11257 matches found
Squid < 4.9 Multiple Vulnerabilities
According to its self-reported version number, the version of Squid installed on the remote host is prior to 4.9. It is, therefore, affected by multiple vulnerabilities: - A heap overflow and possible a remote code execution exist due to incorrect buffer management when processing URN...
September 8, 2020—KB4570333 (OS Build 17763.1457)
None None...
September 8, 2020—KB4577032 (OS Build 17134.1726)
None None...
September 8, 2020—KB4577049 (OS Build 10240.18696)
None None...
Microsoft Warns of Windows Win32k Privilege Escalation
Microsoft has released a security advisory to address an escalation of privileges vulnerability, CVE-2021-1732, in Microsoft Win32k. A local attacker can exploit this vulnerability to take control of an affected system. This vulnerability was detected in exploits in the wild. CISA encourages user...
Microsoft .NET Core 安全漏洞
Microsoft.NET Core provides a fast, modular platform for creating server applications that run on Windows, Linux and macOS. A remote code execution vulnerability exists in Microsoft .NET Core. An attacker could exploit the vulnerability to execute code on the target server...
Intel Graphics Drivers 缓冲区错误漏洞
Intel is an American company that develops CPUs and is the world's largest manufacturer of personal computer parts and CPUs. Multiple Intel® Server elevation of privilege vulnerability can be exploited by an attacker to escalate privileges via local access...
NoxPlayer Android Emulator Supply-Chain Attack
It seems to be the season of sophisticated supply-chain attacks. This one is in the NoxPlayer Android emulator: ESET says that based on evidence its researchers gathered, a threat actor compromised one of the companys official API api.bignox.com and file-hosting servers res06.bignox.com. Using th...
The vulnerability of Microsoft Word, Microsoft Office products, Microsoft Office Online Server, Microsoft Office Web Apps, Microsoft 365 Apps, Microsoft SharePoint Server, and Microsoft SharePoint Enterprise Server arises from insufficient input data validation, allowing attackers to execute arbitrary code.
The vulnerability of Microsoft Word, the Microsoft Office products, Microsoft Office Online Server, Microsoft Office Web Apps, Microsoft 365 Apps, Microsoft SharePoint Server, and Microsoft SharePoint Enterprise Server is related to insufficient validation of input data. Exploiting this...
Design/Logic Flaw
CMCAgent in NCR Command Center Agent 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter within an XML document sent to port 8089 that enables the remote, unauthenticated execution of an arbitrary command as SYSTEM, as exploited in the wild in 2020 and/or 2021. NOTE: th...
CVE-2021-3122
CVE-2021-3122 affects NCR Command Center Agent 16.3 on Aloha POS/BOH servers. The CMCAgent processes a runCommand parameter inside an XML document sent to port 8089, enabling remote unauthenticated execution of arbitrary commands as SYSTEM. Exploitation in the wild reported in 2020–2021. Vendor n...
CVE-2021-3122
CMCAgent in NCR Command Center Agent 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter within an XML document sent to port 8089 that enables the remote, unauthenticated execution of an arbitrary command as SYSTEM, as exploited in the wild in 2020 and/or 2021. NOTE: th...
Cybercriminals Now Using Plex Media Servers to Amplify DDoS Attacks
A new distributed denial-of-service attack DDoS vector has ensnared Plex Media Server systems to amplify malicious traffic against targets to take them offline. "Plex's startup processes unintentionally expose a Plex UPnP-enabled service registration responder to the general Internet, where it ca...
[SECURITY] Fedora 33 Update: monitorix-3.13.1-1.fc33
Monitorix is a free, open source and lightweight system monitoring tool designed to monitor as many services and system resources as possible. It h as been created to be used under production Linux/UNIX servers, but due to its simplicity and small size may also be used on embedded devices as well...
[SECURITY] Fedora 32 Update: monitorix-3.13.1-1.fc32
Monitorix is a free, open source and lightweight system monitoring tool designed to monitor as many services and system resources as possible. It h as been created to be used under production Linux/UNIX servers, but due to its simplicity and small size may also be used on embedded devices as well...
A directory traversal vulnerability exists in the Cesanta Mongoose server.
Cesanta Mongoose is a suite of embedded servers from Cesanta, Ireland. A directory traversal vulnerability exists in the Cesanta Mongoose server, which can be exploited by an attacker to obtain directory information...
A New Linux Malware Targeting High-Performance Computing Clusters
High-performance computing clusters belonging to university networks as well as servers associated with government agencies, endpoint security vendors, and internet service providers have been targeted by a newly discovered backdoor that gives attackers the ability to execute arbitrary commands o...
dnsmasq: multiple queries forwarded for the same name makes forging replies easier for an off-path attacker
A flaw was found in dnsmasq. When receiving a query, dnsmasq does not check for an existing pending request for the same name and forwards a new request. By default, a maximum of 150 pending queries can be sent to upstream servers, so there can be at most 150 queries for the same name. This flaw...
CVE-2021-21293
blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. All servers running blaze-core before version 0.14.15 are affected by a vulnerability in which unbounded connection acceptance leads to file handle exhaustion. Blaze, accepts connections unconditionally on a...
CVE-2019-25018
In the rcp client in MIT krb5-appl through 1.0.3, malicious servers could bypass intended access restrictions via the filename of . or an empty filename, similar to CVE-2018-20685 and CVE-2019-7282. The impact is modifying the permissions of the target directory on the client side. NOTE: MIT...