Ubuntu 16.04 LTS : ARM mbed TLS vulnerabilities (USN-4267-1)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4267-1 advisory. It was discovered that mbedtls has a bounds-check bypass through an integer overflow that can be used by an attacked to execute arbitrary code or cause a...

Ubuntu: Security Advisory (USN-4267-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

A week in security (January 27 – February 2)

Last week on Malwarebytes Labs, we looked at the strengths and weaknesses of the Zero Trust model, gave you the low-down on spear phishing, and took a delve into the world of securing the managed service provider MSP. Other cybersecurity news UN compromised via Sharepoint hack: An extraordinary...

CVE-2019-12399

When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to use an externalized secret variable in a substring of a connector configuration property value,...

CVE-2014-8563

Synacor Zimbra Collaboration before 8.0.9 allows plaintext command injection during STARTTLS...

Command injection

Synacor Zimbra Collaboration before 8.0.9 allows plaintext command injection during STARTTLS...

CVE-2014-8563

Synacor Zimbra Collaboration before 8.0.9 allows plaintext command injection during STARTTLS...

CVE-2014-8563

CVE-2014-8563 affects Synacor Zimbra Collaboration Suite before version 8.0.9. The vulnerability is described as plaintext command injection during STARTTLS, stemming from input data not properly filtered when constructing OS-executable commands. Several connected sources reiterate that versions ...

Realtek SDK Information Disclosure / Code Execution Exploit

Realtek SDK based routers suffer from information disclosure, incorrect access control, insecure password storage, code execution, and incorrectly implemented CAPTCHA vulnerabilities. 1 Sensitive data disclosure and incorrect access control in several series of Realtek SDK based routers...

Weak Encryption Standards

parsel uses weak encryption standards. The configuration exists through the use of a default, hardcoded, Initialization Vector IV and causes the cipher to be vulnerable to chosen plaintext attacks...

Realtek SDK Information Disclosure / Code Execution

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ MULTIPLE VULNERABILITIES IN SEVERAL SERIES OF REALTEK SDK BASED ROUTERS TOTOLINK AND MANY OTHER Blazej Adamczyk br0x [email protected] https://sploit.tech/ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 11.12.2019 1 Sensitive data...

CVE-2012-6663

General Electric D20ME devices are not properly configured and reveal plaintext passwords...

Code injection

General Electric D20ME devices are not properly configured and reveal plaintext passwords...

CVE-2012-6663

CVE-2012-6663 affects General Electric D20ME/D20M RTUs. The available connected documentation confirms a vulnerability where device configurations are accessible via TFTP and reveal plaintext usernames and passwords due to improper configuration. The exploitation path is evidenced by the Metasplo...

CVE-2012-6663

General Electric D20ME devices are not properly configured and reveal plaintext passwords...

Hardcoded Initialization Vector

Overview All versions of parsel have a default hardcoded initialization vector. In cases where the IV is not provided, the package defaults to a hardcoded IV which renders the cipher vulnerable to chosen plaintext attacks. Recommendation The package is deprecated and will not be updated. Consider...

CVE-2019-5593

Improper permission or value checking in the CLI console may allow a non-privileged user to obtain Fortinet FortiOS plaint text private keys of system's builtin local certificates via unsetting the keys encryption password in FortiOS 6.2.0, 6.0.0 to 6.0.6, 5.6.10 and below or for user uploaded...

CVE-2019-5593

Improper permission or value checking in the CLI console may allow a non-privileged user to obtain Fortinet FortiOS plaint text private keys of system's builtin local certificates via unsetting the keys encryption password in FortiOS 6.2.0, 6.0.0 to 6.0.6, 5.6.10 and below or for user uploaded...

CVE-2019-5593

Fortinet FortiOS is affected by CVE-2019-5593. The flaw arises from improper permission/value checking in the CLI console, allowing a non-privileged local attacker to obtain plaintext private keys of system certificates by unsetting the encryption password for built‑in certificates (FortiOS 6.2.0...

CVE-2019-5593

Improper permission or value checking in the CLI console may allow a non-privileged user to obtain Fortinet FortiOS plaint text private keys of system's builtin local certificates via unsetting the keys encryption password in FortiOS 6.2.0, 6.0.0 to 6.0.6, 5.6.10 and below or for user uploaded...