SUSE-SU-2020:3054-1 Security update for pacemaker

This update for pacemaker fixes the following issues: Update to 2.0.4: - based: use crmexit to free qb-logging - cibsecret: don't use pssh -q option unless supported - crmerror: use gfree for a proper match - crmmon: NULL output-pointer when buffer is freed - crmresource: avoid unnecessary issus...

Juniper Networks Junos OS Input Validation Error Vulnerability (CNVD-2020-59743)

Juniper Networks Junos OS is a Juniper Networks network operating system designed for use with Juniper Networks hardware devices. The operating system provides a secure programming interface and the Junos SDK.Junos OS Evolved is an upgraded version of Junos OS. Junos OS has a security vulnerabili...

webpack-subresource-integrity data forgery issue vulnerability

webpack-subresource-integrity is a personal developer's npm extension for website static file security. The library generates an encrypted hash code that can be used to verify that files fetched by the browser e.g. from a CDN are secure. A webpack plugin vulnerability exists in versions prior to...

Emotet Malware

Summary This Alert uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge ATT &CK® framework. See the ATT&CK for Enterprise framework for all referenced threat actor techniques. This product was written by the Cybersecurity and Infrastructure Security Agency CISA and the Multi-State...

Windows Migration Assistant < 2.2.0.0 Arbitrary Code Execution (HT211186)

According to its self-reported version number, the version of Windows Migration Assistant installed on the remote host is prior to 2.2.0.0. It is, therefore, affected by an arbitrary code execution vulnerability due to a dynamic library loading issue. An unauthenticated, local attacker can exploi...

CVE-2020-10140

Acronis True Image 2021 fails to properly set ACLs of the C:\ProgramData\Acronis directory. Because some privileged processes are executed from the C:\ProgramData\Acronis, an unprivileged user can achieve arbitrary code execution with SYSTEM privileges by placing a DLL in one of several paths...

OpenEXR security update

CentOS Errata and Security Advisory CESA-2020:4039 An update for OpenEXR is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Dynamic Data Resolver - Version 1.0.1 beta

By Holger Unterbrink. Cisco Talos is releasing a new beta version of Dynamic Data Resolver DDR today. This release comes with a new architecture for samples using multi-threading. The process and thread tracing has been completely reimplemented. We also fixed a few bugs and memory leaks. Another...

GHSA-4FC4-CHG7-H8GH Unprotected dynamically loaded chunks

Impact All dynamically loaded chunks receive an invalid integrity hash that is ignored by the browser, and therefore the browser cannot validate their integrity. This removes the additional level of protection offered by SRI for such chunks. Top-level chunks are unaffected. Patches This issue is...

Remote code execution

A iccselectdymicparam expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center iMC versions: Prior to iMC PLAT 7.3 E0705P07...

CVE-2020-7175

A iccselectdymicparam expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center iMC versions: Prior to iMC PLAT 7.3 E0705P07...

Overlay Malware Targets Windows Users with a DLL Hijack Twist

Brazilians are being warned of a new overlay malware targeting Windows users in order to siphon victims’ financial data and drain their bank accounts. Researchers say what the malware, dubbed Vizom, lacks in sophistication it makes up for in its creative abuse of the Windows ecosystem. Trusteer, ...

Acronis True Image Access Control Error Vulnerability

Acronis True Image is a famous data backup and restore software from Acronis Singapore. The software can be used to create drive and disk images and can restore the image when a clean system is needed. Acronis True Image version 2021 suffers from an Access Control Error vulnerability that stems...

DLL Hijacking Vulnerability in Haiwell's Cloud SCADA Cloud Configuration Software

Haiwell Haiwell cloud configuration software Cloud SCADA is an industrial automation monitoring and management platform software developed by Xiamen Haiwell Technology Co. A DLL hijacking vulnerability exists in Haiwell Cloud SCADA. An attacker can exploit this vulnerability to load a malicious d...

CVE-2020-1671

On Juniper Networks Junos OS platforms configured as DHCPv6 local server or DHCPv6 Relay Agent, Juniper Networks Dynamic Host Configuration Protocol Daemon JDHCPD process might crash with a core dump if a malformed DHCPv6 packet is received, resulting with the restart of the daemon. This issue on...

CVE-2020-1661 Junos OS: jdhcpd process crash when forwarding a malformed DHCP packet.

On Juniper Networks Junos OS devices configured as a DHCP forwarder, the Juniper Networks Dynamic Host Configuration Protocol Daemon jdhcp process might crash when receiving a malformed DHCP packet. This issue only affects devices configured as DHCP forwarder with forward-only option, that forwar...

Xiamen Printmaster PDF to WORD Command Execution Vulnerability in Xiamen Printmaster Information Technology Co.

Turn Master PDF to word converter can provide free online PDF to word service. Xiamen Printed Information Technology Co., Ltd. to turn the master PDF to WORD there is a command execution vulnerability, an attacker can be used to exploit the vulnerability in the client process to inject an...

CVE-2020-8338

A DLL search path vulnerability was reported in Lenovo Diagnostics prior to version 4.35.4 that could allow a user with local access to execute code on the system...

The vulnerability of the process-interaction channel of the Cisco AnyConnect Secure Mobility Client software allows a perpetrator to execute arbitrary code.

The vulnerability of the process-interaction channel of the Cisco AnyConnect Secure Mobility Client software-related client software is related to errors in the mechanism for checking the path to dynamically attached libraries. Exploiting this vulnerability can allow an attacker to execute...

The vulnerability of the DHCPv6 subsystem in implementations of Intel Active Management Technology and Standard Manageability allows a intruder to gain unauthorized access to protected information.

The vulnerability of the DHCPv6 subsystem in Intel Active Management Technology and Standard Manageability implementations is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access t...