CVE-2021-25837

Cosmos Network Ethermint = v0.4.0 is affected by cache lifecycle inconsistency in the EVM module. Due to the inconsistency between the Storage caching cycle and the Tx processing cycle, Storage changes caused by a failed transaction are improperly reserved in memory. Although the bad storage cach...

Code injection

Cosmos Network Ethermint = v0.4.0 is affected by cache lifecycle inconsistency in the EVM module. Due to the inconsistency between the Storage caching cycle and the Tx processing cycle, Storage changes caused by a failed transaction are improperly reserved in memory. Although the bad storage cach...

CVE-2021-25836

Cosmos Network Ethermint = v0.4.0 is affected by cache lifecycle inconsistency in the EVM module. The bytecode set in a FAILED transaction wrongfully remains in memorystateObject.code and is further written to persistent store at the Endblock stage, which may be utilized to build honeypot contrac...

CVE-2021-25837

Cosmos Network Ethermint = v0.4.0 is affected by cache lifecycle inconsistency in the EVM module. Due to the inconsistency between the Storage caching cycle and the Tx processing cycle, Storage changes caused by a failed transaction are improperly reserved in memory. Although the bad storage cach...

Cosmos Network Ethermint Security Vulnerability

KamiD Cosmos Network Ethermint is a pre-alpha software from the US-based KamiD Personal Organization. It provides a scalable, high-throughput proof-of-stake blockchain that is fully compatible and interoperable with Ether.Cosmos Network Ethermint is a scalable, high-throughput proof-of-stake...

Cosmos Network Ethermint Security Vulnerability

Cosmos Network Ethermint is a scalable, high-throughput Proof-of-Stake blockchain from Cosmos Network, Inc. It is fully compatible and interoperable with Ethermint. It is built using the Cosmos SDK, which runs on top of the Tendermint Core consensus engine. A security vulnerability exists in Cosm...

An issue has been found in libsndfile 1.0.28. There is a memory leak in psf_allocate in common.c as demonstrated by sndfile-convert. NOTE: The maintainer and third parties were unable to reproduce and closed the issue

...

The vulnerability of the TrueConf software lies in its lack of mechanisms to limit the number of authentication attempts. This allows a violator to lock out a user’s account.

The vulnerability of the TrueConf software is related to deficiencies in the mechanism for limiting the number of authentication attempts. Exploiting this vulnerability could allow a malicious actor to lock out a user’s account by attempting more than 10 unsuccessful password entries...

Metasploit Tips and Tricks for HaXmas 2020

For this year's HaXmas, we're giving the gift of Metasploit knowledge! We'll cover a mix of old, new, or recently improved features that you can incorporate into your workflows. Some of our readers may already know these tips and tricks for using Metasploit, but for the others who aren't aware of...

Cannot Complete Your Request Error only occurs to certain users connecting from ADC with Azure MFA over to Storefront

Certain users are receiving Cannot Complete Your Request Error when accessing site via ADC url and after entering their Azure MFA credentials and user is redirected to Storefront's URL, then the error is observed. On the Storefront Server we see the following Event: Log Name: Citrix Delivery...

CVE-2020-8936

An arbitrary memory overwrite vulnerability in Asylo versions up to 0.6.0 allows an attacker to make a host call to UntrustedCall. UntrustedCall failed to validate the buffer range within sgxparams and allowed the host to return a pointer that was an address within the enclave memory. This allowe...

nanorand 0.5.0 - RNGs failed to generate properly for non-64-bit numbers

In versions of nanorand prior to 0.5.1, RandomGen implementations for standard unsigned integers could fail to properly generate numbers, due to using bit-shifting to truncate a 64-bit number, rather than just an as conversion. This often manifested as RNGs returning nothing but 0, including the...

GaussDB Kernel: Configuring the Upper Limit of Failed Login Attempts

You are advised to set the upper limit of failed login attempts to protect passwords from brute-force attacks. After the parameter failedloginattempts is set, an account will be automatically locked if the number of its failed login attempts exceeds the parameter value. Copyright C 2020 Greenbone...

CVE-2020-12926

The Trusted Platform Modules TPM reference software may not properly track the number of times a failed shutdown happens. This can leave the TPM in a state where confidential key material in the TPM may be able to be compromised. AMD believes that the attack requires physical access of the device...

openGauss: Configuring the Upper Limit of Failed Login Attempts

You are advised to set the upper limit of failed login attempts to protect passwords from brute-force attacks. After the parameter failedloginattempts is set, an account will be automatically locked if the number of its failed login attempts exceeds the parameter value. Copyright C 2020 Greenbone...

CVE-2020-15931

Netwrix Account Lockout Examiner before 5.1 allows remote attackers to capture the Net-NTLMv1/v2 authentication challenge hash of the Domain Administrator that is configured within the product in its installation state by generating a single Kerberos Pre-Authentication Failed ID 4771 event on a...

CVE-2020-15931

Netwrix Account Lockout Examiner before 5.1 allows remote attackers to capture the Net-NTLMv1/v2 authentication challenge hash of the Domain Administrator that is configured within the product in its installation state by generating a single Kerberos Pre-Authentication Failed ID 4771 event on a...

CVE-2020-15931: Exposure of Sensitive Information to an Unauthorized Actor

Netwrix Account Lockout Examiner before 5.1 allows remote attackers to capture the Net-NTLMv1/v2 authentication challenge hash of the Domain Administrator that is configured within the product in its installation state by generating a single Kerberos Pre-Authentication Failed ID 4771 event on a...

PT-2020-14724

Name of the Vulnerable Software and Affected Versions Netwrix Account Lockout Examiner versions prior to 5.1 Description The issue allows remote attackers to capture the Net-NTLMv1/v2 authentication challenge hash of the Domain Administrator by generating a single Kerberos Pre-Authentication Fail...

Security update for samba (important)

openSUSE Security Update: Security update for samba Announcement ID: openSUSE-SU-2020:1526-1 Rating: important References: 1176579 Cross-References: CVE-2020-1472 Affected Products: openSUSE Leap 15.2 An update that fixes one vulnerability is now available. Description: This update for samba fixe...