EulerOS 2.0 SP5 : pki-core (EulerOS-SA-2020-2560)

According to the versions of the pki-core packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A vulnerability was found in all pki-core 10.x.x versions, where the Key Recovery Authority KRA Agent Service did not properly sanitize recove...

Fedora 33 : curl (2020-ceaf490686)

curl: Inferior OCSP verification CVE-2020-8286 - libcurl: FTP wildcard stack overflow CVE-2020-8285 - curl: trusting FTP PASV responses CVE-2020-8284 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has...

Virtuozzo 7 : wget (VZLSA-2019-1228)

An update for wget is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

Virtuozzo 7 : http-parser / http-parser-devel (VZLSA-2019-2258)

An update for http-parser is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

Mozilla Firefox < 84.0

The version of Firefox installed on the remote Windows host is prior to 84.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-54 advisory. - The lifecycle of IPC Actors allows managed actors to outlive their manager actors; and the former must ensure that they...

Zilliqa: Using gossip to drain miner wallets

Summary: Using a flaw in the gossip protocol, a malicious shard member can trick any other fellow shard member into signing an arbitrary message. One way this can be exploited is by creating a transaction transferring funds from the account corresponding to a target node's public key; having the...

CVE-2020-25235

Siemens LOGO! 8 BM (incl. SIPLUS variants) is affected by CVE-2020-25235 in all versions prior to 8.3. The vulnerability, categorized as Insufficiently Protected Credentials (CWE-522), allows an attacker with network access to derive valid logins because the authentication password used for the L...

CVE-2019-19287

Siemens XHQ Operations Intelligence prior to version 6.1 contains a relative path traversal vulnerability in the web interface that could allow an unauthenticated remote attacker to traverse the server file system by sending specially crafted packets over the network. Affected: XHQ, all versions

CVE-2020-8169

CVE-2020-8169 affects curl/libcurl 7.62.0–7.70.0. Root cause: libcurl could be tricked into prepending part of a password to the host name before DNS resolution, potentially leaking a partial password over the network and to DNS servers. Impact: information disclosure of partial credentials. Affe...

Code injection

GE Healthcare Imaging and Ultrasound Products may allow specific credentials to be exposed during transport over the network...

U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise

Communications at the U.S. Treasury and Commerce Departments were reportedly compromised by a supply chain attack on SolarWinds, a security vendor that helps the federal government and a range of Fortune 500 companies monitor the health of their IT networks. Given the breadth of the companys...

CVE-2020-25179

CVE-2020-25179 affects GE Healthcare Imaging and Ultrasound Products. The issue involves unprotected transport of credentials and exposure of sensitive system information to an unauthorized control sphere, enabling credential exposure during network transport. Impact described in ICS advisory inc...

Customer Guidance on Recent Nation-State Cyber Attacks

Note: we are updating as the investigation continues. Revision history listed at the bottom. This post contains technical details about the methods of the actor we believe was involved in Recent Nation-State Cyber Attacks, with the goal to enable the broader security community to hunt for activit...

Fedora 32 : libslirp (2020-331e1318dd)

Fix CVE-2020-29129 CVE-2020-29130 out-of-bounds access while processing ARP/NCSI packets Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible...

EulerOS 2.0 SP8 : squid (EulerOS-SA-2020-2534)

According to the versions of the squid package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Squid before 4.9, when certain web browsers are used, mishandles HTML in the host aka hostname parameter to cachemgr.cgi.CVE-2019-18860 - An issue...

Fedora 33 : 1:nodejs (2020-43d5a372fc)

Update to 14.15.1 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network Security, Inc...

CVE-2020-13986

CVE-2020-13986 affects Contiki (through v3.0) with an infinite loop in the uIP TCP/IP stack when processing IPv6 RPL extension headers in net/rpl/rpl-ext-header.c (rpl_remove_header). This is a memory/loop vulnerability in the uIP stack used by Contiki and related ports (e.g., Contiki-NG, PicoTCP...

CVE-2020-5948 — F5 TMUI XSS vulnerability

On BIG-IP versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of the BIG-IP system if the victim user is granted the...

Fedora 32 : pam (2020-bd83344365)

fix CVE-2020-27780: authentication bypass when the user doesn't exist Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Debian DLA-2489-1 : minidlna security update

It was discovered that missing input validation in minidlna, a lightweight DLNA/UPnP-AV server could result in the execution of arbitrary code. In addition minidlna was susceptible to the 'CallStranger' UPnP vulnerability. For Debian 9 stretch, these problems have been fixed in version...