13669 matches found
June 9, 2020—KB4561669 (Security-only update)
None None...
Debian DLA-2239-1 : libpam-tacplus security update
It was discovered that there was an issue in libpam-tacplus a security module for using the TACACS+ authentication service where shared secrets such as private server keys were being added in the clear to various logs. For Debian 8 'Jessie', this issue has been fixed in libpam-tacplus version...
Debian DLA-2238-1 : libupnp security update
libupnp, the portable SDK for UPnP Devices allows remote attackers to cause a denial of service crash via a crafted SSDP message due to a NULL pointer dereference in the functions FindServiceControlURLPath and FindServiceEventURLPath in genlib/servicetable/servicetable.c. This crash can be...
CVE-2020-12695
CVE-2020-12695 (CallStranger) concerns UPnP SUBSCRIBE handling in the Open Connectivity Foundation specification prior to 2020-04-17. The root cause is a controllable Callback header that can trigger HTTP connections to arbitrary URLs, enabling SSRF-like behavior and potentially leading to amplif...
Universal Plug and Play (UPnP) SUBSCRIBE can be abused to send traffic to arbitrary destinations
Overview The Universal Plug and Play UPnP protocol in effect prior to April 17, 2020 can be abused to send traffic to arbitrary destinations using the SUBSCRIBE functionality. Description The UPnP protocol, as specified by the Open Connectivity Foundation OCF, is designed to provide automatic...
Debian DSA-4696-1 : nodejs - security update
Two vulnerabilities were discovered in Node.js, which could result in denial of service and potentially the execution of arbitrary code. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-4696. The text itself i...
Fedora 32 : kernel (2020-07f0be216f)
The 5.6.16 stable kernel update contains a number of important fixes across the tree. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible...
CVE-2020-8555
The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery SSRF that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints...
Innovation Driven by Operational Experience and Engineering Insight Deters NXNS Attacks
DNS and security have had a long and tangled relationship. The DNS has always been an attractive target since it's a network leverage point. At DNS OARC 30 in Bangkok in 2019, Akamai's Ralf Weber did a presentation called DNS Security: Past, Present, and Future It's Not Easy covering numerous DNS...
Fedora 31 : cacti / cacti-spine (2020-d50b988a2f)
Update to 1.2.12 Release notes: https://www.cacti.net/releasenotes.php?version=1.2.12 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible...
CVE-2020-8555
CVE-2020-8555 (Kubernetes) : A SSRF in kube-controller-manager allows certain authorized users to leak up to 500 bytes from unprotected endpoints inside the master’s host network (e.g., link-local or loopback). Affected releases include Kubernetes kube-controller-manager versions v1.0–v1.14, and ...
CVE-2020-10547
rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection. Because, by default, nodes’ passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices. Recent assessments: thegul...
Fedora 32 : prboom-plus (2020-fe80f1f388)
Patch for CVE-2019-20797 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network Securit...
Fedora 31 : 32:bind / bind-dyndb-ldap / dnsperf (2020-f9dcd4e9d5)
Latest minor release with security updates. - Upstream release notes Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...
Fedora 32 : drupal7 (2020-11be4b36d4)
Security fix for https://www.drupal.org/sa-core-2020-002 and https://www.drupal.org/sa-core-2020-003 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much ...
Fedora 32 : slurm (2020-e95ef17134)
Bug fix and security fix for CVE-2020-12693 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C...
Fedora 32 : 1:wireshark (2020-4f5588cf97)
New version 3.2.4, enabled build with androiddump. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues....
Fedora 32 : firefox (2020-6c340484e5)
New upstream version 77.0 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network...
CVE-2020-3222
Cisco IOS XE Software Web UI contains an unauthenticated proxy service at a specific UI endpoint. The vulnerability allows an adjacent, unauthenticated attacker to bypass access controls by proxying requests through the management network, with the proxy reachable via the management VRF. Remediat...
