Cloud tech first floor recommendations

I hate to say it, but Im an old, curmudgeonly guy thats been in the industry more than 20 years. And after a while, things just start to wear on you. In fact, there was a point in my career that I swore if I had to counsel just one more company on the importance of having strong passwords and...

PT-2020-4858 · Intel · Intel Csme +2

Name of the Vulnerable Software and Affected Versions: Intel CSME versions prior to 12.0.70 Intel CSME versions prior to 13.0.40 Intel CSME versions prior to 13.30.10 Intel CSME versions prior to 14.0.45 Intel CSME versions prior to 14.5.25 Intel TXE versions prior to 4.0.30 Intel SPS versions...

Intel® EMA Advisory

Summary: Potential security vulnerabilities in the Intel® Endpoint Management Assistant EMA may allow escalation of privilege or information disclosure. Intel is releasing software updates to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2020-12315 Description: Path...

Intel® Media SDK for Windows* Advisory

Summary: A potential security vulnerability in the Intel® Media SDK for Windows may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2019-11121 Description: Improper file permissions in the installer for...

Intel Unite® Client Advisory

Summary: A potential security vulnerability in the Intel® Unite Client for Windows may allow information disclosure. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details CVEID: CVE-2020-0575 Description: Improper buffer restrictions in the IntelR Uni...

Intel CSI2 Host Controller Advisory

Summary: A potential security vulnerability in the Intel Camera Serial Interface CSI 2 Host Controller driver may allow information disclosure. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2020-0573 Description: Out of bounds read...

Intel® HID Event Filter Driver Advisory

Summary: A potential security vulnerability in the Intel® Human Interface Device HID Event Filter Driver may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details CVEID: CVE-2020-12332 Description: Improper permissions i...

PT-2020-6068

Name of the Vulnerable Software and Affected Versions Axios NPM package version 0.21.0 Description The issue is related to insufficient validation of incoming requests in the Axios library, which can be exploited by a remote attacker to perform a Server-Side Request Forgery SSRF attack. This allo...

PT-2020-5992 · Oracle +9 · Mysql Server +8

Name of the Vulnerable Software and Affected Versions: Oracle MySQL Server versions 5.7.33 and prior Oracle MySQL Server versions 8.0.23 and prior Description: The issue is related to insufficient input validation in the InnoDB component of Oracle MySQL Server. It allows a high-privileged attacke...

PT-2020-16560 · Legion Of The Bouncy Castle · Legion Of The Bouncy Castle Bc

Name of the Vulnerable Software and Affected Versions: Legion of the Bouncy Castle BC versions 1.61 and earlier Legion of the Bouncy Castle BC-FJA versions 1.0.1.2 and earlier Description: The issue allows attackers to obtain sensitive information about a private exponent due to observable...

PT-2020-16526 · Ruckus · Ruckus Vriot

Name of the Vulnerable Software and Affected Versions: Ruckus vRioT versions 1.5.1.0.21 and earlier Description: The issue concerns an API backdoor that is hardcoded into the validate token.py file. This backdoor allows an unauthenticated attacker to interact with the service API by using a...

Threat Source newsletter (Oct. 15, 2020)

Newsletter compiled by Jon Munshaw.Good afternoon, Talos readers. In our latest entry into our election security series, we’re turning our attention to the professionals who are responsible for securing our elections. After months of research, we’ve compiled a series of recommendations for local,...

PT-2020-5281 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.10-rc1 Description: A use-after-free flaw was found in kernel/trace/ring buffer.c, which could cause a denial of service problem due to a race condition in trace open and resize of cpu buffer running in parall...

PT-2020-20210 · Linux Foundation +2 · Kubernetes +1

Name of the Vulnerable Software and Affected Versions: Kubernetes versions prior to 1.19.3 Kubernetes versions prior to 1.18.10 Kubernetes versions prior to 1.17.13 Description: The issue arises when a Kubernetes cluster uses a logging level of at least 4 and encounters a malformed docker config...

PT-2020-13802 · Apache · Apache Solr

Name of the Vulnerable Software and Affected Versions: Apache Solr versions 6.6.0 through 6.6.6 Apache Solr versions 7.0.0 through 7.7.3 Apache Solr versions 8.0.0 through 8.6.2 Description: The issue prevents some features considered dangerous, which could be used for remote code execution, to b...

Threat Source newsletter for Oct. 8, 2020

Newsletter compiled by Jon Munshaw. Good afternoon, Talos readers. We’ve been writing and talking about election security a ton lately. And as the U.S. presidential election draws closer, we decided it was time to summarize some things. So, we released this blog post with our formal recommendatio...

What to expect when you’re electing: Voter recommendations

By Amy Henderson. Information operations have been around for millennia, yet with the advent of the internet and the democratization of content creation, the barriers to entry have lowered to a point that anyone can play now. In the course of our latest research on disinformation, with an eye...

CVE-2020-15174

In Electron before versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 the will-navigate event that apps use to prevent navigations to unexpected destinations as per our security recommendations can be bypassed when a sub-frame performs a top-frame navigation across sites. The issue is patched in...

PT-2020-6454

Name of the Vulnerable Software and Affected Versions macOS versions prior to 11.0.1 watchOS versions prior to 7.1 iOS versions prior to 12.4.9 and prior to 14.2 watchOS versions prior to 6.2.9 and prior to 5.3.9 macOS Catalina versions prior to 10.15.7 Supplemental Update and prior to 10.15.7...

FortiGate SSL VPN "Breaching the Fort"

Security researchers at SAM Seamless Network published a blog post on September 24, 2020 stating that 200,000 businesses were exposed to Man-in-the-Middle MITM attacks against FortiGate SSL VPNs due to the VPN client’s failure to properly verify the server’s certificate out of the box. Instead,...