13669 matches found
SyncBreeze 10.0.28 - (login) Denial of Service Exploit
Exploit Title: SyncBreeze 10.0.28 - 'login' Denial of Service Poc Exploit Author: Ahmed Elkhressy Vendor Homepage: http://www.syncbreeze.com Software Link: http://www.syncbreeze.com/setups/syncbreezeentsetupv10.0.28.exe Version: 10.0.28 Tested on: Windows 7, Windows 10 !/usr/bin/python import...
Virtuozzo 7 : fence-agents-aliyun / fence-agents-all / etc (VZLSA-2020-5003)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:5003 advisory. - python-httplib2: CRLF injection via an attacker controlled unescaped part of uri for httplib2.Http.request function CVE-2020-11078 Note that Nessus...
How to Increase Your Security Posture with Fewer Resources
With the number of COVID-19 cases increasing, another round of attacks is looming over schools and universities as they move into holiday break and prepare for the spring semester. According to a recent article the Wall Street Journal, there have been “nearly three dozen ransomware attacks agains...
VideoBytes: Brute force attacks increase due to more open RDP ports
Hello Folks! In this Videobyte, we’re talking about why brute force attacks are increasing and why that is a problem for everyone. The number of RDP ports exposed to the Internet grew from about three million in January 2020 to over four and a half million in March. The reason for this increase i...
SUSE SLED15 / SLES15 Security Update : PackageKit (SUSE-SU-2020:3845-1)
This update for PackageKit fixes the following issue : CVE-2020-16121: Fixed an Information disclosure in InstallFiles, GetFilesLocal and GetDetailsLocal bsc1176930. Notify service manager when it shutdown and cleanup temporary files when PackageKit quits. bsc1169739 Note that Tenable Network...
The SolarWinds Perfect Storm: Default Password, Access Sales and More
SECOND UPDATE A perfect storm may have come together to make SolarWinds such a successful attack vector for the global supply-chain cyberattack discovered this week. Researchers said that includes its use of a default password “SolarWinds123” that gave attackers an open door into its...
SUSE SLED15 / SLES15 Security Update : Test update for SUSE:SLE-15-SP3:Update (security) (SUSE-SU-2020:3830-1)
This is a security test update for SUSE:SLE-15-SP3:Update Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...
45 Million Medical Images Left Exposed Online
More than 45 million medical images—and the personally identifiable information PII and personal healthcare information PHI associated with them–have been left exposed online due to unsecured technology that’s typically used to store, send and receive medical data, new research has found. A team...
Virtuozzo 7 : java-1.8.0-openjdk / etc (VZLSA-2019-1815)
An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
Fedora 33 : curl (2020-ceaf490686)
curl: Inferior OCSP verification CVE-2020-8286 - libcurl: FTP wildcard stack overflow CVE-2020-8285 - curl: trusting FTP PASV responses CVE-2020-8284 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has...
EulerOS 2.0 SP5 : pki-core (EulerOS-SA-2020-2560)
According to the versions of the pki-core packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A vulnerability was found in all pki-core 10.x.x versions, where the Key Recovery Authority KRA Agent Service did not properly sanitize recove...
Virtuozzo 7 : wget (VZLSA-2019-1228)
An update for wget is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...
EulerOS 2.0 SP5 : nss (EulerOS-SA-2020-2572)
According to the versions of the nss packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in the way NSS handled CCS ChangeCipherSpec messages in TLS 1.3. This flaw allows a remote attacker to send multiple CCS messages,...
Virtuozzo 7 : http-parser / http-parser-devel (VZLSA-2019-2258)
An update for http-parser is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...
Mozilla Firefox < 84.0
The version of Firefox installed on the remote Windows host is prior to 84.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-54 advisory. - The lifecycle of IPC Actors allows managed actors to outlive their manager actors; and the former must ensure that they...
Zilliqa: Using gossip to drain miner wallets
Summary: Using a flaw in the gossip protocol, a malicious shard member can trick any other fellow shard member into signing an arbitrary message. One way this can be exploited is by creating a transaction transferring funds from the account corresponding to a target node's public key; having the...
CVE-2020-25235
Siemens LOGO! 8 BM (incl. SIPLUS variants) is affected by CVE-2020-25235 in all versions prior to 8.3. The vulnerability, categorized as Insufficiently Protected Credentials (CWE-522), allows an attacker with network access to derive valid logins because the authentication password used for the L...
CVE-2019-19287
Siemens XHQ Operations Intelligence prior to version 6.1 contains a relative path traversal vulnerability in the web interface that could allow an unauthenticated remote attacker to traverse the server file system by sending specially crafted packets over the network. Affected: XHQ, all versions
CVE-2020-8169
CVE-2020-8169 affects curl/libcurl 7.62.0–7.70.0. Root cause: libcurl could be tricked into prepending part of a password to the host name before DNS resolution, potentially leaking a partial password over the network and to DNS servers. Impact: information disclosure of partial credentials. Affe...
