[SECURITY] Fedora 34 Update: openssh-8.5p1-2.fc34

SSH Secure SHell is a program for logging into and executing commands on a remote machine. SSH is intended to replace rlogin and rsh, and to provide secure encrypted communications between two untrusted hosts over an insecure network. X11 connections and arbitrary TCP/IP ports can also be forward...

Security Updates for Microsoft Office (March 2021) (macOS)

The Microsoft Office product installed on the remote host is missing security updates. It is, therefore, affected by multiple remote code execution vulnerabilities in Excel. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version numbe...

360 SkyEye traffic sensor has information leakage vulnerability

Ltd. is a company that focuses on the cyberspace security market and provides a new generation of enterprise-class network security products and services to government and corporate users. 360 SkyEye Traffic Sensor has an information leakage vulnerability that can be exploited by attackers to...

CVE-2021-27506

The ClamAV Engine version 0.103.1 and below component embedded in Storsmshield Network Security SNS is subject to DoS in case of parsing of malformed png files. This affect Netasq versions 9.1.0 to 9.1.11 and SNS versions 1.0.0 to 4.2.0. This issue is fixed in SNS 3.7.19, 3.11.7 and 4.2.1...

CVE-2021-27506

The ClamAV Engine version 0.103.1 and below component embedded in Storsmshield Network Security SNS is subject to DoS in case of parsing of malformed png files. This affect Netasq versions 9.1.0 to 9.1.11 and SNS versions 1.0.0 to 4.2.0. This issue is fixed in SNS 3.7.19, 3.11.7 and 4.2.1...

Code injection

The ClamAV Engine version 0.103.1 and below component embedded in Storsmshield Network Security SNS is subject to DoS in case of parsing of malformed png files. This affect Netasq versions 9.1.0 to 9.1.11 and SNS versions 1.0.0 to 4.2.0. This issue is fixed in SNS 3.7.19, 3.11.7 and 4.2.1...

CVE-2021-27506

The ClamAV Engine version 0.103.1 and below component embedded in Storsmshield Network Security SNS is subject to DoS in case of parsing of malformed png files. This affect Netasq versions 9.1.0 to 9.1.11 and SNS versions 1.0.0 to 4.2.0. This issue is fixed in SNS 3.7.19, 3.11.7 and 4.2.1...

CVE-2021-27506

The CVE-2021-27506 issue affects the ClamAV Engine (version 0.103.1 and below) embedded in Stormshield SNS (and Netasq lineage). The root cause is DoS upon parsing malformed PNG files, causing the ClamAV service to crash. Impacted products/versions are Netasq 9.1.0–9.1.11 and Stormshield SNS 1.0....

JVN#37607293: Fuji Xerox multifunction devices and printers vulnerable to denial-of-service (DoS)

Multifunction devices and printers provided by Fuji Xerox Co.,Ltd. contain a denial-of-service DoS vulnerability. Impact An attacker may cause the products to be terminated by sending a specially crafted command. In order to restart the products, the physical power button on the devices must be...

Cisco Plugs Security Hole in Small Business Routers

A popular line of small business routers made by Cisco Systems are vulnerable to a high-severity vulnerability. If exploited, the flaw could allow a remote – albeit authenticated – attacker to execute code or restart affected devices unexpectedly. Cisco issued fixes on Wednesday for the flaw in i...

SUSE SLES12 Security Update : glib2 (SUSE-SU-2021:0801-1)

This update for glib2 fixes the following issues : CVE-2021-27218: gbytearraynewtake takes a gsize as length but stores in a guint, this patch will refuse if the length is larger than guint. bsc1182328 CVE-2021-27219: gmemdup takes a guint as parameter and sometimes leads into an integer overflow...

nss: Use-after-free in sftk_FreeSession due to improper refcounting

A use-after-free flaw was found in Mozilla Network Security Services NSS related to PK11 session handling. An attacker could use this flaw to execute arbitrary code with the permissions of the user running the application compiled with NSS...

nss: Check length of inputs for cryptographic primitives

A vulnerability was discovered in nss where input text length was not checked when using certain cryptographic primitives. This could lead to a heap-buffer overflow resulting in a crash and data leak. The highest threat is to confidentiality and integrity of data as well as system availability...

Debian DLA-2596-1 : shadow security update

Several vulnerabilities were discovered in the shadow suite of login tools. An attacker may escalate privileges in specific configurations. CVE-2017-20002 Shadow incorrectly lists pts/0 and pts/1 as physical terminals in /etc/securetty. This allows local users to login as password-less users even...

Unauthorized Access Vulnerability in Huagu Internet Behavior Management and Auditing System

Ltd. is a high-tech company specializing in the research and development, sales and service of network security products. An unauthorized access vulnerability exists in Huayu Internet Behavior Management and Audit System. Attackers can utilize the vulnerability to obtain sensitive information...

Weak Password Vulnerability in NetSense SecADS 3600 Application Delivery System

NetShen SecADS 3600 Application Delivery System is a product launched for customers in industries such as government, enterprises, education, carriers, and IDC data centers, which is able to solve the problems caused by insufficient server processing power, WAN link bandwidth unable to meet...

Out of cyber class. Maritime compliance.

Ships classification societies have a key role to play in the International Maritime Organisations cyber security requirements. Based on our experience to date, there are some significant issues coming that maritime insurers need to be aware of before writing cover for any vessel that includes...

SUSE SLED15 / SLES15 Security Update : glib2 (SUSE-SU-2021:0778-1)

This update for glib2 fixes the following issues : CVE-2021-27218: gbytearraynewtake takes a gsize as length but stores in a guint, this patch will refuse if the length is larger than guint. bsc1182328 CVE-2021-27219: gmemdup takes a guint as parameter and sometimes leads into an integer overflow...

Weak Password Vulnerability in Huagu Internet Behavior Management System

Ltd. is a high-tech company specializing in the research and development, sales and service of network security products. There is a weak password vulnerability in Huayu Internet Behavior Management System, which can be exploited by attackers to obtain sensitive information...

Weak Password Vulnerability in Various Firewall Products of Shanshi Netcom

Shanshi Netcom is a technology innovation leader in China's network security industry, and in September 2019, it landed on the Science and Technology Innovation Board stock abbreviation: Shanshi Netcom, stock code: 688030. Since its inception, it has been focusing on the innovation of cutting-edg...