perl-IO-Socket-SSL:2.066 and perl-libwww-perl:6.34 update

An update is available for perl-IO-HTML, perl-LWP-MediaTypes, perl-Data-Dump, perl-Net-HTTP, perl-HTTP-Message, perl-Try-Tiny, perl-Digest-HMAC, perl-HTML-Parser, perl-NTLM, perl-Mozilla-CA, perl-IO-Socket-SSL, perl-libwww-perl, perl-Encode-Locale, perl-HTTP-Negotiate, perl-File-Listing,...

perl-IO-Socket-SSL:2.066 and perl-libwww-perl:6.34 update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

Moderate: qt5-qtbase and qt5-qtwebsockets security and bug fix update

Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. Security Fixes: qt: XML entity expansion vulnerability CVE-2015-9541 qt5-qtwebsockets: websocket implementation allows only limited size for frames and...

ALSA-2020:4690 Moderate: qt5-qtbase and qt5-qtwebsockets security and bug fix update

Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. Security Fixes: qt: XML entity expansion vulnerability CVE-2015-9541 qt5-qtwebsockets: websocket implementation allows only limited size for frames and...

U.S. Dept Of Defense: Apparent ██████████ website is publicly exposed, suggests default account details on page and has expired SSL/TLS cert

Summary: Publicly exposed website ███████ offering default login user/pass with expired SSL Description: https://██████/ is branded as '████' with ██████ branding/logo and links to ██████ homepage, defense.gov & @DeptofDefense Twitter account Impact Publicly exposed service with potentially defau...

Exploit for CVE-2020-14882

CVE-2020-14882 checker CVE-2020-14882 detection script This...

Basecamp: SSL expired subdomain leads to API swap with main and flagged cookies. Unable to log device ids and certain session tokens.

SUMMARY - Replacing the login page of launchpad.37signals.com with subdomain help-basecamphq.37signals.com greats you to a login page in which is unsecure and with header sec-fetch-site: same-origin injected into your headers you can disable cookies such as . STEPS TO REPRODUCE 1. Visit...

Cisco Firepower Threat Defense Software SSL Input Validation DoS (cisco-sa-ftd-ssl-mf3822Z)

According to its self-reported version, Cisco Firepower Threat Defense Software is affected by a denial of service DoS vulnerability in its sslinspection component due to insuffient user input validation. An unauthenticated, remote attacker can exploit this issue, by sending malformed TLS packets...

Texas Gold-Dealer Mined for Payment Details in Months-Long Data Breach

A popular precious-metals dealer, JM Bullion, has been the victim of a payment-skimmer attack. The company’s response was less than solid gold — it took months to notify its users of the breach. The Dallas-based company sells gold, platinum, silver, copper and palladium bullion, in the form of...

Oracle Fusion Middleware Oracle HTTP Server (Oct 2020 CPU)

The version of Oracle HTTP Server installed on the remote host is affected by the following vulnerabilities as referenced in the October 2020 CPU advisory: - A denial of service DoS vulnerability exists in the SSL Module OpenSSL. An unauthenticated, remote attacker with network access via HTTPS,...

F5 BIG-IP SSL Communication Handling Denial of Service Vulnerability

F5 BIG-IP is an application delivery platform that integrates network traffic management, application security management, and load balancing. A security vulnerability exists in the processing of F5 BIG-IP SSL communications, which can be exploited by remote attackers to submit a special request...

CVE-2020-5936

On BIG-IP LTM 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, and 12.1.0-12.1.5.1, the Traffic Management Microkernel TMM process may consume excessive resources when processing SSL traffic and client authentication are enabled on the client SSL profile...

Authentication flaw

On BIG-IP LTM 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, and 12.1.0-12.1.5.1, the Traffic Management Microkernel TMM process may consume excessive resources when processing SSL traffic and client authentication are enabled on the client SSL profile...

CVE-2020-5936

On BIG-IP LTM 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, and 12.1.0-12.1.5.1, the Traffic Management Microkernel TMM process may consume excessive resources when processing SSL traffic and client authentication are enabled on the client SSL profile...

CVE-2020-5936

On BIG-IP LTM 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, and 12.1.0-12.1.5.1, the Traffic Management Microkernel TMM process may consume excessive resources when processing SSL traffic and client authentication are enabled on the client SSL profile...

CVE-2020-5936

The CVE-2020-5936 issue affects BIG-IP LTM Traffic Management Microkernel (TMM) when SSL traffic with client authentication is processed in the client SSL profile. Affected versions (BIG-IP LTM): 15.1.0–15.1.0.5, 14.1.0–14.1.2, 13.1.0–13.1.3.4, 12.1.0–12.1.5.1. Root cause: TMM may consume excessi...

CVE-2020-25680

A flaw was found in JBCS httpd in version 2.4.37 SP3, where it uses a back-end worker SSL certificate with the keystore file's ID is 'unknown'. The validation of the certificate whether CN and hostname are matching stopped working and allow connecting to the back-end work. The highest threat from...

F5 Networks BIG-IP : BIG-IP Client SSL Security Advisory (K44020030)

The Traffic Management Microkernel TMM process may consume excessive resources when processing SSL traffic and client authentication are enabled on the client SSL profile. Impact TMM memory may eventually become exhausted and may result in the system producing a core file. The BIG-IP system may...

Man-in-the-Middle (MitM)

puppet-agent is vulnerable to man-in-the-middle attack. The Puppet Agent does not properly verify the SSL connection when downloading a CRL...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.6.1 image security update

An update is now available for Red Hat OpenShift Container Platform 4.6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...