Insecure Session Management

vault uses insecure session management. Vault and Vault Enterprise renewed nearly-expiring token leases and dynamic secret leases with a zero-second TTL, causing them to be treated as non-expiring, and never revoked...

UBUNTU-CVE-2021-25217

In ISC DHCP 4.1-ESV-R1 - 4.1-ESV-R16, ISC DHCP 4.4.0 - 4.4.2 Other branches of ISC DHCP i.e., releases in the 4.0.x series or lower and releases in the 4.3.x series are beyond their End-of-Life EOL and no longer supported by ISC. From inspection it is clear that the defect is also present in...

ISC DHCP 缓冲区错误漏洞

ISC DHCP is a suite of open source Dynamic Host Configuration Protocol server software from ISC Corporation. ISC DHCP suffers from a buffer error vulnerability that stems from a program that may cause dhclient to crash when reading an incorrect lease, which could lead to network connectivity issu...

KB5003240 Setup Dynamic Update for Windows 10, version 2004, 20H2, and 21H1: May 25, 2021

None None...

systemd security, bug fix, and enhancement update

239-45.0.1 - backport upstream pstore tmpfiles patch Orabug: 31420486 - udev rules: fix memory hot add and remove Orabug: 31310273 - fix to enable systemd-pstore.service Orabug: 30951066 - journal: change support URL shown in the catalog entries Orabug: 30853009 - fix to generate...

IBM DB2 代码问题漏洞

IBM DB2 is a set of relational database management system from IBM in the United States. The system is executed on UNIX, Linux, IBMi, z/OS, and Windows server versions. A code issue vulnerability exists in IBM DB2 that allows local users to execute arbitrary code and conduct DLL hijacking attacks...

GHSA-XG2H-WX96-XGXR vulnerabilities

Vulnerabilities for packages: dynamic-localpv-provisioner, dynamic-localpv-provisioner-fips...

GHSA-XG2H-WX96-XGXR vulnerabilities

Vulnerabilities for packages: dynamic-localpv-provisioner...

The installers of ScanSnap Manager may insecurely load Dynamic Link Libraries

Overview The installers of ScanSnap Manager provided by FUJITSU LIMITED contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Yuji Tounai of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated wi...

Installer of Overwolf may insecurely load Dynamic Link Libraries

Overview Overwolf is a software framework for creating applications for games. The Overwolf Installer contains an issue with the DLL search path CWE-427, which may lead to insecurely loading Dynamic Link Libraries stored in the same directory where the installer resides. Shogo kumamaru of LAC Co....

Overwolf 代码问题漏洞

Overwolf is a framework from the Israeli company Overwolf that supports building games using HTML and JavaScript. Overwolf Installer 2.168.0 suffers from a code issue vulnerability that stems from the application loading DLL libraries in an insecure manner. A remote attacker could exploit the...

JVN#65733194: The installers of ScanSnap Manager may insecurely load Dynamic Link Libraries

The installers of ScanSnap Manager provided by FUJITSU LIMITED contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Impact Arbitrary code may be executed with the privilege of the user invoking the installer. Solution Use the latest...

Fujitsu ScanSnap Manager 代码问题漏洞

Fujitsu ScanSnap Manager is a scanner driver required to manage ScanSnap scanned documents from Fujitsu Japan. ScanSnap Manager: A code issue vulnerability exists in versions prior to 7.0L20, which arises from the application loading DLL libraries in an insecure manner. A local attacker could...

Vault Renewed Nearly-Expired Leases With Incorrect Non-Expiring TTLs

Summary Vault and Vault Enterprise “Vault” allowed the renewal of nearly-expired token leases and dynamic secret leases specifically, those within 1 second of their maximum TTL, which caused them to be incorrectly treated as non-expiring during subsequent use. This vulnerability, CVE-2021-32923,...

Fuzzing iOS code on macOS at native speed

Or how iOS apps on macOS work under the hood Posted by Samuel Groß, Project Zero This short post explains how code compiled for iOS can be run natively on Apple Silicon Macs. With the introduction of Apple Silicon Macs, Apple also made it possible to run iOS apps natively on these Macs. This is...

How to Implement Secure and Compliant IaC

Success lies in security True separation of developer and security teams is becoming a thing of the past. Today’s cloud environments enable deployments at previously unheard-of speed and scale; there simply isn’t time to build infrastructure, then code, then hand it all off for security...

The vulnerability in the update process of the Cisco AnyConnect Secure Mobility Client cryptographic security tool for Windows allows a perpetrator to execute arbitrary code with SYSTEM privileges.

The vulnerability in the update process of the Cisco AnyConnect Secure Mobility Client cryptographic security tool for Windows relates to the creation of DLL files with insecure permissions. Exploiting this vulnerability can allow a perpetrator to execute arbitrary code with SYSTEM privileges...

Moderate: Red Hat Security Advisory: python3 security update

An update for python3 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

new module: python39:3.9

An update is available for python-more-itertools, pytest, python-psycopg2, python-lxml, python-PyMySQL, python3x-six, python-toml, python-urllib3, PyYAML, python-attrs, python-iniconfig, python-requests, modwsgi, python3x-pip, python-py, python-chardet, python-pluggy, Cython, python-psutil,...

ALEA-2021:1919 new module: python39:3.9

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. This enhancement...