Debian DLA-2531-1 : python-bottle security update

The package src:python-bottle before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon ;, they can cause a difference in the interpretation of the request between the proxy running with...

openSUSE Security Update : slurm_18_08 (openSUSE-2020-2286)

This update for slurm1808 fixes the following issues : Security issues fixed : - CVE-2020-27745: Fixed a potential buffer overflow from use of unpackmem bsc1178890. - CVE-2020-27746: Fixed a potential leak of the magic cookie when sent as an argument to the xauth command bsc1178891. This update w...

Skyworth Home Gateway Smart Terminal DT541-csg suffers from Denial of Service Vulnerability (CNVD-2021-10398)

hereinafter referred to as "Skyworth Digital" is a national high-tech enterprise focusing on providing comprehensive and systematic digital home solutions and services for global users. A denial of service vulnerability exists in the Skyworth Home Gateway Smart Terminal DT541-csg, which can be...

Blue Cedar partners with Microsoft to combat BYOD issues

This blog post is part of the Microsoft Intelligent Security Association guest blog series. Learn more about MISA. Bring Your Own Device BYOD has been a divisive topic within corporations for years. Employees wanted the convenience of working on their own smart devices, and business decision-make...

Unified Vulnerability View of Unauthenticated and Agent Scans

Vulnerability scanning has evolved significantly over the past few decades. But the key goal remains the same, which is to accurately identify vulnerabilities, assess the risk, prioritize them, and finally remediate them before they get exploited by an attacker. Therein lies the challenge. It is...

Weak Password Vulnerability in Tianrongxin Intrusion Prevention System

TIANRONGXIN Intrusion Prevention System hereinafter referred to as TopIDP product is a network security protection product that defends against all kinds of attack threats in the network and protects customers' network IT service resources in real time. There is a weak password vulnerability in...

Cisco Data Center Network Manager Certificate Validation Vulnerability (CNVD-2021-09939)

Cisco Data Center Network Manager DCNM is a suite of data center network managers from Cisco that provides multiprotocol management of the network and troubleshooting of switch operating conditions and performance. A certificate validation vulnerability exists in Cisco Data Center Network Manager...

CVE-2021-1286

CVE-2021-1286 affects Cisco Data Center Network Manager (DCNM) – the web-based management interface is vulnerable to cross-site scripting (XSS) and a reflected file download (RFD) when accessed by an authenticated network-operator. The root cause is insufficient input validation in the DCNM web i...

CVE-2020-25686

CVE-2020-25686 affects dnsmasq prior to version 2.83. The flaw: when receiving a query, dnsmasq does not check for an existing pending request for the same name and forwards a new one, allowing up to 150 outstanding queries and enabling an off-path attacker to substantially reduce the work needed...

CVE-2021-2101

Oracle E-Business Suite — One-to-One Fulfillment Print Server vulnerability (CVE-2021-2101) affects 12.1.1–12.1.3 and 12.2.3–12.2.10. An unauthenticated attacker with HTTP access can compromise data and gain unauthorized access. CVSS 3.1 base score 9.1 (C/H, I/H). Remediation: Oracle CPU Jan 2021...

CVE-2021-2083

CVE-2021-2083 affects Oracle E-Business Suite iSupport (component: User Responsibilities). Affected versions are 12.1.1–12.1.3 and 12.2.3–12.2.10. The vulnerability allows unauthenticated, network-accessible attacks over HTTP that require a user interaction (UI:R), potentially leading to unauthor...

CVE-2021-2077

CVE-2021-2077 affects Oracle E-Business Suite’s Oracle iStore (Shopping Cart). Affected versions are 12.1.1–12.1.3 and 12.2.3–12.2.10. It is an easily exploitable, unauthenticated remote vulnerability over HTTP that requires user interaction to exploit and can lead to unauthorized access to sensi...

SUSE SLES12 Security Update : kernel (SUSE-SU-2021:0133-1)

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : CVE-2020-28374: Fixed a LIO security issue bsc1178372. CVE-2020-36158: Fixed a potential remote code execution in the Marvell mwifiex driver bsc1180559...

EulerOS 2.0 SP3 : nss (EulerOS-SA-2021-1102)

According to the versions of the nss packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In Network Security Services NSS before 3.36.7 and before 3.41.1, a malformed signature can cause a crash due to a null dereference, resulting in a...

EulerOS 2.0 SP3 : iscsi-initiator-utils (EulerOS-SA-2021-1076)

According to the versions of the iscsi-initiator-utils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in Contiki through 3.0. An Out-of-Bounds Read vulnerability exists in the uIP TCP/IP Stack component when...

Solaris 10 (sparc) : 152643-10

SunOS 5.10: Apache 2.4 Patch. Date this patch was last updated by Sun : Jan/18/21 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include"compat.inc"; if description scriptid145191; scriptversion"1.1";...

EulerOS 2.0 SP3 : python-ipaddress (EulerOS-SA-2021-1115)

According to the version of the python-ipaddress package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow...

EulerOS 2.0 SP3 : squid (EulerOS-SA-2021-1123)

According to the versions of the squid packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A Request Smuggling and Poisoning attack c...

SUSE SLES12 Security Update : dnsmasq (SUSE-SU-2021:0166-1)

This update for dnsmasq fixes the following issues : bsc1177077: Fixed DNSpooq vulnerabilities CVE-2020-25684, CVE-2020-25685, CVE-2020-25686: Fixed multiple Cache Poisoning attacks. CVE-2020-25681, CVE-2020-25682, CVE-2020-25683, CVE-2020-25687: Fixed multiple potential Heap-based overflows when...

Denial of Service Vulnerability in TP-Link TL-R489GP-AC

TL-R489GP-AC is a PoE-AC all-in-one VPN router product developed by TP-LINK for environments such as small and micro businesses, offices and villas. A denial of service vulnerability exists in the TP-Link TL-R489GP-AC. An attacker can exploit the vulnerability to cause a denial of service to the...