[SECURITY] Fedora 31 Update: python-django-2.2.13-1.fc31

Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY Don't Repeat Yourself principle...

[SECURITY] Fedora 32 Update: python-django-3.0.7-1.fc32

Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY Don't Repeat Yourself principle...

Open-Xchange OX Guard Code Issue Vulnerability

Open-Xchange OX Guard is an encryption software from Open-Xchange USA. The software is mainly used for encryption/decryption of emails and documents. A code issue vulnerability exists in Open-Xchange OX Guard 2.10.3 and prior versions. The vulnerability arises from an improperly designed or...

Code Execution Vulnerability in Lenovo L78071 Development Edition by Lenovo (Beijing) Co.

Lenovo Beijing Co., Ltd. is an enterprise engaged in the research and development, production, repair and testing of electronic computers and their components. A code execution vulnerability exists in the Lenovo L78071 Development Edition of Lenovo Beijing Limited, which can be exploited by an...

KumbiaPHP Cross-Site Scripting Vulnerability

KumbiaPHP is a lightweight, BSD-licensed PHP framework. A cross-site scripting vulnerability exists in KumbiaPHP 1.1.1 and earlier versions in development mode. An attacker can exploit this vulnerability via public/pages/kumbia PATHINFO to conduct cross-site scripting attacks...

CVE-2020-14146

KumbiaPHP through 1.1.1, in Development mode, allows XSS via the public/pages/kumbia PATHINFO...

CVE-2020-14146

KumbiaPHP through 1.1.1, in Development mode, allows XSS via the public/pages/kumbia PATHINFO...

Design/Logic Flaw

KumbiaPHP through 1.1.1, in Development mode, allows XSS via the public/pages/kumbia PATHINFO...

CVE-2020-14146: Improper Neutralization of Input During Web Page Generation

KumbiaPHP through 1.1.1, in Development mode, allows XSS via the public/pages/kumbia PATHINFO...

PT-2020-13892

Name of the Vulnerable Software and Affected Versions KumbiaPHP versions 1.1.1 and earlier Description The issue allows for XSS via the "public/pages/kumbia" PATH INFO, specifically when KumbiaPHP is in Development mode. Recommendations For versions 1.1.1 and earlier, consider disabling Developme...

Friday Squid Blogging: Human Cells with Squid-Like Transparency

I think we need more human organs with squid-like features. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...

Meetecho Janus Code Issue Vulnerability

Meetecho Janus is a WebRTC Web Real Time Communication server from Meetecho. A code issue vulnerability exists in Meetecho Janus. The vulnerability stems from an improperly designed or implemented code development process for a web system or product. Detailed vulnerability details are not availab...

Meetecho Janus Code Issue Vulnerability (CNVD-2020-34717)

Meetecho Janus is a WebRTC Web Real Time Communication server from Meetecho. A code issue vulnerability exists in Meetecho Janus. The vulnerability stems from an improperly designed or implemented code development process for a web system or product. Detailed vulnerability details are not availab...

Innovation Driven by Operational Experience and Engineering Insight Deters NXNS Attacks

DNS and security have had a long and tangled relationship. The DNS has always been an attractive target since it's a network leverage point. At DNS OARC 30 in Bangkok in 2019, Akamai's Ralf Weber did a presentation called DNS Security: Past, Present, and Future It's Not Easy covering numerous DNS...

Adobe SDK Buffer Overflow Code Execution

The vulnerability of the DNG file reading and writing software developed by Adobe’s SDK is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

How to Create a Culture of Kick-Ass DevSecOps Engineers

Much like technology itself, the tools, techniques, and optimum processes for developing code evolve quickly. We humans have an insatiable need for more software, more features, more functionality… and we want it faster than ever before, more qualitative, and on top of that: Secure. With an...

[SECURITY] Fedora 32 Update: dpdk-19.11.1-2.fc32

The Data Plane Development Kit is a set of libraries and drivers for fast packet processing in the user space...

Planning Ahead to Prevent Vulnerabilities

The cost to remediate vulnerabilities increases as those vulnerabilities make it further into the development process. If they make it into a final release, those vulnerabilities can leave organizations vulnerable to attacks, costing time and resources to address, as well as causing damage to the...

dpdk: librte_vhost Integer overflow in vhost_user_set_log_base()

A vulnerability was found in DPDK versions 18.05 and above. A missing check for an integer overflow in vhostusersetlogbase could result in a smaller memory map than requested, possibly allowing memory corruption...

dpdk: librte_vhost Integer truncation in vhost_user_check_and_alloc_queue_pair()

A memory corruption issue was found in DPDK versions 17.05 and above. This flaw is caused by an integer truncation on the index of a payload. Under certain circumstances, the index a UInt is copied and truncated into a uint16, which can lead to out of bound indexing and possible memory corruption...