Security Bulletin: A vulnerability in Netty affects the IBM Performance Management product (CVE-2019-16869)

Summary Netty is vulnerable to HTTP request smuggling, caused by a flaw when handling unusual whitespaces before the colon in HTTP headers. By sending a specially-crafted request, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and...

CVE-2020-7278

Exploiting incorrectly configured access control security levels vulnerability in ENS Firewall in McAfee Endpoint Security ENS for Windows prior to 10.7.0 April 2020 and 10.6.1 April 2020 updates allows remote attackers and local users to allow or block unauthorized traffic via pre-existing rules...

Access Restrictions Bypass

The kernel is vulnerable to Access Restrictions Bypass. A missing capability checks were found in the ebtables implementation, used for creating an Ethernet bridge firewall. This could allow a local, unprivileged user to bypass intended capability restrictions and modify ebtables rules...

Privilege Escalation

kdelibs is vulnerable to privilege escalation. The vulnerability exists as a flaw was found in the way Konqueror handled certain FTP PASV commands. A malicious FTP server could use this flaw to perform a rudimentary port-scan of machines behind a user's firewall...

The network location profile changes from "Domain" to "Public" in Windows 7 or in Windows Server 2008 R2

The network location profile changes from "Domain" to "Public" in Windows 7 or in Windows Server 2008 R2 Symptoms On a computer that is running Windows 7 or Windows Server 2008 R2, the network location profile that is selected changes unexpectedly from Domain to Public. Additionally, the firewall...

CVE-2019-10222

A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests. An unauthenticated attacker could crash the Ceph RGW server by sending valid HTTP headers and terminating the connection, resulting in a remote denial of service for Ceph RGW clients. Mitigation T...

CVE-2020-1617

This issue occurs on Juniper Networks Junos OS devices which do not support Advanced Forwarding Interface AFI / Advanced Forwarding Toolkit AFT. Devices using AFI and AFT are not exploitable to this issue. An improper initialization of memory in the packet forwarding architecture in Juniper...

Input validation

This issue occurs on Juniper Networks Junos OS devices which do not support Advanced Forwarding Interface AFI / Advanced Forwarding Toolkit AFT. Devices using AFI and AFT are not exploitable to this issue. An improper initialization of memory in the packet forwarding architecture in Juniper...

CVE-2020-1617 Junos OS: PTX1000 and PTX10000 Series, QFX10000 Series using non-AFT architectures: A specific genuine packet inspected by sFlow will cause a reboot.

This issue occurs on Juniper Networks Junos OS devices which do not support Advanced Forwarding Interface AFI / Advanced Forwarding Toolkit AFT. Devices using AFI and AFT are not exploitable to this issue. An improper initialization of memory in the packet forwarding architecture in Juniper...

CVE-2020-1617

CVE-2020-1617 affects Junos OS on non-AFI/AFT platforms. An improper memory initialization in the packet forwarding architecture can be triggered when a genuine packet is inspected by sFlow through a specific firewall policer, causing a reboot and, after reboot, a core file and another reboot on ...

8x8 Bounty: Open TURN relay abuse is possible due to lack of peer access control (Critical)

NOTE: This is not an SSRF vulnerability but an open TURN relay vulnerability. Typically, this security vulnerability has at least the same impact as an SSRF. However it is considered more useful from an attacker's point of view since attacks are not restricted to HTTP. - Affects: - █████:443 -...

Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Microsoft

CVE-2020-0796-CNA This implementation is based on the POC pro...

CVE-2018-12120

Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with node --debug or node debug, it listens to port 5858 on all interfaces by default. This may allow remote computers to attach to the debug port and evaluate...

How Federal Employees Can Protect their Agencies During the Pandemic

It’s no secret that the way the world works has shifted since COVID-19 came on the scene. Operations are going remote and, for many government and federal agencies, this is new territory. This novelty is compounded by the fact that nation-state attacks are—and have been—on the rise for quite some...

CVE-2019-9946

Cloud Native Computing Foundation CNCF CNI Container Networking Interface 0.7.4 has a network firewall misconfiguration which affects Kubernetes. The CNI 'portmap' plugin, used to setup HostPorts for CNI, inserts rules at the front of the iptables nat chains; which take precedence over the KUBE-...

CVE-2020-5548

Yamaha LTE VoIP RouterNVR700W firmware Rev.15.00.15 and earlier, Yamaha Gigabit VoIP RouterNVR510 firmware Rev.15.01.14 and earlier, Yamaha Gigabit VPN RouterRTX810 firmware Rev.11.01.33 and earlier, RTX830 firmware Rev.15.02.09 and earlier, RTX1200 firmware Rev.10.01.76 and earlier, RTX1210...

CVE-2020-5548

Yamaha LTE VoIP RouterNVR700W firmware Rev.15.00.15 and earlier, Yamaha Gigabit VoIP RouterNVR510 firmware Rev.15.01.14 and earlier, Yamaha Gigabit VPN RouterRTX810 firmware Rev.11.01.33 and earlier, RTX830 firmware Rev.15.02.09 and earlier, RTX1200 firmware Rev.10.01.76 and earlier, RTX1210...

Code injection

Yamaha LTE VoIP RouterNVR700W firmware Rev.15.00.15 and earlier, Yamaha Gigabit VoIP RouterNVR510 firmware Rev.15.01.14 and earlier, Yamaha Gigabit VPN RouterRTX810 firmware Rev.11.01.33 and earlier, RTX830 firmware Rev.15.02.09 and earlier, RTX1200 firmware Rev.10.01.76 and earlier, RTX1210...

CVE-2020-5548

Yamaha LTE VoIP RouterNVR700W firmware Rev.15.00.15 and earlier, Yamaha Gigabit VoIP RouterNVR510 firmware Rev.15.01.14 and earlier, Yamaha Gigabit VPN RouterRTX810 firmware Rev.11.01.33 and earlier, RTX830 firmware Rev.15.02.09 and earlier, RTX1200 firmware Rev.10.01.76 and earlier, RTX1210...

CVE-2020-5548

CVE-2020-5548 affects Yamaha network devices including: LTE VoIP Router NVR700W (firmware ≤15.00.15), Gigabit VoIP Router NVR510 (≤15.01.14), Gigabit VPN Routers RTX810 (≤11.01.33), RTX830 (≤15.02.09), RTX1200 (≤10.01.76), RTX1210 (≤14.01.33), RTX3500 (≤14.00.26), RTX5000 (≤14.00.26), Broadband V...