2783 matches found
UBUNTU-CVE-2014-4678
The safeeval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4657...
ksh: certain environment variables interpreted as arithmetic expressions on startup, leading to code injection
A flaw was found in the way ksh evaluates certain environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Services and applications that allow remote unauthenticated attackers to provide one of those environment variables...
Siemens SIMATIC S7-1500 (Update A)
1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely Vendor: Siemens Equipment: SIMATIC S7-1500 CPU family Vulnerability: Resource Exhaustion 2. UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled ICSA-20-042-11 Siemens SIMATIC S7-1500 that was...
Siemens OZW Web Server
1. EXECUTIVE SUMMARY CVSS v3 5.3 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: OZW web server Vulnerability: Information disclosure 2. RISK EVALUATION Successful exploitation of this vulnerability could allow unauthenticated users to access project files...
Invoke-APT29: Adversarial Threat Emulation
MITRE recently conducted its second ATT&CK exercise in their ongoing annual series of Endpoint Security Efficacy testing and evaluation. This test focuses on assessing the behavioral capabilities of multiple endpoint security vendors against a simulated adversary, based closely around...
Huawei EulerOS: Security Advisory for oprofile (EulerOS-SA-2019-2644)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
python-reportlab security update
2.3-3.el610.1 - Do not eval strings passed to toColor - Resolves: 1788551...
Evaluating Your Security Controls? Be Sure to Ask the Right Questions
Testing security controls is the only way to know if they are truly defending your organization. With many different testing frameworks and tools to choose from, you have lots of options. But what do you specifically want to know? And how are the findings relevant to the threat landscape you face...
Changing the monolith—Part 2: Whose support do you need?
In Changing the monolith—Part 1: Building alliances for a secure culture, I explored how security leaders can build alliances and why a commitment to change must be signaled from the top. But whose support should you recruit in the first place? In Part 2, I address considerations for the...
Design/Logic Flaw
On EX4300, EX4600, QFX3500, and QFX5100 Series, a vulnerability in the IP firewall filter component may cause the firewall filter evaluation of certain packets to fail. This issue only affects firewall filter evaluation of certain packets destined to the device Routing Engine RE. This issue does...
Types of NetScaler and NetScaler Gateway Licenses
This article describes the types of licenses available for NetScaler and NetScaler Gateway appliances. NetScaler licenses are assigned to physical MPX and virtual VPX appliances. Logical SDX appliances require licenses for each physical appliance and each virtual instance. Refer to NetScaler...
LAVA - Large-scale Automated Vulnerability Addition
Evaluating and improving bug-finding tools is currently difficult due to a shortage of ground truth corpora i.e., software that has known bugs with triggering inputs. LAVA attempts to solve this problem by automatically injecting bugs into software. Every LAVA bug is accompanied by an input that...
DEBIAN-CVE-2014-2686
Ansible prior to 1.5.4 mishandles the evaluation of some strings...
CVE-2014-2686
Ansible prior to 1.5.4 mishandles the evaluation of some strings...
CVE-2014-2686
Ansible prior to 1.5.4 mishandles the evaluation of some strings...
PYSEC-2020-198
Ansible prior to 1.5.4 mishandles the evaluation of some strings...
PYSEC-2020-198
Ansible prior to 1.5.4 mishandles the evaluation of some strings...
CVE-2014-2686
Ansible prior to 1.5.4 mishandles the evaluation of some strings...
