CVE-2022-20929

A vulnerability in the upgrade signature verification of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an unauthenticated, local attacker to provide an unauthentic upgrade file for upload. This vulnerability is due to insufficient cryptographic signature verification of upgrade...

EulerOS 2.0 SP9 : python3 (EulerOS-SA-2023-1455)

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to...

EulerOS 2.0 SP9 : python3 (EulerOS-SA-2023-1480)

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to...

Debian: Security Advisory (DLA-773-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DLA-766-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-5933-1: Libtpms vulnerabilities

Francisco Falcon discovered that Libtpms did not properly manage memory when performing certain cryptographic operations. An attacker could possibly use this issue to cause a denial of service, or possibly execute arbitrary code. CVE-2023-1017, CVE-2023-1018 It was discovered that Libtpms did not...

USN-5933-1 libtpms vulnerabilities

Francisco Falcon discovered that Libtpms did not properly manage memory when performing certain cryptographic operations. An attacker could possibly use this issue to cause a denial of service, or possibly execute arbitrary code. CVE-2023-1017, CVE-2023-1018 It was discovered that Libtpms did not...

Ubuntu 18.04 ESM : Python vulnerability (USN-5930-1)

The remote Ubuntu 18.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-5930-1 advisory. It was discovered that Python incorrectly handled certain inputs. If a user or an automated system were tricked into running a specially crafted input, a remote...

Ubuntu 18.04 ESM : Python vulnerability (USN-5931-1)

The remote Ubuntu 18.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-5931-1 advisory. It was discovered that Python incorrectly handled certain inputs. If a user or an automated system were tricked into running a specially crafted input, a remote...

The vulnerability of Western Digital MyCloud PR4100 network storage microprogramming software, related to incorrect verification of the cryptographic signature, allows a hacker to execute arbitrary code.

The vulnerability of Western Digital MyCloud PR4100 network storage microprogramming software is related to improper verification of the cryptographic signature. Exploiting this vulnerability could allow an attacker operating remotely to execute arbitrary code...

Two New Vulnerabilities Discovered in TPM 2.0 Library

Threat Level Vulnerability Report Follow Hive Pro for a detailed threat advisory, download the pdf file here from HiveForce Labs. Summary The Trusted Platform Module TPM 2.0 specification, a hardware-based technology used to provide tamper-resistant secure cryptographic functions, is affected by...

The vulnerability of the access control tool, Policy Manager, in the software for remote IT support and monitoring provided by Dell Secure Connect Gateway (SCG), allows a perpetrator to increase their privileges.

The vulnerability of the access control mechanism in the Policy Manager software for remote IT support and monitoring in Dell Secure Connect Gateway SCG is related to the use of a strictly encrypted cryptographic key. Exploiting this vulnerability could allow an attacker to increase their...

The vulnerability of the Thunderbird email client, related to errors in processing OpenPGP and OpenPGP MIME data, allows a hacker to execute a DoS attack.

The vulnerability of the Thunderbird email client is related to errors in processing OpenPGP and OpenPGP MIME data. Exploiting this vulnerability could allow a remote attacker to carry out a DoS attack using a specially created certificate...

Ubuntu 18.04 LTS : Python vulnerability (USN-5767-3)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5767-3 advisory. USN-5767-1 fixed vulnerabilities in Python. This update fixes the problem for Ubuntu 18.04 LTS. Tenable has extracted the preceding description block directly fro...

The vulnerability of the access control tool, Policy Manager, in the software for remote IT support and monitoring provided by Dell Secure Connect Gateway (SCG), allows a perpetrator to increase their privileges.

The vulnerability of the access control mechanism in the Policy Manager software for remote IT support and monitoring in Dell Secure Connect Gateway SCG is related to the use of a strictly encrypted cryptographic key. Exploiting this vulnerability could allow an attacker to increase their...

SUSE SLES15 / openSUSE 15 Security Update : nodejs16 (SUSE-SU-2023:0608-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0608-1 advisory. Update to LTS version 16.19.1: - CVE-2023-23918: Fixed permissions policies that could have been bypassed via...

SUSE SLES12 Security Update : nodejs16 (SUSE-SU-2023:0609-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0609-1 advisory. Update to LTS version 16.19.1: - CVE-2023-23918: Fixed permissions policies that could have been bypassed via process.mainModule...

New EX-22 Tool Empowers Hackers with Stealthy Ransomware Attacks on Enterprises

A new post-exploitation framework called EXFILTRATOR-22 aka EX-22 has emerged in the wild with the goal of deploying ransomware within enterprise networks while flying under the radar. "It comes with a wide range of capabilities, making post-exploitation a cakewalk for anyone purchasing the tool,...

XKCP: buffer overflow in the SHA-3 reference implementation

A flaw was found in the Keccak XKCP SHA-3 reference implementation. The sponge function interface allows partial input data to be processed, and partial output to be produced. When at least one of these has a length of 4294967096 bytes or more, it can result in elimination of cryptographic...

Internet Bug Bounty: Inadequate Encryption Strength in nodejs-current reads openssl.cnf from /home/iojs/build/... upon startup on MacOS

A cryptographic vulnerability was found in nodejs-current that allowed openssl.cnf to be read from an insecure location upon startup on MacOS, potentially exposing encryption keys or certificates...