Debian DLA-2513-1 : p11-kit security update

Several memory safety issues affecting the RPC protocol were fixed in p11-kit, a library providing a way to load and enumerate PKCS11 modules. CVE-2020-29361 Multiple integer overflows CVE-2020-29362 Heap-based buffer over-read For Debian 9 stretch, these problems have been fixed in version...

Fedora 33 : grafana (2020-64e54abd9f)

update to upstream 7.3.6 Note regarding CVE-2020-27846: SAML is not supported in the open source version of Grafana, however the dependency on crewjam/saml is also present in the open source version. This update removes this dependency altogether. Note that Tenable Network Security has extracted...

Delta Electronics DOPSoft

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low skill level to exploit Vendor: Delta Electronics Equipment: DOPSoft Vulnerabilities: Out-of-bounds Write, Untrusted Pointer Dereference 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow arbitrary code execution. 3...

PT-2021-12646 · Mcafee · Mcafee Network Security Management

Name of the Vulnerable Software and Affected Versions: McAfee Network Security Management NSM versions prior to 10.1.7.35 McAfee Network Security Management NSM 9.x versions prior to 9.2.9.55 Description: A Cross Site Request Forgery issue may allow an attacker to change the configuration of the...

Debian DLA-2516-1 : gssproxy security update

It was discovered that there was an issue in the gssproxy privilege separation caused by gssproxy not unlocking condmutex prior to calling pthreadexit. For Debian 9 'Stretch', this problem has been fixed in version 0.5.1-2+deb9u1. We recommend that you upgrade your gssproxy packages. For the...

Forcepoint and Microsoft: Risk-based access control for the remote workforce

This blog post is part of the Microsoft Intelligence Security Association MISA guest blog series. Learn more about MISA here. Adopting cloud-based services as part of an organization’s digital transformation strategy is no longer optional, its a necessity. Last year, only 18 percent of the...

Forcepoint and Microsoft: Risk-based access control for the remote workforce

This blog post is part of the Microsoft Intelligence Security Association MISA guest blog series. Learn more about MISA here. Adopting cloud-based services as part of an organization’s digital transformation strategy is no longer optional, its a necessity. Last year, only 18 percent of the...

EulerOS 2.0 SP9 : unbound (EulerOS-SA-2021-1037)

According to the version of the unbound packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a local vulnerability that...

Fedora 32 : guacamole-server (2020-bfde0ab889)

Updated SPEC file and rebuilt for new dependencies. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

EulerOS 2.0 SP9 : glibc (EulerOS-SA-2021-1005)

According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The iconv function in the GNU C Library aka glibc or libc6 2.30 to 2.32, when converting UCS4 text containing an irreversible character, fails an...

EulerOS 2.0 SP9 : nss (EulerOS-SA-2021-1011)

According to the version of the nss packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - In Network Security Services NSS before 3.46, several cryptographic primitives had missing length checks. In cases where the application calling the...

h1-ctf: h1-ctf : 12 days of hack holiday writeup

Summary This was a real fun CTF and I really enjoyed solving the challenges. Great job on creating the challenges. This is my writeup for the "12 Days of Hacky Holidays CTF". I hope you enjoy reading it, and I hope others reading it will pick up a trick or two. Flags: This is all the flags found...

Mcafee McAfee Network Security Management 跨站请求伪造漏洞

McAfee Network Security Manager NSM is a network security solution from McAfee that enables real-time monitoring of deployed McAfee intrusion prevention systems across the network. A cross-site request forgery vulnerability exists in McAfee Network Security Manager. An attacker could exploit this...

Debian DLA-2510-1 : libdatetime-timezone-perl new upstream release

This update includes the changes in tzdata 2020e for the Perl bindings. For the list of changes, see DLA-2510-1. For Debian 9 stretch, this problem has been fixed in version 1:2.09-1+2020e. We recommend that you upgrade your libdatetime-time zone-perl packages. For the detailed security status of...

SUSE SLES12 Security Update : xen (SUSE-SU-2020:3945-1)

This update for xen fixes the following issues : CVE-2020-29480: Fixed an issue which could have allowed leak of non-sensitive data to administrator guests bsc117949 XSA-115. CVE-2020-29481: Fixed an issue which could have allowd to new domains to inherit existing node permissions bsc1179498...

SQL Injection Vulnerability in the Website Building System of Spiegel Fargo Network Security Information Technology Company Limited (CNVD-2021-01311)

Spiegel Fargo Network Security Information Technology Co., Ltd. was established on 11/09/2007. Legal representative Xu Binglian, the company's scope of business includes: computer network technology development, promotion; network security technology services and consulting. There is a SQL...

Fedora 33 : libmaxminddb (2020-8a8f8b244f)

New version 1.4.3. Security fix for CVE-2020-28241. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

Fedora 33 : mediawiki (2020-0be2d40e13)

https://lists.wikimedia.org/pipermail/mediawiki-announce/2020-December /000268.html Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible witho...

Fedora 32 : xen (2020-df772b417b)

xenstore watch notifications lacking permission checks XSA-115, CVE-2020-29480 1908091 Xenstore: new domains inheriting existing node permissions XSA-322, CVE-2020-29481 1908095 Xenstore: wrong path length check XSA-323, CVE-2020-29482 1908096 Xenstore: guests can crash xenstored via watchs...

SUSE SLES12 Security Update : PackageKit (SUSE-SU-2020:3909-1)

This update for PackageKit fixes the following issues : CVE-2020-16121: Fixed an information disclosure in InstallFiles, GetFilesLocal and GetDetailsLocal bsc1176930. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable...