Debian DLA-2663-1 : libimage-exiftool-perl security update

A vulnerability was discovered in libimage-exiftool-perl, a library and program to read and write meta information in multimedia files, which may result in execution of arbitrary code if a malformed DjVu file is processed. For Debian 9 stretch, this problem has been fixed in version 10.40-1+deb9u...

Top Certifications for Network Security Administrators in 2021

By Waqas The demand for security professionals is at its peak like never before. Here are some certifications that will help you polish your skills. This is a post from HackRead.com Read the original post: Top Certifications for Network Security Administrators in 2021...

SUSE SLED15 / SLES15 Security Update : dtc (SUSE-SU-2021:1598-1)

This update for dtc fixes the following issues : make all packaged binaries PIE-executables bsc1184122. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as...

uC/TCP-IP Stack - HTTP Detection

Binary data uctcpipstackhttpdetect.nbin...

CVE-2021-20999

The CVE-2021-20999 issue affects Weidmüller u-controls and IoT-Gateways (versions up to 1.12.1). A network port intended for device-internal use is reachable via external interfaces, enabling manipulation of the device or disruption of operation. The vulnerability is documented with high/critical...

SUSE SLES12 Security Update : xen (SUSE-SU-2021:1580-1)

This update for xen fixes the following issues : A recent systemd update caused a regression in 'xenstored.service' systemd now fails to track units that use systemd-notify. bsc1183790 Add a fix to delay between the call to 'systemd-notify' and the final exit of the wrapper script. bsc1185021,...

SUSE SLED15 / SLES15 Security Update : openvpn (SUSE-SU-2021:1577-1)

This update for openvpn fixes the following issues : CVE-2020-15078: Fixed authentication bypass with deferred authentication bsc1185279. CVE-2020-11810: Fixed race condition between allocating peer-id and initializing data channel key bsc1169925. CVE-2018-7544: Fixed cross-protocol scripting iss...

‘FragAttacks’: Wi-Fi Bugs Affect Millions of Devices

A Belgian security researcher specializing in Wi-Fi bugs has unearthed a clutch of new ones, which he called FragAttacks, that affect the Wi-Fi standard itself. The name is short for “fragmentation and aggregation attacks.” Some bugs date back to 1997, meaning that computers, smartphones or other...

Debian DLA-2654-1 : composer security update

It was discovered that composer, a dependency manager for PHP, did not properly sanitize Mercurial URLs, which could lead to arbitrary code execution. For Debian 9 stretch, this problem has been fixed in version 1.2.2-1+deb9u1. We recommend that you upgrade your composer packages. For the detaile...

CVE-2020-26142

An issue was discovered in the kernel in OpenBSD 6.6. The WEP, WPA, WPA2, and WPA3 implementations treat fragmented frames as full frames. An adversary can abuse this to inject arbitrary network packets, independent of the network configuration...

Design/Logic Flaw

An issue was discovered in the kernel in OpenBSD 6.6. The WEP, WPA, WPA2, and WPA3 implementations treat fragmented frames as full frames. An adversary can abuse this to inject arbitrary network packets, independent of the network configuration...

CVE-2020-26142

CVE-2020-26142 is an OpenBSD kernel issue (OpenBSD 6.6) where the WEP, WPA, WPA2, and WPA3 implementations incorrectly treat fragmented frames as full frames. This misbehavior can allow an adversary to inject arbitrary network packets, independent of network configuration, by abusing fragmented f...

CVE-2020-26140

The CVE-2020-26140 entry is covered in ARISTA Security Advisory 0063, which groups it under the FragAttacks fragmentation/aggregation vulnerabilities. The advisory states that plaintext data frames are accepted on encrypted networks, enabling packet injection. Fixes are provided as platform-speci...

CVE-2020-26140

Removed by vendor...

CVE-2020-26144

CVE-2020-26144 describes that plaintext A-MSDU frames starting with an RFC1042 (LLC/SNAP) header can be accepted on encrypted Wi‑Fi networks, enabling packet injection. The vulnerability is part of the FragAttacks family affecting 802.11 frame aggregation/fragmentation implementations. Connected ...

Siemens Mendix Database Replication Module

1. EXECUTIVE SUMMARY CVSS v3 4.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: Mendix Database Replication Module Vulnerability: Generation of Error Message Containing Sensitive Information 2. RISK EVALUATION Successful exploitation of this vulnerability could...

JetBrains WebStorm 加密问题漏洞

JetBrains WebStorm is an application from the Czech company JetBrains. Provides an IDE for programming. A security vulnerability exists in JetBrains WebStorm versions prior to 2021.1. The vulnerability stems from the program's use of HTTP requests instead of HTTPS.No detailed vulnerability detail...

CVE-2020-24588

The CVE-2020-24588 entry relates to the 802.11 Wi‑Fi fragmentation/ A‑MSDU handling issue where the plaintext QoS header flag isn’t authenticated, enabling an attacker to inject packets by sending non‑SSP A‑MSDU frames (FragAttacks). Connected Astra Linux advisories describe this as a variant of ...

Command Execution Vulnerability in LeadSec NetGuard Security Gateway

Beijing Nethub Information Technology Co., Ltd. was renamed from Lenovo Nethub Technology Beijing Co., Ltd. and its predecessor was the Information Security Division of Lenovo Group. For more than twenty years, Netnifty Nebula insists on being the defender of network security order and adheres to...

Command Execution Vulnerability in NETSYS

Founded in 2004, Shenzhen Domain Technology Co., Ltd. is a national high-tech enterprise specializing in the research and development, production, sales and service of products in the field of network information security. NETSYS has a command execution vulnerability that can be exploited by an...