CCleanup: A Vast Number of Machines at Risk

This post was authored by: Edmund Brumaghin, Ross Gibb, Warren Mercer, Matthew Molyett, and Craig WilliamsUpdate 9/18: CCleaner Cloud version 1.07.3191 is also reported to be affectedUpdate 9/19: This issue was discovered and reported by both Morphisec and Cisco in separate in-field cases and...

CVE-2016-8273

Huawei PC client software HiSuite 4.0.5.300OVE uses insecure HTTP for upgrade software package download and does not check the integrity of the software package before installing; an attacker can launch an MITM attack to interrupt or replace the downloaded software package and further compromise...

CVE-2016-8273

Huawei PC client software HiSuite 4.0.5.300OVE uses insecure HTTP for upgrade software package download and does not check the integrity of the software package before installing; an attacker can launch an MITM attack to interrupt or replace the downloaded software package and further compromise...

Hardcoded credentials

Huawei PC client software HiSuite 4.0.5.300OVE uses insecure HTTP for upgrade software package download and does not check the integrity of the software package before installing; an attacker can launch an MITM attack to interrupt or replace the downloaded software package and further compromise...

CVE-2016-8273

Huawei PC client software HiSuite 4.0.5.300OVE uses insecure HTTP for upgrade software package download and does not check the integrity of the software package before installing; an attacker can launch an MITM attack to interrupt or replace the downloaded software package and further compromise...

CVE-2016-8273

Huawei PC client software HiSuite 4.0.5.300OVE uses insecure HTTP for upgrade software package download and does not check the integrity of the software package before installing; an attacker can launch an MITM attack to interrupt or replace the downloaded software package and further compromise...

[SECURITY] Fedora 25 Update: moodle-3.1.5-1.fc25

Moodle is a course management system CMS - a free, Open Source software package designed using sound pedagogical principles, to help educators crea te effective online learning communities...

MGASA-2017-0069 Updated webkit2 packages fix security vulnerabilities

The webkit2 package has been updated to version 2.14.5, fixing several security issues and other bugs...

Security Advisory - Multiple Security Vulnerabilities in Huawei HiSuite

Huawei HiSuite PC client software has an information leak vulnerability. The software provides the function for configuring the proxy server. The password textbox on the proxy configuration UI do not disable the password copy function. An attacker who can log in to the system can copy out the...

MGASA-2016-0210 Updated mediawiki packages fix security vulnerability

The mediawiki package has been updated to version 1.23.14, which fixes multiple security issues and other bugs. See the release announcements for more details...

[SECURITY] Fedora 24 Update: moodle-3.0.3-1.fc24

Moodle is a course management system CMS - a free, Open Source software package designed using sound pedagogical principles, to help educators crea te effective online learning communities...

MGASA-2016-0016 Updated roundcubemail packages fix security vulnerability

The roundcubemail package has been updated to version 1.0.8, which fixes a path traversal issue and other bugs. See the upstream release announcement for more details...

[SECURITY] Fedora 21 Update: moodle-2.7.9-1.fc21

Moodle is a course management system CMS - a free, Open Source software package designed using sound pedagogical principles, to help educators crea te effective online learning communities...

MGASA-2015-0189 Updated pdns & pdns-recursor packages fix CVE-2015-1868

Updated pdns and pdns-recursor packages fix security vulnerability: A bug was discovered in the label decompression code in PowerDNS and PowerDNS Recursor, making it possible for names to refer to themselves, thus causing a loop during decompression. On some platforms, this bug can be abused to...

The vulnerability of the Red Hat Enterprise Linux operating system allows malicious actors to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the libvirt-client-0.8.1 package of the Red Hat Enterprise Linux operating system can lead to violations of confidentiality, integrity, and accessibility of protected information. This vulnerability can be exploited locally...

Vulnerabilities in the Debian GNU/Linux operating system that allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information

The numerous vulnerabilities in the Debian GNU/Linux operating system’s analog software package can lead to breaches of the confidentiality, integrity, and accessibility of protected information. These vulnerabilities can be exploited remotely...

Vulnerabilities of the Gentoo Linux operating system, which allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information

Multiple vulnerabilities in the freetype package up to version 2.1.10-r3 of the Gentoo Linux operating system. Exploitation of these vulnerabilities may lead to violations of confidentiality, integrity, and accessibility of protected information. These vulnerabilities can be exploited remotely by...

Vulnerabilities of the CentOS operating system that allow a remote attacker to compromise the accessibility of protected information

The net-snmp-5.3.2.2 package from the CentOS operating system has multiple vulnerabilities. Exploitation of these vulnerabilities may lead to a violation of the accessibility of protected information. These vulnerabilities can be exploited remotely...

The vulnerability of the Gentoo Linux operating system allows a malicious individual to compromise the confidentiality of protected information.

The vulnerability of the aa-sources package up to version 2.6.5-r5 of the Gentoo Linux operating system can lead to a violation of the confidentiality of protected information. This vulnerability can be exploited locally...

CVE-2015-0662: Undefined Security Weakness

Cisco AnyConnect Secure Mobility Client 4.0.00051 and earlier allows local users to gain privileges via crafted IPC messages that trigger use of root privileges for a software-package installation, aka Bug ID CSCus79385...