Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : libssh vulnerability (USN-3795-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3795-1 advisory. Peter Winter-Smith discovered that libssh incorrectly handled authentication when being used as a server. A remote attacker could use this...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : MoinMoin vulnerability (USN-3794-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3794-1 advisory. It was discovered that MoinMoin incorrectly handled certain inputs. An attacker could possibly use this issue to access sensitive...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Requests vulnerability (USN-3790-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3790-1 advisory. It was discovered that Requests incorrectly handled certain HTTP headers. An attacker could possibly use this issue to access sensitive...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Thunderbird vulnerabilities (USN-3793-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3793-1 advisory. Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a...

Solaris 10 (sparc) : 152920-11

JavaSE 6: update 211 patch equivalent to JDK 6u211, 64bit. Date this patch was last updated by Sun : Oct/15/18 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include"compat.inc"; if description scriptid118132;...

Solaris 10 (sparc) : 152100-91

JavaSE 8: update 191 patch equivalent to. Date this patch was last updated by Sun : Oct/15/18 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include"compat.inc"; if description scriptid118129; scriptversion"1.4";...

Fedora 27 : libgit2 (2018-7d993184f6)

Update to 0.26.7 CVE-2018-17456 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 7030...

Fedora 27 : python-paramiko (2018-aff51f5e62)

Python Paramiko versions 2.3.2 and 2.4.1 are vulnerable to an authentication bypass in paramiko/authhandler.py. A remote attacker could exploit this vulnerability in Paramiko SSH servers to execute arbitrary code. Note that applications using Paramiko only as a client such as ansible are not...

Debian DLA-1544-1 : tomcat7 security update

Sergey Bobrov discovered that when the default servlet returned a redirect to a directory e.g. redirecting to /foo/ when the user requested /foo a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice. For Debian 8 'Jessie', this problem has...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : ClamAV vulnerability (USN-3789-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3789-1 advisory. It was discovered that ClamAV incorrectly handled unpacking MEW executables. A remote attacker could possibly use this issue to cause Clam...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Tex Live vulnerabilities (USN-3788-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3788-1 advisory. Jakub Wilk discovered that Tex Live incorrectly handled certain files. An attacker could possibly use this issue to execute...

Ubuntu 14.04 LTS / 16.04 LTS : Tomcat vulnerability (USN-3787-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3787-1 advisory. It was discovered that Tomcat incorrectly handled returning redirects to a directory. A remote attacker could possibly use this issue with a specially...

Microsoft Patches Zero-Day Under Active Attack by APT

Microsoft has issued a patch for a zero-day bug being actively exploited in the wild, as part of its Patch Tuesday security bulletin. The vulnerability is an elevation-of-privilege flaw, rated important, affecting the Windows Win32k component. The zero-day CVE-2018-8453, found by Kaspersky Lab,...

MikroTik router vulnerability lets hackers bypass firewall to load malware undetected

By Waqas Tenable Research’s cybersecurity researcher has released “By The way,” which is a new PoC proof-of-concept RCE attack after identifying a new attack method to exploit an already discovered vulnerability in MikroTik routers. The vulnerability, identified as CVE-2018-14847, is an old...

Fedora 27 : mediawiki (2018-edf90410ea)

https://www.mediawiki.org/wiki/Releasenotes/1.29MediaWiki1.29.3 - T169545, CVE-2018-0503 SECURITY: $wgRateLimits entry for 'user' overrides 'newbie'. - T194605, CVE-2018-0505 SECURITY: BotPasswords can bypass CentralAuth's account lock. - T180551 Fix LanguageSrTest for language converter - T18055...

Fedora 27 : liblouis (2018-9a09435935)

Security fix for CVE-2018-17294 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 7030...

New Exploit for MikroTik Router WinBox Vulnerability Gives Full Root Access

A known vulnerability in MikroTik routers is potentially far more dangerous than previously thought. A cybersecurity researcher from Tenable Research has released a new proof-of-concept PoC RCE attack for an old directory traversal vulnerability that was found and patched within a day of its...

PoC Attack Escalates MikroTik Router Bug to ‘As Bad As It Gets’

A new hacking technique used against vulnerable MikroTik routers gives attackers the ability to execute remote code on affected devices. The technique is yet another security blow against the MikroTik router family. Previous hacks have left the routers open to device failures, cyptojacking and...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : AppArmor update (USN-3784-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3784-1 advisory. As a security improvement, this update adjusts the private-files abstraction to disallow writing to thumbnailer configuration files...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Liblouis vulnerabilities (USN-3782-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3782-1 advisory. Henri Salo discovered that Liblouis incorrectly handled certain files. An attacker could possibly use this issue to execute...