HPESBHF03932 rev.2 - HPE Products using certain Intel UEFI Reference Code, Local Escalation of Privilege, Denial of Service Vulnerabilities

Potential Security Impact: Local: Denial of Service DoS, Escalation of Privilege SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE ProLiant DL360 Gen10 Server Firmware prior to 2.04 04/18/2019 HPE ProLiant DL160 Gen10 Server Firmware prior to 2.04 04/18/2019 HPE ProLiant DL180...

EulerOS Virtualization 3.0.1.0 : openssh (EulerOS-SA-2019-1426)

According to the versions of the openssh packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The processopen function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, whi...

Security Bulletin: Vulnerability in SSLv3 affects ITCAM for APPLICATION DIAGNOSTICS Agent for HTTP Servers (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in ITCAM for APPLICATION DIAGNOSTICS Agent for HTTP Servers Vulnerability Details CVE-ID: CVE-2014-3566 DESCRIPTION: Product could allow a remote...

Deployment Diversity for DNS Resiliency

Consider Addressing Delegation Servers with Varying Network Routes Written by: Jim Gilbert and Barry Greene Don't Forget DNS Similar to diverse workforces performing at a higher level, diverse network service deployments perform at a higher level that is increasingly important as the Internet...

CVE-2018-18975

An issue was discovered in the Ascensia Contour NEXT ONE app for iOS before 2019-01-15. An attacker may proxy communications between the app and Ascensia backend servers because of a weak certificate-pinning implementation, leading to disclosure of medical information...

CVE-2019-3559

Java Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thri...

CVE-2019-3559

Java Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thri...

Default credentials

Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook...

Default credentials

C++ Facebook Thrift servers using cpp2 would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects...

CVE-2019-3552

C++ Facebook Thrift servers using cpp2 would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects...

CVE-2019-3564

Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift...

UBUNTU-CVE-2019-3565

Legacy C++ Facebook Thrift servers using cpp instead of cpp2 would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service...

UBUNTU-CVE-2019-3552

C++ Facebook Thrift servers using cpp2 would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects...

CVE-2019-3558

Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook...

CVE-2019-3559

The CVE-2019-3559 issue affects Facebook Thrift servers prior to v2019.02.18.00. The root cause is that Java Facebook Thrift servers would not error when receiving messages whose containers contain fields of unknown type, allowing malicious clients to craft short messages that take a long time to...

CVE-2019-3559

Java Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thri...

CVE-2019-3564

CVE-2019-3564 affects Go Facebook Thrift servers where messages containing containers with fields of unknown type are not rejected. This can allow a malicious client to send short messages that take long to parse, enabling a denial-of-service condition. Affected product: Facebook Thrift (Go imple...

CVE-2019-3558

Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook...

EulerOS 2.0 SP3 : wget (EulerOS-SA-2019-1350)

According to the version of the wget package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Race condition in wget 1.17 and earlier, when used in recursive or mirroring mode to download a single file, might allow remote servers to bypass...

Man-In-The-Middle (MitM)

Samba is vulnerable to man-in-the-middle attacks. This allows an attacker to spoof SMB servers and decrypt all traffic, by modifying the client-server data stream...