VMware Carbon Black Cloud Adds Device Control

With most organizations now working remotely, the chances your employees may unintentionally use restricted devices and infect your network has grown exponentially. With this threat in mind, we’re happy to announce the release today of device control in the VMware Carbon Black Cloud. Although the...

CVE-2020-13799

Western Digital has identified a security vulnerability in the Replay Protected Memory Block RPMB protocol as specified in multiple standards for storage device interfaces, including all versions of eMMC, UFS, and NVMe. The RPMB protocol is specified by industry standards bodies and is implemente...

Design/Logic Flaw

Western Digital has identified a security vulnerability in the Replay Protected Memory Block RPMB protocol as specified in multiple standards for storage device interfaces, including all versions of eMMC, UFS, and NVMe. The RPMB protocol is specified by industry standards bodies and is implemente...

CVE-2020-13799

Western Digital has identified a security vulnerability in the Replay Protected Memory Block RPMB protocol as specified in multiple standards for storage device interfaces, including all versions of eMMC, UFS, and NVMe. The RPMB protocol is specified by industry standards bodies and is implemente...

[SECURITY] Fedora 33 Update: f2fs-tools-1.14.0-1.fc33

NAND flash memory-based storage devices, such as SSD, and SD cards, have been widely being used for ranging from mobile to server systems. Since they are known to have different characteristics from the conventional rotational disks,a file system, an upper layer to the storage device, should adap...

CVE-2020-13364

A backdoor in certain Zyxel products allows remote TELNET access via a CGI script. This affects NAS520 V5.21AASZ.4C0, V5.21AASZ.0C0, V5.11AASZ.3C0, and V5.11AASZ.0C0; NAS542 V5.11ABAG.0C0, V5.20ABAG.1C0, and V5.21ABAG.3C0; NSA325 v2V4.81AALS.0C0 and V4.81AAAJ.1C0; NSA310 4.22AFK.0C0 and...

IBM Security Key Lifecycle Manager Information Disclosure Vulnerability (CNVD-2020-43154)

IBM Security Key Lifecycle Manager Tivoli Key Lifecycle Manager is a set of key lifecycle management software from IBM in the United States. The software provides key storage, key maintenance and key lifecycle management for storage devices. An information disclosure vulnerability exists in IBM...

Arbitrary Command Execution

device-mapper-multipath is vulnerable to arbitrary command execution. It was discovered that the multipathd daemon set incorrect permissions on the socket used to communicate with command line clients. An unprivileged, local user could use this flaw to send commands to multipathd, resulting in...

Zyxel Fixes 0day in Network Storage Devices

Patch comes amid active exploitation by ransomware gangs Networking hardware vendor Zyxel today released an update to fix a critical flaw in many of its network attached storage NAS devices that can be used to remotely commandeer them. The patch comes 12 days after KrebsOnSecurity alerted the...

Linux: Mounting of usb-storage filesystems

USB storage devices such as thumb drives can be used to introduce unauthorized software and other vulnerabilities. Support for these devices should be disabled and the devices themselves should be tightly controlled. Note: This script looks for entry SPDX-FileCopyrightText: 2020 Greenbone AG Some...

Meet ‘TajMahal,’ A New and Highly Advanced APT Framework

SINGAPORE – Researchers at Kaspersky Lab have discovered a new, highly sophisticated advanced persistent threat APT framework targeting a single Central Asian diplomatic agency. Malware samples associated with the APT reveal a complex never-before-seen code base, making it extremely hard to detec...

The vulnerability in the web interfaces of microprogramming software for network storage devices such as Seagate GoFlex Home, Medion LifeCloud NAS, and Netgear Stora allows a hacker to exploit their privileges.

The vulnerability of the web interfaces of microprogramming software for network storage devices such as Seagate GoFlex Home, Medion LifeCloud NAS, and Netgear Stora is related to incorrect restrictions on XML links to external objects. Exploiting this vulnerability can allow a malicious actor to...

[SECURITY] Fedora 28 Update: udisks2-2.7.6-2.fc28

The Udisks project provides a daemon, tools and libraries to access and manipulate disks, storage devices and technologies...

ASUSTOR Data Master Cross-Site Scripting Vulnerability

ASUSTOR Data Master ADM is a dedicated operating system for ASUSTOR NAS storage devices from ASUSTOR. A cross-site scripting vulnerability exists in ADM 3.1.5 and prior versions, which originates when the program uses HTTP requests for configuration files. A remote attacker can exploit this...

Lynis 2.6.7 - Security Auditing Tool for Unix/Linux Systems

We are excited to announce this major release of auditing tool Lynis. Several big changes have been made to core functions of Lynis. These changes are the next of simplification improvements we made. There is a risk of breaking your existing configuration. Lynis is an open source security auditin...

OpenSLP Memory Corruption Vulnerability

Lenovo ThinkServer RD350G, etc. are products of Lenovo China.Lenovo ThinkServer RD350G, RD350X, RD450X, and HR650 are rackmount servers; N3310, N4610 are NAS storage devices; Fan Power Controller FPC is a fan speed controller.OpenSLP Service Location Protocol is an IETF standard protocol develope...

EMC VNX2 OE for File and VNX1 OE for File Local Elevation of Privilege Vulnerability

The EMC VNX2 OE for File and VNX1 OE for File are file storage devices from EMC Corporation USA. A security vulnerability exists in EMC VNX2 OE for File and VNX1 OE for File, which can be exploited by a local attacker to submit a special request to execute arbitrary commands with root privileges...

EMC VNX2 OE for File and VNX1 OE for File Elevation of Privilege Vulnerabilities

The EMC VNX2 OE for File and VNX1 OE for File are file storage devices from EMC Corporation USA. A security vulnerability exists in EMC VNX2 OE for File and VNX1 OE for File, which can be exploited by a remote attacker to submit a special request to execute arbitrary code with root privileges on ...

Authentication flaw

I-O DATA DEVICE WFS-SR01 firmware version 1.10 and earlier allow remote attackers to bypass access restriction to access data on storage devices inserted into the product via unspecified vectors...

CVE-2016-7807

I-O DATA DEVICE WFS-SR01 firmware version 1.10 and earlier allow remote attackers to bypass access restriction to access data on storage devices inserted into the product via unspecified vectors...