Jaeles v0.9 - The Swiss Army Knife For Automated Web Application Testing

Jaeles is a powerful, flexible and easily extensible framework written in Go for building your own Web Application Scanner. Installation Download precompiled version here. If you have a Go environment, make sure you have Go = 1.13 with Go Modules enable and run the following command. GO111MODULE=...

Security update for freetype2 (moderate)

openSUSE Security Update: Security update for freetype2 Announcement ID: openSUSE-SU-2020:0704-1 Rating: moderate References: 1079603 1091109 Cross-References: CVE-2018-6942 Affected Products: openSUSE Leap 15.1 An update that solves one vulnerability and has one errata is now available...

SUSE SLED15 / SLES15 Security Update : freetype2 (SUSE-SU-2020:1353-1)

This update for freetype2 to version 2.10.1 fixes the following issues : Security issue fixed : CVE-2018-6942: Fixed a NULL pointer dereference within ttinerp.c bsc1079603. Non-security issues fixed : Update to version 2.10.1 - The bytecode hinting of OpenType variation fonts was flawed, since th...

The vulnerability of the Image Signature Verification function in Cisco Adaptive Security Appliance (ASA) and Configure Firepower Threat Defense (FTD) microprogramming systems allows attackers to compromise the integrity of protected information.

The vulnerability of the Image Signature Verification function in Cisco Adaptive Security Appliance ASA and Configure Firepower Threat Defense FTD software relates to improper verification of cryptographic signatures. Exploiting this vulnerability can allow a malicious actor to compromise the...

CVE-2020-12046

Opto 22 SoftPAC Project Version 9.6 and prior. SoftPAC’s firmware files’ signatures are not verified upon firmware update. This allows an attacker to replace legitimate firmware files with malicious files...

PAN-OS: Panorama management server log injection

A missing authorization vulnerability in the management server component of PAN-OS Panorama allows a remote unauthenticated user to inject messages into the management server ms.log file. This vulnerability can be leveraged to obfuscate an ongoing attack or fabricate log entries in the ms.log fil...

CVE-2020-10059

The UpdateHub module disables DTLS peer checking, which allows for a man in the middle attack. This is mitigated by firmware images requiring valid signatures. However, there is no benefit to using DTLS without the peer checking. See NCC-ZEP-018 This issue affects: zephyrproject-rtos zephyr versi...

Code injection

The UpdateHub module disables DTLS peer checking, which allows for a man in the middle attack. This is mitigated by firmware images requiring valid signatures. However, there is no benefit to using DTLS without the peer checking. See NCC-ZEP-018 This issue affects: zephyrproject-rtos zephyr versi...

CVE-2020-12692

A flaw was found in Keystone, where the restriction was not checked for the Signature Version 4 V4 process of AWS signatures issued within a limited time window. This flaw allows an attacker to capture an auth header and reuse it, potentially maintaining indefinite access...

Design/Logic Flaw

A vulnerability in the Image Signature Verification feature of Cisco Firepower Threat Defense FTD Software could allow an authenticated, remote attacker with administrator-level credentials to install a malicious software patch on an affected device. The vulnerability is due to improper...

CVE-2020-3308

Cisco Firepower Threat Defense (FTD) Software is vulnerable in its Image Signature Verification feature. The root cause is improper verification of digital signatures for patch images, enabling an authenticated, remote attacker with administrator-level credentials to craft and load an unsigned pa...

Cisco Firepower Threat Defense Software Signature Verification Bypass Vulnerability

A vulnerability in the Image Signature Verification feature of Cisco Firepower Threat Defense FTD Software could allow an authenticated, remote attacker with administrator-level credentials to install a malicious software patch on an affected device. The vulnerability is due to improper...

Fedora: Security Advisory for php-robrichards-xmlseclibs1 (FEDORA-2020-af82229ae5)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

evolution: specially crafted email leading to OpenPGP signatures being spoofed for arbitrary messages

GNOME Evolution through 3.28.2 is prone to OpenPGP signatures being spoofed for arbitrary messages using a specially crafted email that contains a valid signature from the entity to be impersonated as an attachment...

Huawei EulerOS: Security Advisory for gnupg2 (EulerOS-SA-2020-1504)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2020-1026

A Security Feature Bypass vulnerability exists in the MSR JavaScript Cryptography Library that is caused by multiple bugs in the library’s Elliptic Curve Cryptography ECC implementation.An attacker could potentially abuse these bugs to learn information about a server’s private ECC key a key...

Fedora: Security Advisory for php-robrichards-xmlseclibs1 (FEDORA-2020-46d0f456a9)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for php-robrichards-xmlseclibs1 (FEDORA-2020-1b95d7a131)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 31 Update: php-robrichards-xmlseclibs1-1.4.3-1.fc31

xmlseclibs is a library written in PHP for working with XML Encryption and Signatures. NOTE: php-mcrypt will not be automatically installed as a dependency of this package so it will need to be "manually" installed if it is required -- specifically for the following XMLSecurityKey encryption type...

[SECURITY] Fedora 30 Update: php-robrichards-xmlseclibs1-1.4.3-1.fc30

xmlseclibs is a library written in PHP for working with XML Encryption and Signatures. NOTE: php-mcrypt will not be automatically installed as a dependency of this package so it will need to be "manually" installed if it is required -- specifically for the following XMLSecurityKey encryption type...