openSUSE Security Update : libX11 (openSUSE-2020-1162)

This update for libX11 fixes the following issues : - Fixed XIM client heap overflows CVE-2020-14344, bsc1174628 This update was imported from the SUSE:SLE-15:Update update project. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUS...

SQL Injection Vulnerability in Website Building System of Shenzhen Shenzhou Tongda Network Technology Co.

Shenzhen Shenzhou Tongda Network Technology Co., Ltd, provides Tencent enterprise mailbox, high-end website construction PC website, cell phone website, WeChat public account, SEO optimization and promotion, enterprise WeChat and other network infrastructure services and network marketing and...

CVE-2020-15054

TP-Link USB Network Server TL-PS310U devices before 2.079.000.t0210 allow an attacker on the same network to elevate privileges because the administrative password can be discovered by sniffing unencrypted UDP traffic...

CVE-2020-15058

The CVE-2020-15058 entry concerns Lindy 42633 4-Port USB 2.0 Gigabit Network Server (version 2.078.000). A flaw allows an attacker on the same network to elevate privileges because the administrative password can be discovered by sniffing unencrypted UDP traffic. The root cause is the exposure of...

CVE-2020-15056

CVE-2020-15056 affects TP-Link TL-PS310U USB Network Server devices up to version 2.079.000.t0210. Affected function is the server name setting under administrative privileges, allowing an attacker on the same network to perform persistent cross-site scripting via a crafted server name. The vulne...

How COVID-19 Has Changed Business Cybersecurity Priorities Forever

For much of this year, IT professionals all over the globe have had their hands full, finding ways to help businesses cope with the fallout of the coronavirus COVID-19 pandemic. In many cases, it involved a rapid rollout of significant remote work infrastructure. That infrastructure was called in...

Scientific Linux Security Update : thunderbird on SL7.x x86_64 (20200806)

Security Fixes : - chromium-browser: Use after free in ANGLE CVE-2020-6463 - chromium-browser: Inappropriate implementation in WebRTC CVE-2020-6514 - Mozilla: Potential leak of redirect targets when loading scripts in a worker CVE-2020-15652 - Mozilla: Memory safety bugs fixed in Firefox 79 and...

Cisco UCS Director Stored Cross-Site Scripting Vulnerability (cisco-sa-ucs-director-xss-O7T8ORYR)

According to its self-reported version, Cisco UCS Director is affected by a vulnerability. Please see the included Cisco BIDs and Cisco Security Advisory for more information. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid139413; scriptversion"1.5";...

Fedora 32 : cutter-re / radare2 (2020-aa51efe207)

Rebase radare2 to upstream version 4.5.0 - Rebase cutter to upstream version 1.11.0 - Provide cutter translation - Provide -devel sub package of cutter-re Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has...

SUSE SLES12 Security Update : kernel (SUSE-SU-2020:2119-1)

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : CVE-2020-15780: A lockdown bypass for loading unsigned modules using ACPI table injection was fixed. bsc1173573 CVE-2020-15393: Fixed a memory leak in...

SUSE SLED15 / SLES15 Security Update : MozillaFirefox (SUSE-SU-2020:2118-1)

This update for MozillaFirefox fixes the following issues : Firefox Extended Support Release 78.1.0 ESR - Fixed: Various stability, functionality, and security fixes bsc1174538 - CVE-2020-15652: Potential leak of redirect targets when loading scripts in a worker - CVE-2020-6514: WebRTC data chann...

Fedora 32 : python37 (2020-87c0a0a52d)

Security fix for CVE-2019-20907, CVE-2020-14422. Provide a versioned pathfix3.7.py command. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possib...

Fedora 32 : python36 (2020-1ddd5273d6)

Security fix for CVE-2019-20907, CVE-2020-14422. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C...

SUSE SLES12 Security Update : libX11 (SUSE-SU-2020:2117-1)

This update for libX11 fixes the following issues : Fixed XIM client heap overflows CVE-2020-14344, bsc1174628 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as...

Debian DLA-2312-1 : libx11 security update

Todd Carson discovered some integer overflows in libX11, which could lead to heap corruption when processing crafted messages from an input method. For Debian 9 stretch, this problem has been fixed in version 2:1.6.4-3+deb9u2. We recommend that you upgrade your libx11 packages. For the detailed...

Pi-hole 4.3.2 - Remote Code Execution (Authenticated) Exploit

Exploit for linux platform in category web applications !/usr/bin/env python2 Exploit Title: Pi-hole 4.3.2 - Remote Code Execution Authenticated Date: 2020-08-04 Exploit Author: Luis Vacas @CyberVaca Vendor Homepage: https://pi-hole.net/ Software Link: https://github.com/pi-hole/pi-hole Version: ...

nss: Use-after-free in sftk_FreeSession due to improper refcounting

A use-after-free flaw was found in Mozilla Network Security Services NSS related to PK11 session handling. An attacker could use this flaw to execute arbitrary code with the permissions of the user running the application compiled with NSS...

nss: Timing attack on DSA signature generation

A flaw was found in the DSA signature generation function in nss. During the process of generating a DSA signature, the nonce value 'k' is not padded, exposing the bit length. Combined with other techniques, this can result in the recovery of the DSA private key. The highest threat from this...

Moderate: Red Hat Security Advisory: nss and nspr security, bug fix, and enhancement update

An update for nss and nspr is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

nss: TLS 1.3 HelloRetryRequest downgrade request sets client into invalid state

A protocol downgrade flaw was found in Network Security Services NSS. After a HelloRetryRequest has been sent, the client may negotiate a lower protocol than TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data...