Rapid7 Releases Q2 2020 Quarterly Threat Report

It’s hard to believe it’s already the end of September, and with it comes Rapid7’s Q2 2020 Quarterly Threat Report. As in previous quarters, our Rapid7 research team produced this report by analyzing the data from our internet telemetry-gathering systems Project Sonar and Project Heisenberg, as...

CVE-2020-15590

A vulnerability in the Private Internet Access PIA VPN Client for Linux 1.5 through 2.3+ allows remote attackers to bypass an intended VPN kill switch mechanism and read sensitive information via intercepting network traffic. Since 1.5, PIA has supported a “split tunnel” OpenVPN bypass option. Th...

Design/Logic Flaw

A vulnerability in the Private Internet Access PIA VPN Client for Linux 1.5 through 2.3+ allows remote attackers to bypass an intended VPN kill switch mechanism and read sensitive information via intercepting network traffic. Since 1.5, PIA has supported a “split tunnel” OpenVPN bypass option. Th...

CVE-2020-15590

A vulnerability in the Private Internet Access PIA VPN Client for Linux 1.5 through 2.3+ allows remote attackers to bypass an intended VPN kill switch mechanism and read sensitive information via intercepting network traffic. Since 1.5, PIA has supported a “split tunnel” OpenVPN bypass option. Th...

CVE-2020-15590

CVE-2020-15590 affects the Private Internet Access (PIA) VPN Client for Linux (1.5–2.3+). The underlying issue is that when the VPN kill switch blocks all inbound/outbound traffic, privileged processes can still send/receive traffic if net.ipv4.ip_forward is enabled, enabling leakage of the host ...

Product Overview: Cynet Takes Cyber Threat Protection Automation to the Next Level with Incident Engine

We have all heard of the “cybersecurity skills gap” – the inability of firms to hire and retain high-level cybersecurity talent. This gap has been manifesting in two ways. First, companies that want to hire cybersecurity talent simply cannot find candidates with sufficient skills. Second, compani...

CVE-2020-15791

A vulnerability has been identified in SIMATIC S7-300 CPU family incl. related ET200 CPUs and SIPLUS variants All versions, SIMATIC S7-400 CPU family incl. SIPLUS variants All versions, SIMATIC WinAC RTX F 2010 All versions, SINUMERIK 840D sl All versions. The authentication protocol between a...

CVE-2020-15791

A vulnerability has been identified in SIMATIC S7-300 CPU family incl. related ET200 CPUs and SIPLUS variants All versions, SIMATIC S7-400 CPU family incl. SIPLUS variants All versions, SIMATIC WinAC RTX F 2010 All versions, SINUMERIK 840D sl All versions. The authentication protocol between a...

Fast, Furious, and Scalable: Designing a High-throughput, Real-time Network Traffic Analyzer

These days, our focus is on spoiling our customers. For example, we give our DDoS Protection customers the peace of mind that their network traffic is routing through Impervas cloud for consistent volumetric attack protection. That protection works pretty well, but customers have started asking u...

TP-Link TL-PS310U Elevation of Privilege Vulnerability

The TP-Link TL-PS310U is a single USB 2.0 port MFP and storage server. An elevation of privilege vulnerability exists in versions prior to TP-Link TL-PS310U 2.079.000.t0210, which stems from the ability to discover administrative passwords by sniffing unencrypted UDP traffic, and can be exploited...

maltrail

It is an offensive tool for network traffic detection. The primary CVE ID is not explicitly mentioned, but it utilizes publicly available blacklists containing malicious and/or generally suspicious trails, along with static trails compiled from various AV reports and custom user-defined lists. Th...

About the security content of iOS 12.2 - Apple Support

About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. Apple security documents reference...

CVE-2020-15813

Graylog before 3.3.3 lacks SSL Certificate Validation for LDAP servers. It allows use of an external user/group database stored in LDAP. The connection configuration allows the usage of unencrypted, SSL- or TLS-secured connections. Unfortunately, the Graylog client code in all versions that suppo...

Design/Logic Flaw

Graylog before 3.3.3 lacks SSL Certificate Validation for LDAP servers. It allows use of an external user/group database stored in LDAP. The connection configuration allows the usage of unencrypted, SSL- or TLS-secured connections. Unfortunately, the Graylog client code in all versions that suppo...

Man-in-the-Middle (MitM)

dogtag-pki is vulnerable to man-in-the-middle attack. The certificate validation is disabled by default and is not configurable, allowing an attacker to perform a man-in-the-middle attack to intercept and modify network traffic...

CVE-2020-10281

This vulnerability applies to the Micro Air Vehicle Link MAVLink protocol and allows a remote attacker to gain access to sensitive information provided it has access to the communication medium. MAVLink is a header-based protocol that does not perform encryption to improve transfer and reception...

CVE-2020-10281

This vulnerability applies to the Micro Air Vehicle Link MAVLink protocol and allows a remote attacker to gain access to sensitive information provided it has access to the communication medium. MAVLink is a header-based protocol that does not perform encryption to improve transfer and reception...

CVE-2020-10281 RVD#3315: Cleartext transmission of sensitive information in MAVLink protocol version 1.0 and 2.0

This vulnerability applies to the Micro Air Vehicle Link MAVLink protocol and allows a remote attacker to gain access to sensitive information provided it has access to the communication medium. MAVLink is a header-based protocol that does not perform encryption to improve transfer and reception...

Critical Bugs and Backdoor Found in GeoVision's Fingerprint and Card Scanners

GeoVision, a Taiwanese manufacturer of video surveillance systems and IP cameras, recently patched three of the four critical flaws impacting its card and fingerprint scanners that could've potentially allowed attackers to intercept network traffic and stage man-in-the-middle attacks. In a report...

[SECURITY] Fedora 31 Update: tcpreplay-4.3.3-1.fc31

Tcpreplay is a tool to replay captured network traffic. Currently, tcpreplay supports pcap tcpdump and snoop capture formats. Also included, is tcpprep a tool to pre-process capture files to allow increased performance under certain conditions as well as capinfo which provides basic information...