Security Bulletin: IBM Cloud Private is vulnerable to Node.js lodash vulnerabilities (CVE-2020-28500)

Summary IBM Cloud Private is vulnerable to Node.js lodash vulnerabilities Vulnerability Details CVEID: CVE-2020-28500 DESCRIPTION: Node.js lodash module is vulnerable to a denial of service, caused by a regular expression denial of service ReDoS in the toNumber, trim and trimEnd functions. By...

Security Bulletin: IBM Cloud Private is vulnerable to Node.js lodash vulnerabilities (CVE-2021-23337)

Summary IBM Cloud Private is vulnerable to Node.js lodash vulnerabilities Vulnerability Details CVEID: CVE-2021-23337 DESCRIPTION: Node.js lodash module could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by a command injection flaw in the template. By...

Security Bulletin: IBM Cloud Private is vulnerable to Helm vulnerabilities ( CVE-2021-21303)

Summary IBM Cloud Private is vulnerable to Helm vulnerabilities Vulnerability Details CVEID: CVE-2021-21303 DESCRIPTION: Helm could allow a local authenticated attacker to bypass security restrictions, caused by the failure to sanitized multiple fields in various .yaml files. By sending a...

Security Bulletin: IBM Cloud Private is vulnerable to Docker vulnerabilities (CVE-2021-21285, CVE-2021-21284)

Summary IBM Cloud Private is vulnerable to Docker vulnerabilities Vulnerability Details CVEID: CVE-2021-21285 DESCRIPTION: Docker is vulnerable to a denial of service, caused by improper input validation. By persuading a victim to pull a specially-crafted Docker image, a remote attacker could...

SUSE: Security Advisory (SUSE-SU-2021:2924-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Atlassian Releases Security Updates for Confluence Server and Data Center

On August 25, 2021, Atlassian released security updates to address a remote code execution vulnerability CVE-2021-26084 affecting Confluence Server and Data Center. Recently, CVE-2021-26084 has been detected in exploits in the wild. A remote attacker could exploit this vulnerability to take contr...

Security Bulletin: IBM Cloud Private is vulnerable to Java vulnerabilities (CVE-2020-14781)

Summary IBM Cloud Private is vulnerable to Java vulnerabilities Vulnerability Details CVEID: CVE-2020-14781 DESCRIPTION: An unspecified vulnerability in Java SE related to the JNDI component could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality...

Security Bulletin: IBM Cloud Private is vulnerable to OpenSSL vulnerabilities (CVE-2020-1971 )

Summary IBM Cloud Private is vulnerable to OpenSSL vulnerabilities Vulnerability Details CVEID: CVE-2020-1971 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference. If the GENERALNAMEcmp function contain an EDIPARTYNAME, an attacker could exploit this...

Security Bulletin: IBM Cloud Private is vulnerable to Kubernetes vulnerabilities (CVE-2020-8554)

Summary IBM Cloud Private is vulnerable to Kubernetes vulnerabilities Vulnerability Details CVEID: CVE-2020-8554 DESCRIPTION: Kubernetes could allow a remote authenticated attacker to bypass security restrictions, caused by a flaw when using LoadBalancer or ExternalIPs. By using man-in-the-middle...

Security Bulletin: IBM Cloud Private is vulnerable to Elastic vulnerabilities (CVE-2020-7020 )

Summary IBM Cloud Private is vulnerable to Elastic vulnerabilities Vulnerability Details CVEID: CVE-2020-7020 DESCRIPTION: Elastic Enterprise Search could allow a remote authenticated attacker to obtain sensitive information, caused by not properly preserving security permissions in search querie...

Security Bulletin: IBM Cloud Private is vulnerable to OpenSSL vulnerabilities (CVE-2020-1968 )

Summary IBM Cloud Private is vulnerable to OpenSSL vulnerabilities Vulnerability Details CVEID: CVE-2020-1968 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by a Raccoon attack in the TLS specification. By computing the pre-master secret in connections...

Security Bulletin: IBM Cloud Private is vulnerable to Elastic vulnerabilities (CVE-2020-7018,CVE-2020-7019 )

Summary IBM Cloud Private is vulnerable to Elastic vulnerabilities Vulnerability Details CVEID: CVE-2020-7018 DESCRIPTION: Elastic Enterprise Search could allow a remote authenticated attacker to obtain sensitive information, caused by a credential exposure flaw in the App Search interface. By...

A deep-dive into the SolarWinds Serv-U SSH vulnerability

Several weeks ago, Microsoft detected a 0-day remote code execution exploit being used to attack the SolarWinds Serv-U FTP software in limited and targeted attacks. The Microsoft Threat Intelligence Center MSTIC attributed the attack with high confidence to DEV-0322, a group operating out of Chin...

Cisco Releases Security Updates for Cisco Enterprise NFVIS

Cisco has released security updates to address a critical vulnerability affecting Cisco Enterprise Network Function Virtualization Infrastructure Software NFVIS Release 4.5.1. A remote attacker could exploit this vulnerability to take control of an affected system. For updates addressing lower...

RHEL 7 : kernel (RHSA-2021:3321)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3321 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: out-of-bounds write in...

QNAP Working on Patches for OpenSSL Flaws Affecting its NAS Devices

Network-attached storage NAS appliance maker QNAP said it's currently investigating two recently patched security flaws in OpenSSL to determine their potential impact, adding it will release security updates should its products turn out to be vulnerable. Tracked as CVE-2021-3711 CVSS score: 7.5 a...

RHEL 7 : kernel (RHSA-2021:3320)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3320 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: race condition for removal of...

Photon OS 2.0: Nxtgn PHSA-2021-2.0-0383

An update of the nxtgn package has been released. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-2.0-0383. The text itself is copyright C VMware, Inc...

PC Wireless Wi-Fi Adapter Driver Security Updates August 2021

Wireless Wi-Fi vendors have informed HP of potential security vulnerabilities identified in some of their wireless PC adapters which may allow escalation of privilege and information disclosure. These industry-wide vulnerabilities are known as FragAttacks fragmentation and aggregation attacks...

Photon OS 4.0: Cpio PHSA-2021-4.0-0089

An update of the cpio package has been released. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-4.0-0089. The text itself is copyright C VMware, Inc. include'deprecatednasllevel.inc...