Security Bulletin: Vulnerability in RC4 stream cipher affects IBM InfoSphere Optim Performance Manager (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects IBM InfoSphere Optim Performance Manager. Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An attacker...

Cisco Nexus 9000 Series Fabric Switches ACI Mode Link Layer Discovery Protocol Port DoS (cisco-sa-apic-lldap-dos-WerV9CFj)

According to its self-reported version, Cisco NX-OS Software is affected by a denial of service DoS vulnerability. The vulnerability exists in the Link Layer Discovery Protocol LLDP due to incorrect processing of LLDP on packets on an SFP interface. An unauthenticated, adjacent attacker can explo...

MGASA-2021-0298 Updated java-openjdk packages fix security vulnerabilities

For java-1.8.0 Security fixes - JDK-8227467: Better class method invocations - JDK-8244473: Contextualize registration for JNDI - JDK-8244543: Enhanced handling of abstract classes - JDK-8249906, CVE-2021-2163: Enhance opening JARs - JDK-8250568, CVE-2021-2161: Less ambiguous processing -...

xen/arm: Boot modules are not scrubbed

ISSUE DESCRIPTION The bootloader will load boot modules e.g. kernel, initramfs... in a temporary area before they are copied by Xen to each domain memory. To ensure sensitive data is not leaked from the modules, Xen must "scrub" them before handing the page over to the allocator. Unfortunately, i...

Security Bulletin: Vulnerabilities in SSLv3 affect Informix Genero (CVE-2014-3566 & CVE-2014-0076)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in Informix Genero. Vulnerability Details CVEID: CVE-2014-3566 DESCRIPTION: Multiple products could allow a remote attacker to obtain sensitive...

SUSE SLES15 Security Update : ceph (SUSE-SU-2021:1473-1)

This update for ceph fixes the following issues : ceph was updated to 14.2.20-402-g6aa76c6815 : - CVE-2021-20288: Fixed unauthorized globalid reuse bsc1183074. - CVE-2020-25678: Do not add sensitive information in Ceph log files bsc1178905. - CVE-2020-27839: Use secure cookies to store JWT Token...

Tokens can get locked and funds lost when minting is disabled in Vader.sol and USDV.sol

Handle 0xRajeev Vulnerability details Impact The flipMinting function can disable/stop conversion/redeeming of VADERUSDV tokens upon DAO approval when that functionality is added. When minting is disabled i.e. false, the convert functions in USDV.sol accept VADER tokens from sender L170 but do no...

Exploit for Server-Side Request Forgery in F5 Big-Ip_Access_Policy_Manager

Vuln Impact This vulnerability allows for unauthenticated at...

CVE-2021-20261

A race condition was found in the Linux kernels implementation of the floppy disk drive controller driver software. The impact of this issue is lessened by the fact that the default permissions on the floppy device /dev/fd0 are restricted to root. If the permissions on the device have changed the...

Buffer not correctly recycled in Gzip Request inflation

Impact If GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection and if an attacker can send a request with a body that is received entirely by not consumed by the application, then a subsequent request on the same connection will see...

GaussDB Kernel: Disabling the Permission to Copy Files on the Server

The enablecopyserverfiles parameter allows users with the sysadmin permission to copy files on the server. However, sensitive files may be viewed or modified by unauthorized users during remote copy operations. Therefore, disable this configuration for databases in the production environment. The...

GaussDB Kernel: Disabling Log Overwriting

The parameter logtruncateonrotation specifies whether GaussDB Kernel deletes or overwrites rather than append the existing log file with the same Name. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respecti...

Tfsec - Security Scanner For Your Terraform Code

tfsec uses static analysis of your terraform templates to spot potential security issues. Now with terraform v0.12+ support. Example Output Installation Install with brew/linuxbrew: brew install tfsec Install with Chocolatey: choco install tfsec You can also grab the binary for your system from t...

Unbreakable Enterprise kernel-container security update

4.14.35-2025.402.2.1.el7 - powercap: restrict energy meter to root access Kanth Ghatraju Orabug: 32040805 CVE-2020-8694 CVE-2020-8695 4.14.35-2025.402.2.el7 - ocfs2: fix remounting needed after setfacl command Gang He - Fix multiple variable definition with syzkaller Hans Westgaard Ry Orabug:...

openGauss: Disabling Log Overwriting

The parameter logtruncateonrotation specifies whether openGauss deletes or overwrites rather than append the existing log file with the same name. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective...

CVE-2020-27152

A stack overflow flaw via an infinite loop condition issue was found in the KVM hypervisor of the Linux kernel. This flaw occurs while processing interrupts because the IRQ state is erroneously set. This flaw allows a guest user to crash the host kernel, resulting in a denial of service. The...

CVE-2020-14144

DISPUTED The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer environments where the documentation was not understood e.g., one viewpoint is that the dangerousness of this feature should be documented immediately above the ENABLEGITHOO...

CVE-2020-8349

An internal security review has identified an unauthenticated remote code execution vulnerability in Cloud Networking Operating System CNOS’ optional REST API management interface. This interface is disabled by default and not vulnerable unless enabled. When enabled, it is only vulnerable where...

CVE-2020-15179 HTML Injection in ScratchSig

The ScratchSig extension for MediaWiki before version 1.0.1 allows stored Cross-Site Scripting. Using tag inside tag, attackers with edit permission can execute scripts on visitors' browser. With MediaWiki JavaScript API, this can potentially lead to privilege escalation and/or account takeover...

Security Bulletin: Vulnerability in SSLv3 affects IBM Sterling Connect:Direct for i5/OS (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM Sterling Connect:Direct for i5/OS. Vulnerability Details CVE-ID: CVE-2014-3566 DESCRIPTION: Product could allow a remote attacker to obtain...