982 matches found
On the Insecurity of ES&S Voting Machines’ Hash Code
Andrew Appel and Susan Greenhalgh have a blog post on the insecurity of ES&Ss software authentication system: It turns out that ES&S has bugs in their hash-code checker: if the "reference hashcode" is completely missing, then itll say "yes, boss, everything is fine" instead of reporting an error...
The vulnerability of the rand() and random() functions in software certification for wireless network WPA devices, related to the lack of entropy in PIN selection, allows a hacker to trigger a service failure.
The vulnerability of the rand and random functions in software device certification for wireless networks with WPA security is related to a lack of entropy in the PIN selection process. Exploiting this vulnerability could allow an attacker to trigger a service failure...
EulerOS Virtualization 3.0.6.6 : gnupg2 (EulerOS-SA-2021-1479)
According to the version of the gnupg2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which resul...
EulerOS Virtualization for ARM 64 3.0.2.0 : gnupg2 (EulerOS-SA-2021-1406)
According to the version of the gnupg2 package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key,...
EulerOS Virtualization 3.0.2.6 : gnupg2 (EulerOS-SA-2021-1435)
According to the version of the gnupg2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which resul...
Huawei EulerOS: Security Advisory for gnupg2 (EulerOS-SA-2021-1406)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
grub2 security update
2.02-90.0.2.el83.1 - Fix various coverity issues Orabug: 32530657 - Add SBAT metadata to grubx64.efi Orabug: 32530657 - Set proper blsdir if /boot is on btrfs rootfs Orabug: 32063327 - Add CVE-2020-15706, CVE-2020-15707 to the list Orabug: 31225072 - Update signing certificate for efi binaries -...
Huawei EulerOS: Security Advisory for gnupg2 (EulerOS-SA-2021-1479)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Amazon Dismisses Claims Alexa 'Skills' Can Bypass Security Vetting Process
Researchers warn Amazon’s voice assistant Alexa is vulnerable to malicious third-party “skills” – voice assistant capabilities developed by third parties – that could leave smart-speaker owners vulnerable to a wide range of cyberattacks. The security-threat claim is roundly dismissed by Amazon...
Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update
An update for kernel is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...
CentOS 8 : python-pip (CESA-2020:1916)
The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:1916 advisory. - python-requests: Redirect from HTTPS to HTTP does not remove Authorization header CVE-2018-18074 - python-urllib3: Cross-host redirect does not remov...
CentOS 8 : python27:2.7 (CESA-2019:3335)
The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:3335 advisory. - python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on internal service CVE-2019-11236 - python-urllib3...
CentOS 8 : python-urllib3 (CESA-2019:3590)
The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2019:3590 advisory. - python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on internal service CVE-2019-11236 - python-urllib3...
CVE-2021-3309
packages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process connections even though they are not authorized by the Certification Authority trust store,...
CVE-2021-3309
packages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process connections even though they are not authorized by the Certification Authority trust store,...
Code injection
packages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process connections even though they are not authorized by the Certification Authority trust store,...
CVE-2021-3309
packages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process connections even though they are not authorized by the Certification Authority trust store,...
Cyber Essentials and the New Normal
TL;DR Cyber Essentials has changed and aspects of the new normal are catching many by surprise. Increased levels of evidence and stricter controls determining a pass or a fail are in place. Be prepared for the increased hurdles Ask for assistance before starting the process if you are uncertain o...
Man-in-the-Middle (MitM)
erlang is vulnerable to man-in-the-middle attack. The SSL application accepts and trusts an invalid X.509 certificate chain to a trusted root Certification Authority, potentially allowing for man-in-the-middle attacks...