CVE-2020-36517

An information leak in Nabu Casa Home Assistant Operating System and Home Assistant Supervised 2022.03 allows a DNS operator to gain knowledge about internal network resources via the hardcoded DNS resolver configuration...

Will Russian Oil Ban Spur Increased Cyber-Attacks

President Biden banned the sale of Russian oil to the United States to deprive the Putin regime of the economic resources needed to wage war. But this may put US companies in the firing line of cyber-attacks from the east...

DEBIAN-CVE-2022-24715

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Authenticated users, with access to the configuration, can create SSH resource files in unintended directories, leading to the execution of arbitrary code. This issue has been resolved in versions 2.8.6...

March 8, 2022—KB5011560 (Security-only update)

None None...

Google Go memory consumption vulnerability

Google Go is a development language of Google, Inc. Google Go memory consumption vulnerability, which originates from regexp. The compilation process may deplete stack resources through deeply nested expressions, which can be exploited by attackers to consume system resources...

CVE-2020-36517

CVE-2020-36517 concerns an information leak in Nabu Casa Home Assistant Operating System and Home Assistant Supervised 2022.03. The vulnerability arises from a hardcoded DNS resolver configuration, which may allow a DNS operator to gain knowledge about internal network resources. The connected do...

CVE-2020-36517

An information leak in Nabu Casa Home Assistant Operating System and Home Assistant Supervised 2022.03 allows a DNS operator to gain knowledge about internal network resources via the hardcoded DNS resolver configuration...

CVE-2021-43954

The DefaultRepositoryAdminService class in Fisheye and Crucible before version 4.8.9 allowed remote attackers, who have 'can add repository permission', to enumerate the existence of internal network and filesystem resources via a Server-Side Request Forgery SSRF vulnerability...

Improper Input Validation and Allocation of Resources Without Limits or Throttling in poi-scratchpad

A shortcoming in the HMEF package of poi-scratchpad Apache POI allows an attacker to cause an Out of Memory exception. This package is used to read TNEF files Microsoft Outlook and Microsoft Exchange Server. If an application uses poi-scratchpad to parse TNEF files and the application allows...

HCL BigFix Insights 安全漏洞

HCL BigFix Insights is HCL India's accelerates risk identification and decision making through elevated views of endpoint queue data, rich reporting and integration with existing business intelligence tools. HCL BigFix Insights has a security vulnerability that stems from the application storing...

Directory Traversal

github.com/claudiodangelis/qrcp, is vulnerable to directory traversal. The vulnerability exists due to a lack of sanitization in the receive mode allowing an attacker to access unauthorized resources via file name...

Cyber threat activity in Ukraine: analysis and resources

UPDATE 02 MAR 2022: See Updated malware details and Microsoft security product detections below for additional insights and protections specific to the evolving threats we have identified impacting organizations with ties to Ukraine. Microsoft has been monitoring escalating cyber activity in...

Information Disclosure

intel-microcode is vulnerable to information disclosure. The vulnerability exists due to the improper initialization of shared resources in some IntelR Processors, allowing an attacker to gain sensitive information via local access...

CVE-2021-40046

PCManager versions 11.1.1.95 has a privilege escalation vulnerability. Successful exploit could allow the attacker to access certain resource beyond its privilege...

Security Bulletin: Libxml2 vulnerabilities in Network Intrusion Prevention System (CVE-2014-0191, CVE-2013-2877, CVE-2014-3660, CVE-2013-5211)

Summary Security vulnerabilities have been discovered in the libxml2 component of IBM Security Network Intrusion Prevention System. Vulnerability Details CVEID: CVE-2014-0191 DESCRIPTION: Libxml2 is vulnerable to a denial of service, caused by the expansion of internal entities within the...

Security Bulletin: Potential denial of service in WebSphere Application Server Admin Console affects IBM Spectrum Control (formerly Tivoli Storage Productivity Center) (CVE-2019-4080)

Summary There is a potential denial of service in WebSphere Application Server Admin Console which affects IBM Spectrum Control formerly Tivoli Storage Productivity Center. Vulnerability Details CVEID: CVE-2019-4080 DESCRIPTION: IBM WebSphere Application Server Admin Console is vulnerable to a...

openSUSE 15 Security Update : xerces-j2 (openSUSE-SU-2022:0500-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2022:0500-1 advisory. - There's a vulnerability within the Apache Xerces Java XercesJ XML parser when handling specially crafted XML document payloads. This causes, the...

Google Cloud Service Account Private Key Disclosure

Google Cloud resources access control is managed through the Identify and Access Management IAM feature which helps defining the different roles and permissions available to authenticated principals. Principals include Google accounts for end users and service accounts which purpose is to be used...

CVE-2021-3557

A flaw was found in argocd. Any unprivileged user is able to deploy argocd in their namespace and with the created ServiceAccount argocd-argocd-server, the unprivileged user is able to read all resources of the cluster including all secrets which might enable privilege escalations. The highest...

CVE-2021-3557

A flaw was found in argocd. Any unprivileged user is able to deploy argocd in their namespace and with the created ServiceAccount argocd-argocd-server, the unprivileged user is able to read all resources of the cluster including all secrets which might enable privilege escalations. The highest...