[SECURITY] Fedora 33 Update: synergy-1.12.0-1.fc33

Synergy lets you easily share your mouse and keyboard between multiple computers, where each computer has its own display. No special hardware is required, all you need is a local area network. Synergy is supported on Windows, Mac OS X and Linux. Redirecting the mouse and keyboard is as simple as...

Denial Of Service (DoS)

tensorflow is vulnerable to denial of service DoS. The vulnerability exists as the tf.rawops.ImmutableConst operation crashes the Python interpreter when it tries to write the immutable memory area, if the type of the tensor is not an integral type...

CVE-2020-8539

Kia Motors Head Unit with Software version: SOP.003.30.18.0703, SOP.005.7.181019, and SOP.007.1.191209 may allow an attacker to inject unauthorized commands, by executing the micomd executable deamon, to trigger unintended functionalities. In addition, this executable may be used by an attacker t...

CVE-2020-29440

Tesla Model X vehicles before 2020-11-23 do not perform certificate validation during an attempt to pair a new key fob with the body control module BCM. This allows an attacker who is inside a vehicle, or is otherwise able to send data over the CAN bus to start and drive the vehicle with a spoofe...

Cisco SD-WAN Software Elevation of Privilege Vulnerability

Cisco SD-WAN vManage is software from Cisco that provides software-defined networking capabilities. The software is a way to virtualize the network.Cisco SD-WAN vEdge is a router from Cisco. The device provides basic WAN, security and multi-cloud capabilities for Cisco SD-WAN solutions. An...

TotoLink A850r-v1 安全漏洞

TOTOLINK A850R-V1 is a wireless dual-band router.TOTOLINK A850R-V1 version 1.0.1-B20150707.1612 and F1-V2 version 1.1-B20150708.1646 contain a security vulnerability that stems from the fact that by sending a specific hel,xasf packet to the WAN interface , it is possible to open the web managemen...

The vulnerability of the Snort intrusion detection system, which includes Cisco Firepower Threat Defense (FTD) for microprogramming network firewalls, Cisco SD-WAN for programmatically defined networks, Cisco IOS XE for network operating systems, and Cisco Meraki for networking devices, allows attackers to bypass security measures and execute malicious activities.

The vulnerability of the Snort intrusion detection system, the microprogramming software for Cisco Firepower Threat Defense FTD, the program-defined network Cisco SD-WAN, the Cisco IOS XE network operating system, and the microprogramming software for Cisco Meraki devices is related to a flaw in...

The vulnerability in the vManage web interface of the software-defined Cisco SD-WAN network allows a malicious actor to gain unauthorized access to protected information and to modify, add, or delete data.

The vulnerability in the vManage web interface of the Cisco SD-WAN program-defined network is related to errors in restricting XML links to external objects. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information and to modify, add, or delete data...

CVE-2020-8272

Authentication Bypass resulting in exposure of SD-WAN functionality in Citrix SD-WAN Center versions before 11.2.2, 11.1.2b and 10.2.8...

Edit feed settings and others, Cross Site Scripting(XSS) Vulnerability in Latest Release 4.4.0

baserCMS 4.4.0 and earlier is affected by Cross Site Scripting XSS. Impact: XSS via Arbitrary script execution. Attack vector is: Administrator must be logged in. Components are: Edit feed settings, Edit widget area, Sub site new registration, New category registration Tested baserCMS Version :...

GHSA-WPWW-4JF4-4HX8 Edit feed settings and others, Cross Site Scripting(XSS) Vulnerability in Latest Release 4.4.0

baserCMS 4.4.0 and earlier is affected by Cross Site Scripting XSS. Impact: XSS via Arbitrary script execution. Attack vector is: Administrator must be logged in. Components are: Edit feed settings, Edit widget area, Sub site new registration, New category registration Tested baserCMS Version :...

CVE-2020-15792

A vulnerability has been identified in Desigo Insight All versions. The web service does not properly apply input validation for some query parameters in a reserved area. This could allow an authenticated attacker to retrieve data via a content-based blind SQL injection attack...

XSS vulnerability when listing users on add & modify server pages.

Impact An XSS vulnerability exists in versions of Pterodactyl Panel before 0.7.19. Affected versions do not properly sanitize account names before rendering them to the dropdown selector in the admin area when creating or modifying a server. Patches This XSS has been addressed in 0.7.19 and will ...

kernel: information leak bug caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_core.c driver

An information-leak flaw was found in the Linux kernel's pcan USB driver. When a device using this driver connects to the system, the stack information is leaked to the CAN bus, a controller area network for automobiles. The highest threat with this vulnerability is breach of data confidentiality...

Fighting Smoke with Open Source

I'm a developer advocate at Akamai and a huge proponent for the open source initiative. So, today I am going to tell you a story of how a regular person like you or me can make an impact with just a little bit of goodwill, and a pinch of open source. Early morning on August 16, around 2,500...

CVE-2020-1472/Zerologon. As an IT manager should I worry?

TL;DR Yes, apply the update from Microsoft. The new MS08-067? CVE-2020-1472 is an elevation of privilege vulnerability in a cryptographic authentication scheme used by the Netlogon service and was discovered and named Zerologon by Tom Tervoort at Secura. It does not require authentication. It can...

VulnCheck KEV: CVE-2020-8195

Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an information disclosure vulnerability...

CVE-2020-9199

B2368-22 V100R001C00;B2368-57 V100R001C00;B2368-66 V100R001C00 have a command injection vulnerability. An attacker with high privileges may exploit this vulnerability through some operations on the LAN. Due to insufficient input validation of some parameters, the attacker can exploit this...

CVE-2020-25119

The Admin CP in vBulletin 5.6.3 allows XSS via a Title of a Child Help Item in the Login/Logoff part of the User Manual...

CVE-2020-11797

An Authentication Bypass vulnerability in the Published Area of the web conferencing component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could allow an unauthenticated attacker to gain access to unauthorized information due to insufficient access validation. A successful exploit...