CVE-2020-25493

The CVE-2020-25493 entry concerns Oclean Mobile Application 2.1.2, which communicates with an external site over HTTP. The vulnerability description states that HTTP payloads are encrypted with a hardcoded XOR key, creating a pathway for potential traffic decoding and eavesdropping. Connected sou...

SUSE SLES15 Security Update : kernel (SUSE-SU-2021:0427-1)

The SUSE Linux Enterprise 15 SP2 realtime kernel was updated to receive various security and bugfixes. The following security bugs were fixed : CVE-2021-3347: A use-after-free was discovered in the PI futexes during fault handling, allowing local users to execute code in the kernel bnc1181349...

CVE-2021-27170

Technical details about CVE-2021-27170 are not publicly provided in the connected documents. Monitor for updates.

SUSE SLES12 Security Update : kernel (SUSE-SU-2021:0348-1)

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes. The following security bugs were fixed : CVE-2021-3347: A use-after-free was discovered in the PI futexes during fault handling, allowing local users to execute code in the kernel bnc1181349...

SUSE SLES12 Security Update : kernel (SUSE-SU-2021:0353-1)

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : CVE-2021-3347: A use-after-free was discovered in the PI futexes during fault handling, allowing local users to execute code in the kernel bnc1181349...

SUSE SLED15 / SLES15 Security Update : java-11-openjdk (SUSE-SU-2021:0352-1)

This update for java-11-openjdk fixes the following issues : java-11-openjdk was upgraded to include January 2021 CPU bsc1181239 Enable Sheandoah GC for x8664 jscECO-3171 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory...

CVE-2021-26676

ConnMan gdhcp flaw (CVE-2021-26676) causes a stack information leak via an uninitialized variable in the gdhcp component, affecting ConnMan versions prior to 1.39. Network-adjacent attackers could leverage the leak to facilitate further exploitation related to bugs in gdhcp. Public advisories (Op...

CVE-2021-26675

CVE-2021-26675 affects ConnMan’s DNS proxy (dnsproxy) prior to version 1.39. It is a stack-based buffer overflow that could allow a network-adjacent attacker to execute arbitrary code, as described across multiple sources (Arch Linux ASA, openSUSE update, Debian DSA/DLA, Gentoo GLSA). The issue i...

CVE-2020-24685

CVE-2020-24685 affects ABB AC500 V2 with onboard Ethernet versions 2.8.4 and earlier. An unauthenticated, specially crafted network packet can cause a denial-of-service by stopping the PLC; after stop, physical access is required to restart the application. Public documents describe the vulnerabi...

Siemens SCALANCE W780 and W740

1. EXECUTIVE SUMMARY CVSS v3 4.3 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: SCALANCE W780 and W740 Vulnerability: Allocation of Resources Without Limits or Throttling 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an...

The vulnerability of the tcpdump tool for capturing and analyzing network traffic in a software-defined Cisco SD-WAN network allows a hacker to elevate their privileges to the root level.

The vulnerability of the tcpdump tool for capturing and analyzing network traffic in a software-defined Cisco SD-WAN network is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to elevate their privileges to the root level...

Email Relaying. A how-to and a reminder

On a recent internal infrastructure test I came across a server that had port 25/TCP open. This is normally the Simple Mail Transfer Protocol SMTP service, and sure enough a quick look confirmed it. Now, such services on an internal network are not unusual. System and network administrators...

EulerOS 2.0 SP9 : openldap (EulerOS-SA-2021-1250)

According to the versions of the openldap packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An integer underflow was discovered in OpenLDAP before 2.4.57 leading to slapd crashes in the Certificate Exact Assertion processing, resultin...

EulerOS 2.0 SP9 : bind (EulerOS-SA-2021-1261)

According to the version of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - In ISC BIND9 versions BIND 9.11.14 - 9.11.19, BIND 9.14.9 - 9.14.12, BIND 9.16.0 - 9.16.3, BIND Supported Preview Edition 9.11.14-S1 - 9.11.19-S1:...

EulerOS 2.0 SP5 : mysql-connector-java (EulerOS-SA-2021-1215)

According to the version of the mysql-connector-java package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - MySQL Connector/J is a native Java driver that converts JDBC Java Database Connectivity calls into the network protocol used by the...

EulerOS 2.0 SP5 : nss (EulerOS-SA-2021-1218)

According to the version of the nss packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - In Network Security Services NSS before 3.36.7 and before 3.41.1, a malformed signature can cause a crash due to a null dereference, resulting in a...

Debian DLA-2543-1 : libdatetime-timezone-perl new upstream version

This update includes the changes in tzdata 2021a for the Perl bindings. For the list of changes, see DLA-2542-1. For Debian 9 stretch, this problem has been fixed in version 1:2.09-1+2021a. We recommend that you upgrade your libdatetime-time zone-perl packages. For the detailed security status of...

EulerOS 2.0 SP5 : openjpeg (EulerOS-SA-2021-1220)

According to the versions of the openjpeg package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An invalid write access was discovered in bin/jp2/convert.c in OpenJPEG 2.2.0, triggering a crash in the tgatoimage function. The vulnerability...

EulerOS 2.0 SP5 : sox (EulerOS-SA-2021-1231)

According to the versions of the sox package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - SoX Sound eXchange is a sound file format converter SoX can convert between many different digitized sound formats and perform simple sound...

CVE-2021-25755

Affected software : JetBrains Code With Me (plugin for IntelliJ IDE). Issue : cryptographic/traffic protection vulnerability where an attacker on the local network, knowing a session ID, could access encrypted traffic. Root cause / details : multiple sources (NVD, Red Hat, CNVD, CVE records) cons...