Attack Analytics Multi-Sensor Integrations Provide Unmatched Visibility

Since debuting Attack Analytics back in 2018, this groundbreaking security analytics functionality has come a long way. Time and again our customers have told us how powerful they find the tool and how much time it saves them. Attack Analytics better positions Imperva’s customers to focus on what...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.3.25 security update

Red Hat OpenShift Container Platform release 4.3.25 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which...

Schneider Electric Vijeo Designer and Vijeo Designer Basic Trust Management Issues Vulnerability

Schneider Electric Vijeo Designer Basic and Schneider Electric Vijeo Designer are both a suite of programming and design software for HMIs Human Machine Interfaces from Schneider Electric, France. A vulnerability exists in Schneider Electric Vijeo Designer Basic and Vijeo Designer due to a trust...

Ubuntu: Security Advisory (USN-4397-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : NSS vulnerabilities (USN-4397-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4397-1 advisory. It was discovered that NSS incorrectly handled the TLS State Machine. A remote attacker could possibly use this issue to cause NS...

USN-4397-1: NSS vulnerabilities

It was discovered that NSS incorrectly handled the TLS State Machine. A remote attacker could possibly use this issue to cause NSS to hang, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 19.10. CVE-2019-17023 Cesar Pereida Garcia discovered that NSS...

USN-4397-1 nss vulnerabilities

It was discovered that NSS incorrectly handled the TLS State Machine. A remote attacker could possibly use this issue to cause NSS to hang, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 19.10. CVE-2019-17023 Cesar Pereida Garcia discovered that NSS...

Machine-in-the-middle response injection attack when using STARTTLS with IMAP, POP3, and SMTP

mutt 1.14.4 updates: CVE-2020-14954 - Machine-in-the-middle response injection attack when using STARTTLS with IMAP, POP3, and SMTP...

vasto

This is a copy of the VASTO exploit kit for virtualization platforms. The kit consists of two modules: Abiquo Guest Stealer and Abiquo Poison. Abiquo Guest Stealer is a module that exploits a path traversal vulnerability in Abiquo's REST APIs to retrieve files on the remote system under the Tomca...

Updating vCPU in Nutanix prov scheme via Powershell, new machines are not getting the new setting

Tried to decrease the number of cores per vCPU in a Nutanix machine catalog. However, the new machines did not have the desired change...

Kubernetes Falls to Cryptomining via Machine-Learning Framework

A unique cyberattack campaign that targets Kubeflow, a machine-learning toolkit for Kubernetes, has affected large swathes of container clusters, according to Microsoft. The Kubeflow open-source project is a popular framework for running machine-learning ML tasks in Kubernetes. According to an...

Another Intel Speculative Execution Vulnerability

Remember Spectre and Meltdown? Back in early 2018, I wrote: Spectre and Meltdown are pretty catastrophic vulnerabilities, but they only affect the confidentiality of data. Now that they -- and the research into the Intel ME vulnerability -- have shown researchers where to look, more is coming --...

Unspecified Vulnerability in Kata Containers

Kata Containers is an open source lightweight virtual machine builder from the Kata Containers community. A security vulnerability in Kata Containers versions 1.11 prior to 1.11.1, 1.10 prior to 1.10.5, and 1.9 and earlier can be exploited by an attacker to execute code and impersonate a kata age...

Misconfigured Kubeflow workloads are a security risk

Azure Security Center ASC monitors and defends thousands of Kubernetes clusters running on top of AKS. Azure Security Center regularly searches for and research for new attack vectors against Kubernetes workloads. We recently published a blog post about a large scale campaign against Kubernetes...

Availability Attacks against Neural Networks

New research on using specially crafted inputs to slow down machine-learning neural network systems: Sponge Examples: Energy-Latency Attacks on Neural Networks shows how to find adversarial examples that cause a DNN to burn more energy, take more time, or both. They affect a wide range of DNN...

Advantech WebAccess Node Buffer Overflow Vulnerability (CNVD-2020-32232)

Advantech WebAccess browser-based HMI and SCADA software. A buffer overflow vulnerability exists in Advantech WebAccess Node, which can be exploited by an attacker to remotely execute code...

DEBIAN-CVE-2020-13800

ati-vga in hw/display/ati.c in QEMU 4.2.0 allows guest OS users to trigger infinite recursion via a crafted mmindex value during an atimmread or atimmwrite call...

Multiple Cisco Products Input Validation Error Vulnerability (CNVD-2020-31994)

Cisco 809 Industrial Integrated Services Routers are products of Cisco Corporation.Cisco 809 Industrial Integrated Services Routers are industrial integrated multi-service routers.Cisco 829 Industrial Integrated Services Routers are industrial integrated multi-service routers.Cisco 1000 Series...

Cisco IOS and IOS XE Denial of Service Vulnerability (CNVD-2020-31826)

Cisco IOS and IOS XE are a set of operating systems developed by Cisco for its network devices. A security vulnerability exists in the Secure Shell SSH server code in Cisco IOS Software and Cisco IOS XE Software, which stems from the SSH state machine not properly representing internal state. An...

CVE-2020-3200

A vulnerability in the Secure Shell SSH server code of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause an affected device to reload. The vulnerability is due to an internal state not being represented correctly in the SSH state machine, which...