CVE-2020-14341

The "Test Connection" available in v7.x of the Red Hat Single Sign On application console can permit an authorized user to cause SMTP connections to be attempted to arbitrary hosts and ports of the user's choosing, and originating from the RHSSO installation. By observing differences in the timin...

CVE-2021-21469

When security guidelines for SAP NetWeaver Master Data Management running on windows have not been thoroughly reviewed, it might be possible for an external operator to try and set custom paths in the MDS server configuration. When no adequate protection has been enforced on any level e.g., MDS...

Debian DLA-2520-1 : golang-websocket security update

There was an integer overflow vulnerability concerning the length of websocket frames received via a websocket connection. An attacker could use this flaw to cause a denial of service attack on an HTTP Server allowing websocket connections. For Debian 9 stretch, this problem has been fixed in...

Fedora 32 : mingw-binutils (2020-28c78a6ac3)

Backport patches for CVE-2020-35493, CVE-2020-35494, CVE-2020-35495, CVE-2020-35496. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible...

Microsoft Teams < 1.3.0.13000 Remote Code Execution

The version of Microsoft Teams installed on the remote Windows host is a version prior to 1.3.0.13000. It is, therefore, affected by remote code execution vulnerability. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number....

Denial of Service Vulnerability in Mercuery X18G Routers

The business scope of Shenzhen Meike Star Communication Technology Co., Ltd. includes the technical development of computer wireless LAN products, computer hardware and software, communication equipment, electronic products and network security equipment. A denial of service vulnerability exists ...

Russia’s SolarWinds Attack and Software Security

The information that is emerging about Russias extensive cyberintelligence operation against the United States and other countries should be increasingly alarming to the public. The magnitude of the hacking, now believed to have affected more than 250 federal agencies and businesses -- ­primarily...

Waychar enrollment system suffers from SQL injection vulnerability (CNVD-2021-03387)

Guangzhou City Huadu District Xinhua Weichuang Advertising Design Service Department business scope includes: advertising, network information technology promotion services, network security information consulting. Waychar enrollment system has a SQL injection vulnerability, which can be exploite...

Waychar enrollment system suffers from SQL injection vulnerability (CNVD-2021-03395)

Guangzhou City Huadu District Xinhua Weichuang Advertising Design Service Department business scope includes: advertising, network information technology promotion services, network security information consulting. Waychar enrollment system has a SQL injection vulnerability, which can be exploite...

NSA Urges SysAdmins to Replace Obsolete TLS Protocols

The National Security Agency NSA is lighting a fire under system administrators who are dragging their feet to replace insecure and outdated Transport Layer Security TLS protocol instances. The agency this week released new guidance and tools to equip companies to update from obsolete older...

McAfee Network Security Manager Cross-Site Request Forgery Vulnerability

McAfee Network Security Manager NSM is a network security solution from McAfee that enables real-time monitoring of deployed McAfee intrusion prevention systems across the network. A cross-site request forgery vulnerability exists in McAfee Network Security Manager. An attacker could exploit this...

SUSE SLED15 / SLES15 Security Update : ceph (SUSE-SU-2021:0023-1)

This update for ceph fixes the following issues : Security issues fixed : CVE-2020-27781: Fixed a privilege escalation via the cephvolumeclient Python interface bsc1179802 bsc1180155. Non-security issues fixed : Fixes an issue when check in legacy collection reaches end. bsc1179139 Fixes an issue...

SUSE SLES12 Security Update : java-1_8_0-ibm (SUSE-SU-2021:0032-1)

This update for java-180-ibm fixes the following issues : Update to Java 8.0 Service Refresh 6 Fix Pack 20 bsc1180063,bsc1177943 CVE-2020-14792 CVE-2020-14797 CVE-2020-14781 CVE-2020-14779 CVE-2020-14798 CVE-2020-14796 CVE-2020-14803 - Class libraries : - SOCKETADAPTOR$SOCKETINPUTSTREAM.READ is...

CVE-2020-7336

Cross Site Request Forgery vulnerability in McAfee Network Security Management NSM prior to 10.1.7.35 and NSM 9.x prior to 9.2.9.55 may allow an attacker to change the configuration of the Network Security Manager via a carefully crafted HTTP request...

CVE-2020-7336

Cross Site Request Forgery vulnerability in McAfee Network Security Management NSM prior to 10.1.7.35 and NSM 9.x prior to 9.2.9.55 may allow an attacker to change the configuration of the Network Security Manager via a carefully crafted HTTP request...

Cross site request forgery (csrf)

Cross Site Request Forgery vulnerability in McAfee Network Security Management NSM prior to 10.1.7.35 and NSM 9.x prior to 9.2.9.55 may allow an attacker to change the configuration of the Network Security Manager via a carefully crafted HTTP request...

CVE-2020-7336

McAfee Network Security Manager (NSM) is affected by CVE-2020-7336, a Cross-Site Request Forgery (CSRF) vulnerability that could allow an attacker to change NSM configuration via a crafted HTTP request. Affected versions are NSM prior to 10.1.7.35 and NSM 9.x prior to 9.2.9.55. If exploited, the ...

CVE-2020-7336 Network Security Management (NSM) - Cross Site Request Forgery vulnerability

Cross Site Request Forgery vulnerability in McAfee Network Security Management NSM prior to 10.1.7.35 and NSM 9.x prior to 9.2.9.55 may allow an attacker to change the configuration of the Network Security Manager via a carefully crafted HTTP request...

GE Reason RT43X Clocks

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: GE Equipment: Reason RT43X Clocks Vulnerabilities: Code Injection, Use of Hard-coded Cryptographic Key 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an...

Fedora 33 : grafana (2020-64e54abd9f)

update to upstream 7.3.6 Note regarding CVE-2020-27846: SAML is not supported in the open source version of Grafana, however the dependency on crewjam/saml is also present in the open source version. This update removes this dependency altogether. Note that Tenable Network Security has extracted...