—probabl...

Understanding the threat landscape and risks of OT environments

The security community is continuously changing, growing, and learning from each other to better position the world against cyber threats. In the latest Voice of the Community blog series post, Microsoft Product Marketing Manager Natalia Godyla talks with Chris Sistrunk, Technical Manager in...

Understanding the threat landscape and risks of OT environments

The security community is continuously changing, growing, and learning from each other to better position the world against cyber threats. In the latest Voice of the Community blog series post, Microsoft Product Marketing Manager Natalia Godyla talks with Chris Sistrunk, Technical Manager in...

Arbitrary File Download Vulnerability in Next-Generation Firewall Control System of Shenzhen Zhongke NetWizard Technology Co.

Ltd. was founded in 2009, headquartered in Shenzhen Futian International E-commerce Industrial Park, is a national high-tech enterprises, double soft enterprise; the earliest domestic VPN R & D manufacturers, professional network security products R & D vendors, the company has been committed to...

SUSE SLED15 / SLES15 Security Update : postgresql13 (SUSE-SU-2021:1785-1)

This update for postgresql13 fixes the following issues : Upgrade to version 13.3 : CVE-2021-32027: Fixed integer overflows in array subscripting calculations bsc1185924. CVE-2021-32028: Fixed mishandling of junk columns in INSERT ... ON CONFLICT ... UPDATE target lists bsc1185925. CVE-2021-32029...

SUSE SLES12 Security Update : slurm_20_11 (SUSE-SU-2021:1791-1)

This update for slurm2011 fixes the following issues : Udpate to 20.11.7 : CVE-2021-31215: remote code execution as SlurmUser because of a PrologSlurmctld or EpilogSlurmctld script leads to environment mishandling bsc1186024 Ship REST API version and auth plugins with slurmrestd. Add YAML support...

Unbreakable Enterprise kernel-container security update

5.4.17-2102.201.3.el8 - locking/qrwlock: Fix ordering in queuedwritelockslowpath Ali Saidi Orabug: 32805544 5.4.17-2102.201.2.el8 - md/bitmap: wait for external bitmap writes to complete during tear down Sudhakar Panneerselvam Orabug: 32764237 - ocfs2: fix deadlock between setattr and dioendiowri...

Information Leakage Vulnerability in the Built-in Reports of Ren Tian Xing Network Security Management System of Ren Tian Xing Network Technology Co.

Ltd. is the most comprehensive provider of large-scale cyberspace security protection solutions in China. There is an information leakage vulnerability in the built-in reports of Renzihang Network Security Management System of Renzihang Network Technology Co., Ltd, which can be exploited by...