Johnson Controls Sensormatic Electronics KT-1

1. EXECUTIVE SUMMARY CVSS v3 8.6 ATTENTION: Exploitable remotely/low attack complexity Vendor: Sensormatic Electronics, LLC., a subsidiary of Johnson Controls, Inc. Equipment: KT-1 Vulnerability: Authentication Bypass by Capture-replay 2. RISK EVALUATION Successful exploitation of this...

Xiaomi Mi WiFi suffers from an arbitrary file read vulnerability

Founded on March 3, 2010, Xiaomi Technology Co., Ltd. is a globalized mobile Internet enterprise focusing on the research and development of smart hardware and electronic products, as well as an innovative technology enterprise focusing on the construction of high-end smartphones, Internet TVs an...

FTC bans SpyFone and its CEO from continuing to sell stalkerware

Nearly two years after the US Federal Trade Commission first took aim against mobile apps that can non-consensually track people’s locations and pry into their emails, photos, and videos, the government agency placed restrictions Wednesday on the developers of SpyFone—which the FTC called a...

Epic Games Rocket League 1.95 (AK::MemoryMgr::GetPoolName) Stack Buffer Overrun

Summary Rocket League is a high-powered hybrid of arcade-style soccer and vehicular mayhem with easy-to-understand controls and fluid, physics-driven competition. Description The game suffers from a stack-based buffer overflow vulnerability. The issue is caused due to a boundary error in the...

openSUSE Security Update : clamav (openSUSE-2021-555)

This update for clamav fixes the following issues : - CVE-2021-1252: Fix for Excel XLM parser infinite loop. bsc1184532 - CVE-2021-1404: Fix for PDF parser buffer over-read; possible crash. bsc1184533 - CVE-2021-1405: Fix for mail parser NULL-dereference crash. bsc1184534 - Fix errors when scanni...

openSUSE Security Update : nghttp2 (openSUSE-2021-468)

This update for nghttp2 fixes the following issues : - CVE-2020-11080: HTTP/2 Large Settings Frame DoS bsc1181358 This update was imported from the SUSE:SLE-15:Update update project. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSU...

openSUSE Security Update : velocity (openSUSE-2021-447)

This update for velocity fixes the following issues : - CVE-2020-13936: Fixed an arbitrary code execution when attacker is able to modify templates bsc1183360. This update was imported from the SUSE:SLE-15-SP2:Update update project. C Tenable Network Security, Inc. The descriptive text and packag...

Fixed in Apache Tomcat 9.0.44

Important: Denial of Service CVE-2021-41079 When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service. This was fixed with commit d4b340fa. This issue was first reported to the Apach...

openSUSE Security Update : bind (openSUSE-2021-386)

This update for bind fixes the following issues : - dnssec-keygen can no longer generate HMAC keys. Use tsig-keygen instead. bsc1180933 This update was imported from the SUSE:SLE-15:Update update project. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

openSUSE Security Update : bind (openSUSE-2021-375)

This update for bind fixes the following issues : - CVE-2020-8625: A vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack bsc1182246 This update was imported from the SUSE:SLE-15:Update update project. C Tenable Network Security, Inc. The...

CVE-2022-3218

Due to a reliance on client-side authentication, the WiFi Mouse Mouse Server from Necta LLC's authentication mechanism is trivially bypassed, which can result in remote code execution...

openSUSE Security Update : segv_handler (openSUSE-2021-198)

This update for segvhandler fixes the following issues : - Replace by empty package with README explaining the removal for security reasons boo1180665. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update...

openSUSE Security Update : hawk2 (openSUSE-2021-54)

This update for hawk2 fixes the following security issue : - CVE-2020-35458: Fixed an insufficient input handler that could have led to remote code execution bsc1179998. This update was imported from the SUSE:SLE-15:Update update project. C Tenable Network Security, Inc. The descriptive text and...

openSUSE Security Update : slurm_18_08 (openSUSE-2020-2286)

This update for slurm1808 fixes the following issues : Security issues fixed : - CVE-2020-27745: Fixed a potential buffer overflow from use of unpackmem bsc1178890. - CVE-2020-27746: Fixed a potential leak of the magic cookie when sent as an argument to the xauth command bsc1178891. This update w...

openSUSE Security Update : MozillaFirefox (openSUSE-2021-63)

This update for MozillaFirefox fixes the following issues : - Firefox Extended Support Release 78.6.1 ESR - Fixed: Critical security issue MFSA 2021-01 bsc1180623 - CVE-2020-16044 Use-after-free write when handling a malicious COOKIE-ECHO SCTP chunk This update was imported from the...

openSUSE Security Update : libqt5-qtbase (openSUSE-2020-2142)

This update for libqt5-qtbase fixes the following issues : - CVE-2020-17507: Fixed a buffer overflow in XBM parser bsc1176315 - Fixed various issues discovered by fuzzing : - Made handling of XDGRUNTIMEDIR more secure bsc1172515 : This update was imported from the SUSE:SLE-15-SP2:Update update...

openSUSE Security Update : wireshark (openSUSE-2020-1882)

This update for wireshark fixes the following issues : - Update to wireshark 3.2.7 : - CVE-2020-25863: MIME Multipart dissector crash bsc1176908 - CVE-2020-25862: TCP dissector crash bsc1176909 - CVE-2020-25866: BLIP dissector crash bsc1176910 - CVE-2020-17498: Kafka dissector crash bsc1175204 Th...

openSUSE Security Update : tiff (openSUSE-2020-1840)

This update for tiff fixes the following issues : - CVE-2019-14973: Fixed an improper check which was depended on the compiler which could have led to integer overflow bsc1146608. This update was imported from the SUSE:SLE-15:Update update project. C Tenable Network Security, Inc. The descriptive...

openSUSE Security Update : spice-gtk (openSUSE-2020-1803)

This update for spice-gtk fixes the following issues : - CVE-2020-14355: Fixed multiple buffer overflow vulnerabilities in QUIC image decoding bsc1177158. This update was imported from the SUSE:SLE-15-SP2:Update update project. C Tenable Network Security, Inc. The descriptive text and package...

ReQuest Serious Play F3 Media Server 7.0.3 - Remote Code Execution (Unauthenticated)

Exploit Title: ReQuest Serious Play F3 Media Server 7.0.3 - Remote Code Execution Unauthenticated Exploit Author: LiquidWorm Software Link: http://request.com/ Version: 3.0.0 !/usr/bin/env python3 -- coding: utf-8 -- ReQuest Serious Play F3 Media Server 7.0.3 Unauthenticated Remote Code Execution...