5859 matches found
October Release: Q&A with Ari Weil
Shortly after Akamai announced the October 2019 Release with new features and capabilities across its security, performance and media product lines, Akamai's VP of Product Marketing, Ari Weil, took over Akamai's Twitter account for a live October Release Q&A. For those that missed the live event,...
httpd: URL normalization inconsistency
A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multiple consecutive slashes '/', directives such as LocationMatch and RewriteRule must account for duplicates in regular expressions while other aspects of the servers processing wi...
CVE-2017-2636
A race condition flaw was found in the NHLDC Linux kernel driver when accessing nhdlc.tbuf list that can lead to double free. A local, unprivileged user able to set the HDLC line discipline on the tty device could use this flaw to increase their privileges on the system. Mitigation The nhdlc kern...
Gosec - Golang Security Checker
Inspects source code for security problems by scanning the Go AST. Install CI Installation binary will be $GOPATH/bin/gosec curl -sfL https://raw.githubusercontent.com/securego/gosec/master/install.sh | sh -s -- -b $GOPATH/bin vX.Y.Z or install it into ./bin/ curl -sfL...
Important: Red Hat Security Advisory: Red Hat Decision Manager 7.5.0 Security Update
An update is now available for Red Hat Decision Manager. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links i...
Vulnerability Spotlight: Denial-of-service in VMWare Fusion 11
Piotr Bania of Cisco Talos discovered this vulnerability. Executive summary VMware Fusion 11 contains an exploitable denial-of-service vulnerability. VMWare Fusion is an application for Mac operating systems that allows users to run other OSs in a virtual environment, such as Windows and Linux. A...
Linux kernel memory corruption vulnerability (CNVD-2019-37726)
Linux kernel is the kernel used by Linux, the open source operating system released by the Linux Foundation in the United States. A memory corruption vulnerability exists in the 'fib6rulesuppress' function of the net/ipv6/fib6rules.c file in versions of Linux kernel prior to 5.3.4, which can be...
Vulnerability Spotlight: Another fix for Adobe Acrobat Reader DC text field value remote code execution
Aleksandar Nikolic of Cisco Talos discovered this vulnerability. Cisco Talos once again would like to bring attention to a remote code execution vulnerability in Adobe Acrobat Reader. Acrobat, which is one of the most popular PDF readers on the market, contains a bug when the software incorrectly...
CVE-2019-17532
An issue was discovered on Belkin Wemo Switch 28B WW2.00.11057.PVT-OWRT-SNS devices. They allow remote attackers to cause a denial of service persistent rules-processing outage via a crafted ruleDbBody element in a StoreRules request to the upnp/control/rules1 URI, because database corruption...
CVE-2019-17532
An issue was discovered on Belkin Wemo Switch 28B WW2.00.11057.PVT-OWRT-SNS devices. They allow remote attackers to cause a denial of service persistent rules-processing outage via a crafted ruleDbBody element in a StoreRules request to the upnp/control/rules1 URI, because database corruption...
CVE-2019-17197
OpenEMR through 5.0.2 has SQL Injection in the Lifestyle demographic filter criteria in library/clinicalrules.php that affects library/patient.inc...
CVE-2019-17197
OpenEMR through 5.0.2 has SQL Injection in the Lifestyle demographic filter criteria in library/clinicalrules.php that affects library/patient.inc...
The vulnerability of the fly-admin-local-se component in the FLY operating system of the Astra Linux platform allows a attacker to compromise data integrity, gain unauthorized access to protected information, and cause service interruptions.
The vulnerability of the fly-admin-local-se component in the FLY operating system of Astra Linux is related to logging errors when changing user privileges, as well as errors in creating rules for devices with the same name. Exploiting this vulnerability can allow attackers to compromise data...
Terraform AWS Secure Baseline - Terraform Module To Set Up Your AWS Account With The Secure Baseline Configuration Based On CIS Amazon Web Services Foundations
Terraform Module Registry A terraform module to set up your AWS account with the reasonably secure configuration baseline. Most configurations are based on CIS Amazon Web Services Foundations v1.2.0. See Benchmark Compliance to check which items in CIS benchmark are covered. Starting from v0.10.0...
Vulnerability Spotlight: Foxit PDF Reader JavaScript Array.includes remote code execution vulnerability
Aleksandar Nikolic of Cisco Talos discovered this vulnerability. Foxit PDF Reader contains a remote code execution vulnerability in its JavaScript engine. Foxit aims to be one of the most feature-rich PDF readers on the market, and contains many similar functions to that of Adobe Acrobat Reader...
Roblox: Insecure redirect rule results in bypassing ban redirect on certain pages
Description Account bans on Roblox work via redirect rules. If an user attempts go to a page that's outside a whitelisted set of rules, they'll be redirected back to the ban page. After researching, I've found that the following rules are whitelisted and bypass this redirect: - Any URLs ending in...
Traffic of any type doesn't pass through SDWAN Firewall
Traffic is sent from Zone A to Zone B. Firewall Policy Policy Ais configured to ALLOW 10.10.10.x IP source to Any destination with Highest Priority. Another Firewall policy Policy Bis set to DENY from Any source to Any destination with Least priority. Issue is that the Traffic always hits the Den...
CVE-2019-10410
Jenkins Log Parser Plugin 2.0 and earlier did not escape an error message, resulting in a cross-site scripting vulnerability exploitable by users able to define log parsing rules...
Cross site scripting
Jenkins Log Parser Plugin 2.0 and earlier did not escape an error message, resulting in a cross-site scripting vulnerability exploitable by users able to define log parsing rules...