4209 matches found
CVE-2021-40867
Certain NETGEAR smart switches are affected by an authentication hijacking race-condition vulnerability by an unauthenticated attacker who uses the same source IP address as an admin in the process of logging in e.g., behind the same NAT device, or already in possession of a foothold on an admin'...
Race condition
Certain NETGEAR smart switches are affected by an authentication hijacking race-condition vulnerability by an unauthenticated attacker who uses the same source IP address as an admin in the process of logging in e.g., behind the same NAT device, or already in possession of a foothold on an admin'...
CVE-2021-40867
Certain NETGEAR smart switches are affected by an authentication hijacking race-condition vulnerability by an unauthenticated attacker who uses the same source IP address as an admin in the process of logging in e.g., behind the same NAT device, or already in possession of a foothold on an admin'...
FreeBSD : Python -- multiple vulnerabilities (145ce848-1165-11ec-ac7e-08002789875b)
Python reports : bpo-42278: Replaced usage of tempfile.mktemp with TemporaryDirectory to avoid a potential race condition. bpo-44394: Update the vendored copy of libexpat to 2.4.1 from 2.2.8 to get the fix for the CVE-2013-0340 'Billion Laughs' vulnerability. This copy is most used on Windows and...
ROS-2-641
2.641 Vulnerability in OpenVPN CVE-2020-11810 1. Vulnerability description: A corrective release of the OpenVPN 2.4.9 virtual private networking package has been generated. The new version addresses a vulnerability CVE-2020-11810 that allows a client session to be transferred to a new IP address...
ROS-2-448
2.448 Vulnerability in OpenVPN CVE-2020-11810 1. Vulnerability Description: A corrective release of the OpenVPN Virtual Private Networking Package 2.4.9 has been generated. The new version addresses a vulnerability CVE-2020-11810 that allows a client session to be transferred to a new IP address...
Tor vs VPN—What is the difference?
Our data is a precious commodity and there are plenty of people who would like to get their hands on it, from spouses and marketing teams to crooks and state-sponsored spies. Because of that, tools like Tor and Virtual Private Networks VPNs are growing in popularity. But while both tools can...
ProtonMail logged, shared activist’s IP address with Swiss police
By Waqas ProtonMail is being criticized for sharing French activists IP address with Swiss authorities while claiming it does not save logs. End-to-end encrypted email service provider ProtonMail is currently facing criticism after the company shared the IP address of an anti-gentrification...
Patch now! Netgear fixes serious smart switch vulnerabilities
In a security advisory, NetGear has announced it has fixed three vulnerabilities in firmware updates for several network devices. Most of the affected products are smart switches, some of them with cloud management capabilities that allow for configuring and monitoring them over the web. One of t...
golang: net: incorrect parsing of extraneous zero characters at the beginning of an IP address octet
A flaw was found in golang. Extraneous zero characters at the beginning of an IP address octet are not properly considered which could allow an attacker to bypass IP-based access controls. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...
ProtonMail Logs Activist's IP Address With Authorities After Swiss Court Order
End-to-end encrypted email service provider ProtonMail has drawn criticism after it ceded to a legal request and shared the IP address of anti-gentrification activists with law enforcement authorities, leading to their arrests in France. The Switzerland-based company said it received a "legally...
Critical Auth Bypass Bug Affect NETGEAR Smart Switches — Patch and PoC Released
Networking, storage and security solutions provider Netgear on Friday issued patches to address three security vulnerabilities affecting its smart switches that could be abused by an adversary to gain full control of a vulnerable device. The flaws, which were discovered and reported to Netgear by...
SUSE SLED15: libpython3_9-1_0 / python39 / python39-base / python39-curses / etc (SUSE-SU-2021:2940-1)
The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:2940-1 advisory. - CVE-2021-29921: Fixed improper input validation of octal string IP addresses bsc1185706. - Use versioned python-Sphinx to avoid dependency on...
openSUSE 15 Security Update : python39 (openSUSE-SU-2021:2940-1)
The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:2940-1 advisory. - In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This in some situations...
Security update for python39 (important)
openSUSE Security Update: Security update for python39 Announcement ID: openSUSE-SU-2021:2940-1 Rating: important References: 1183858 1185588 1185706 Cross-References: CVE-2021-29921 CVSS scores: CVE-2021-29921 NVD : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-29921 SUSE: 8.6...
CyberArk Credential File Insufficient Effective Key Space
Vulnerability Details Affected Vendor: CyberArk Affected Product: Application Access Manager/Credential Provider Affected Version: Prior to 12.1 Platform: Linux/Windows/zOS CWE Classification: CWE-326: Inadequate Encryption Strength CVE ID: CVE-2021-31796 2. Vulnerability Description CyberArk...
Design/Logic Flaw
Access Restriction Bypass via referrer spoof was discovered in SolarWinds Web Help Desk 12.7.2. An attacker can access the 'Web Help Desk Getting Started Wizard', especially the admin account creation page, from a non-privileged IP address network range or loopback address by intercepting the HTT...
F5 BIG-IP TMUI Remote Command Execution Vulnerability
F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. A remote command execution vulnerability exists in the F5 BIG-IP TMUI, which can be exploited by an authenticated attacker wi...
Cross-Site Request Forgery (CSRF) in namelessmc/nameless
✍️ Description Attacker able to delete any custom page with CSRF attack. It does not matter at all that your application run in localhost or elsewhere, just it is enough to run on a browser and another low privilege user or attackers know the IP address or hostname of your application. In CSRF...