CVE-2020-29490: Uncontrolled Resource Consumption

Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contain a Denial of Service vulnerability on NAS Servers with NFS exports. A remote authenticated attacker could potentially exploit this vulnerability and cause Denial of Service Storage Processor Panic by sending specially...

Wyse ThinOS Licensing Issues Vulnerability

Wyse ThinOS is a specialized operating system for Dell servers from Dell USA. A security vulnerability exists in Wyse ThinOS 8.6 and prior versions, which can be exploited by an attacker to access writable files and manipulate the configuration of any targeted specific site...

[SECURITY] Fedora 33 Update: tor-0.4.4.6-1.fc33

The Tor network is a group of volunteer-operated servers that allows people to improve their privacy and security on the Internet. Tor's users employ this network by connecting through a series of virtual tunnels rather than makin g a direct connection, thus allowing both organizations and...

Golang malware infecting Windows, Linux servers with XMRig miner

By Sudais Asif Golang malware has been active since last month targeting both Linux and Windows-based servers. This is a post from HackRead.com Read the original post: Golang malware infecting Windows, Linux servers with XMRig miner...

UBUNTU-CVE-2020-35863

An issue was discovered in the hyper crate before 0.12.34 for Rust. HTTP request smuggling can occur. Remote code execution can occur in certain situations with an HTTP server on the loopback interface...

AutoHotkey-Based Password Stealer Targeting US, Canadian Banking Users

Threat actors have been discovered distributing a new credential stealer written in AutoHotkey AHK scripting language as part of an ongoing campaign that started early 2020. Customers of financial institutions in the US and Canada are among the primary targets for credential exfiltration, with a...

[SECURITY] Fedora 33 Update: mediawiki-1.35.1-1.fc33

MediaWiki is the software used for Wikipedia and the other Wikimedia Foundation websites. Compared to other wikis, it has an excellent range of features and support for high-traffic websites using multiple servers This package supports wiki farms. Read the instructions for creating wiki instances...

Web Servers Directory Traversal Attempt (CVE-2020-10631; CVE-2020-13158; CVE-2020-13886; CVE-2020-3240)

A directory traversal vulnerability exists in web servers. Successful exploitation of this vulnerability could result in information disclosure or execution of arbitrary code...

TerraMaster TOS Remote Code Execution Vulnerability

TerraMaster TOS is a Linux-based operating system developed for TerraMaster Cloud Storage NAS servers. A remote code execution vulnerability exists in TerraMaster TOS 4.2.06 and earlier versions. An attacker can exploit this vulnerability to execute commands without authentication via shell...

CVE-2020-35269

Nagios Core application version 4.2.4 is vulnerable to Site-Wide Cross-Site Request Forgery CSRF in many functions, like adding – deleting for hosts or servers...

CVE-2020-35269

Nagios Core application version 4.2.4 is vulnerable to Site-Wide Cross-Site Request Forgery CSRF in many functions, like adding – deleting for hosts or servers...

CVE-2020-35269

Nagios Core application version 4.2.4 is vulnerable to Site-Wide Cross-Site Request Forgery CSRF in many functions, like adding – deleting for hosts or servers...

Law Enforcement Seizes Joker's Stash — Stolen Credit Card Marketplace

The US Federal Bureau of Investigation FBI and Interpol have allegedly seized proxy servers used in connection with Blockchain-based domains belonging to Joker's Stash, a notorious fraud bazaar known for selling compromised payment card data in underground forums. The takedown happened last week ...

ISC BIND TKEY Queries Assertion Failure (CVE-2015-5477)

A denial of service vulnerability has been reported in ISC BIND DNS servers. The vulnerability is due to the way that the DNS server improperly handles invalid TKEY resource records. A remote attacker may exploit this issue by sending a specially crafted DNS query to a DNS server. Successful...

RHEL 8 : Red Hat OpenShift Service Mesh 1.1.11 (RHSA-2020:5649)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5649 advisory. Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an on-premise...

CVE-2020-26277

DBdeployer is a tool that deploys MySQL database servers easily. In DBdeployer before version 1.58.2, users unpacking a tarball may use a maliciously packaged tarball that contains symlinks to files external to the target. In such scenario, an attacker could induce dbdeployer to write into a syst...

CVE-2020-26277

DBdeployer (dbdeployer) prior to v1.58.2 is vulnerable to a symbolic-link path traversal during tarball unpacking, allowing an attacker with a malicious tarball to cause writes to files outside the target directory (potentially system files). This requires: the user running as root (dbdeployer ca...

CVE-2020-26263

tlslite-ng is an open source python library that implements SSL and TLS cryptographic protocols. In tlslite-ng before versions 0.7.6 and 0.8.0-alpha39, the code that performs decryption and padding check in RSA PKCS1 v1.5 decryption is data dependant. In particular, the code has multiple ways in...

Dark Web Pricing Skyrockets for Microsoft RDP Servers, Payment-Card Data

Cybercriminals are vying for Remote Desktop Protocol RDP access, stolen payment cards and DDoS-for-Hire services, based on a recent analysis of underground marketplace pricing. During the COVID-19 pandemic, cybercriminals have profited with “increasingly advantageous positions to benefit from the...

RSA weakness in tslite-ng

Impact The code that performs decryption and padding check in RSA PKCS1 v1.5 decryption is data dependant. In particular, code in current as of 0.8.0-alpha38 master https://github.com/tlsfuzzer/tlslite-ng/blob/0812ed60860fa61a6573b2c0e18771414958f46d/tlslite/utils/rsakey.pyL407-L441 and code in...