[SECURITY] [DLA 2736-1] lynx security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2736-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb August 09, 2021 https://wiki.debian.org/LTS -...

Shopify: EC2 Takeover at turn.shopify.com

Summary Hi team, It seems that the domain turn.shopify.com pointed to an EC2 instance that was terminated and the DNS record wasn't updated. We managed to register a new EC2 instance with the IP that turn.shopify.com points to: Command dig turn.shopify.com ; DiG 9.11.3-1ubuntu1.13-Ubuntu...

Information Leakage Vulnerability in SSL VPN of Beijing NetGalaxy Information Technology Co.

Beijing Nethub Information Technology Co., Ltd. was renamed from Lenovo Nethub Technology Beijing Co., Ltd. and its business covers network border security protection, application and data security protection, network-wide security risk management, professional security solutions and professional...

EulerOS 2.0 SP8 : curl (EulerOS-SA-2021-2290)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - curl 7.7 through 7.76.1 suffers from an information disclosure when the -t command line option, known as CURLOPTTELNETOPTIONS in libcurl, is used ...

Palo Alto Software: DNS Miconfiguration Leads to Subdomain Takeover - max1.liveplan.com

Summary The issue happens due to using EC2 public DNS instead of using Elastic IPs as CNAME record. This report is simliar to report 1069795 Misconfiguration - DNS Records json "host": "max1.liveplan.com", "resolver": "1.0.0.1:53" , "a": "54.68.121.128" , "cname":...

lynx -- SSL certificate validation error

Axel Beckert reports: ... I was able to capture the password given on the commandline in traffic of an TLS handshake using tcpdump and analysing it with Wireshark:...

CVE-2021-32581

Acronis True Image prior to 2021 Update 4 for Windows, Acronis True Image prior to 2021 Update 5 for Mac, Acronis Agent prior to build 26653, Acronis Cyber Protect prior to build 27009 did not implement SSL certificate validation...

Input validation

Acronis True Image prior to 2021 Update 4 for Windows, Acronis True Image prior to 2021 Update 5 for Mac, Acronis Agent prior to build 26653, Acronis Cyber Protect prior to build 27009 did not implement SSL certificate validation...

CVE-2021-32581

Acronis True Image prior to 2021 Update 4 for Windows, Acronis True Image prior to 2021 Update 5 for Mac, Acronis Agent prior to build 26653, Acronis Cyber Protect prior to build 27009 did not implement SSL certificate validation...

CVE-2021-32581

CVE-2021-32581 affects multiple Acronis products: Acronis True Image for Windows (before 2021 Update 4) and macOS (before 2021 Update 5), Acronis Agent (before build 26653), and Acronis Cyber Protect (before build 27009). The underlying issue is failure to implement SSL certificate validation, le...

Acronis True Image 信任管理问题漏洞

Acronis True Image is a famous data backup and restore software from Acronis Singapore. The software can be used to create drive and disk images and can restore the image when a clean system is needed. Acronis True Image based on Windows platform 2021 Update 4 and earlier versions, Acronis True...

SharpLAPS - Retrieve LAPS Password From LDAP

The attribute ms-mcs-AdmPwd stores the clear-text LAPS password. This executable is made to be executed within Cobalt Strike session using execute-assembly. It will retrieve the LAPS password from the Active Directory. Require either: Account with ExtendedRight or Generic All Rights Domain Admin...

[SECURITY] Fedora 33 Update: mbedtls-2.16.11-1.fc33

Mbed TLS is a light-weight open source cryptographic and SSL/TLS library written in C. Mbed TLS makes it easy for developers to include cryptographic and SSL/TLS capabilities in their embedded applications with as little hassle as possible. FOSS License Exception:...

[SECURITY] Fedora 34 Update: mbedtls-2.16.11-1.fc34

Mbed TLS is a light-weight open source cryptographic and SSL/TLS library written in C. Mbed TLS makes it easy for developers to include cryptographic and SSL/TLS capabilities in their embedded applications with as little hassle as possible. FOSS License Exception:...

Fedora: Security Advisory for mbedtls (FEDORA-2021-165969af24)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Open Redirect in erudika/scoold

✍️ Description There is an open redirect vulnerability in the following URL: https://live.scoold.com/signin?returnto=https://google.com 🕵️‍♂️ Proof of Concept Step to reproduce 1. open above URL 2. login in the applicaiton 3. you redirect to google.com 💥 Impact That causes a redirection to an...

Security Bulletin: Potential vulnerability in OpenSSL

Summary A potential vulnerability has been identified related to OpenSSL. Refer to details for additional information. Vulnerability Details CVEID: CVE-2021-3449 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference in signaturealgorithms processing. By...

Security Bulletin: Vulnerabilities in the Python, Python cryptography , and Urllib3 affect IBM Spectrum Discover.

Summary Vulnerabilities in Python, Python cryptography , and Urllib3 such as buffering problems, SSL certificate validations for HTTP & HTTPS, Bleichenbacher timing attacks in the RSA decryption API, may affect IBM Spectrum Discover. Vulnerability Details CVEID: CVE-2020-36242 DESCRIPTION:...

Error: "SSL Error 61: You have not chosen to trust Certificate Authority.." with Online Plug-in

Error: "SSL Error 61: You have not chosen to trust 'Certificate Authority'..." When Launching Apps with Citrix Online Plug-in Users may be unable to launch apps with the Citrix Online Plug-in. The following error message appears: "Unable to launch your application. Contact your Helpdesk with the...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.8.2 bug fix and security update

Red Hat OpenShift Container Platform release 4.8.2 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.8. Red Hat Product Security has rated this update as having a...