GHSA-W73W-5M7G-F7QC Authorization bypass in github.com/dgrijalva/jwt-go

jwt-go allows attackers to bypass intended access restrictions in situations with string for m"aud" which is allowed by the specification. Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience...

SSON/Passthrough authentication not working with Edge browser

User tries to logon to MS Edge browser via SSON User is prompted to enter username and password instead of getting logged in automatically with SSON as expected...

Google to start automatically enrolling users in two-step verification “soon”

If you use a Google account, it may soon be mandatory to sign up to Googles two-step verification program. As recently as 2017, a tiny amount of GMail users made use of its two-step options. Maybe the uptake is still slow, and Google has decided enough is enough. With so much valuable data stuffe...

Unspecified Vulnerability in Mozilla Rust (CNVD-2021-33046)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in the standard library in Rust prior to version 1.29.0, which stems from weak synchronization in the Arc::get mut method. This synchronization issue could lead to memory safety...

uClibc-ng Input Validation Error Vulnerability

uclibc-ng is an application. Small C library for Linux. An input validation error vulnerability exists in versions prior to uClibc-ng 1.0.37, which stems from being susceptible to integer wrapping by the malloc-simple function. This incorrect memory allocation could lead to arbitrary memory...

ISC BIND security vulnerability

ISC BIND is a suite of open source software that implements the DNS protocol from ISC USA. A security vulnerability exists in ISC BIND that causes the receiving named server to inadvertently delete SOA records for problematic zones from the zone database...

CVE-2020-36326

PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unreadable by PHPMailer, even in...

Windows does not recognize the VMXNET3 on App layer after upgraded to Windows 10 20H2.

After upgraded to Windows 10 20H2 on OS layer, then add a new version to App layer or platform layer, Windows virtual machine does not recognize the VMXNET3 virtual adapter. In the Windows device manager, you see a message similar to on packing machine: This device cannot start. Code 10 Operation...

PT-2021-4100

Name of the Vulnerable Software and Affected Versions Yubico pam-u2f versions prior to 1.1.1 Description The issue is related to a logic problem in pam-u2f that could lead to a local PIN bypass, depending on the pam-u2f configuration and the application used. This does not allow user presence or...

Mac Receiver Launches Application and Closes Abruptly

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. User is unable to log on from a MacBook using the Citrix Receiver for Mac. The session opens and...

PT-2021-8278

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to the locking mechanism in the Linux kernel, specifically in the queued write lock slowpath function. A reader can acquire the lock without holding the wait lock,...

ADC Fails To Connect To ADM for Pooled Licensing

When trying to add the ADC to the ADM for Pooled Licensing, or CPU based licensing, or anything that uses ADM as the license server, you receive an errror. Error might be "Unable to connect to licenseserver" or "Registration of device failed"...

bpftool, kernel, perf, python security update

CentOS Errata and Security Advisory CESA-2021:1071 An update for kernel is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Network Detection & Response: The Next Frontier in Fighting the Human Problem

Last year, Gartner published a market guide on network detection and response NDR. Formerly known as network-traffic analytics, which I’ve spoken about in the past at length, NDR has adapted to not only play a major role in helping network and security teams identify threats, but it has enabled...

Important: Red Hat Security Advisory: kernel security and bug fix update

An update for kernel is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Citrix Receiver HDX Engine has stoped working after upgrading from Citrix Receiver 4.3.100 to 4.9 only for Linux VDA

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. On a Ubuntu 16.0.4 Linux VDA 7.15, when open opening a Desktop, we receive the error message "Citrix...

This operation has been cancelled due to restrictions in effect on this computer

When you try to browse to the My Documents folder on a published Windows Explorer application while using Special Folder Redirection, the following error message appears: “This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator.” ...

CVE-2020-7463

In FreeBSD 12.1-STABLE before r364644, 11.4-STABLE before r364651, 12.1-RELEASE before p9, 11.4-RELEASE before p3, and 11.3-RELEASE before p13, improper handling in the kernel causes a use-after-free bug by sending large user messages from multiple threads on the same SCTP socket. The...

SAML + LDAP using Nfactor gives error "You are not allowed to login. Please contact your administrator"

After hitting Netscaler for login, you are redirected to SAML and successfully login. Afterwards, you are redirected back to Netscaler and receive the error"You are not allowed to login. Please contact your administrator"...

SUSE-SU-2021:0853-1 Security update for the Linux Kernel (Live Patch 9 for SLE 15 SP1)

This update for the Linux Kernel 4.12.14-19734 fixes several issues. The following security issues were fixed: - CVE-2020-29368: Fixed an issue in copy-on-write implementation which could have granted unintended write access because of a race condition in a THP mapcount check bsc1179664. - Fixed ...