Police Shut Down xDedic – An Online Market for Cyber Criminals

In an international operation involving law enforcement authorities from the U.S. and several European countries, feds have shut down an online underground marketplace and arrested three suspects in Ukraine. Dubbed xDedic, the illegal online marketplace let cybercriminals buy, sell or rent out...

openSUSE Security Update : openssh (openSUSE-2019-91)

This update for openssh fixes the following issues : Security issues fixed : - CVE-2018-20685: Fixed an issue where scp client allows remote SSH servers to bypass intended access restrictions bsc1121571 - CVE-2019-6109: Fixed an issue where the scp client would allow malicious remote SSH servers ...

Security update for openssh (important)

openSUSE Security Update: Security update for openssh Announcement ID: openSUSE-SU-2019:0093-1 Rating: important References: 1121571 1121816 1121818 1121821 Cross-References: CVE-2018-20685 CVE-2019-6109 CVE-2019-6110 CVE-2019-6111 Affected Products: openSUSE Leap 42.3 An update that fixes four...

Security update for openssh (important)

openSUSE Security Update: Security update for openssh Announcement ID: openSUSE-SU-2019:0091-1 Rating: important References: 1121571 1121816 1121818 1121821 Cross-References: CVE-2018-20685 CVE-2019-6109 CVE-2019-6110 CVE-2019-6111 Affected Products: openSUSE Leap 15.0 An update that fixes four...

GreyEnergy’s overlap with Zebrocy

In October 2018, ESET published a report describing a set of activity they called GreyEnergy, which is believed to be a successor to BlackEnergy group. BlackEnergy a.k.a. Sandworm is best known, among other things, for having been involved in attacks against Ukrainian energy facilities in 2015,...

WAS Target Discovery for PCI

This plugin discovers web sites on a scanned system. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid121348; scriptversion"1.5"; scriptsetattributeattribute:"pluginmodificationdate", value:"2022/05/24"; scriptnameenglish:"WAS Target Discovery for PCI";...

Updated pdns-recursor package fixes security vulnerabilities

An issue has been found in PowerDNS Recursor where Lua hooks are not properly applied to queries received over TCP in some specific combination of settings, possibly bypassing security policies enforced using Lua CVE-2019-3806. An issue has been found in PowerDNS Recursor where records in the...

Critical RCE Flaw in Linux APT Allows Remote Attackers to Hack Systems

Just in time… Some cybersecurity experts this week arguing over Twitter in favor of not using HTTPS and suggesting software developers to only rely on signature-based package verification, just because APT on Linux also does the same. Ironically, a security researcher just today revealed details ...

SUSE SLES11 Security Update : openssh (SUSE-SU-2019:13931-1)

This update for openssh fixes the following issues : Security issue fixed : CVE-2018-20685: Fixed an issue where scp client allows remote SSH servers to bypass intended access restrictions bsc1121571 CVE-2019-6109: Fixed an issue where the scp client would allow malicious remote SSH servers to...

Bitdefender BOX 2 bootstrap download_image command injection vulnerability

Summary An exploitable command injection vulnerability exists in the bootstrap stage of Bitdefender BOX 2, versions 2.1.47.42 and 2.1.53.45. The API method /api/downloadimage unsafely handles the production firmware URL supplied by remote servers, leading to arbitrary execution of system commands...

Bitdefender BOX 2 bootstrap update_setup command execution vulnerability

Summary An exploitable command execution vulnerability exists in the recovery partition of Bitdefender BOX 2, version 2.0.1.91. The API method /api/updatesetup does not perform firmware signature checks atomically, leading to an exploitable race condition TOCTTOU that allows arbitrary execution o...

Cryptomining Malware Uninstalls Cloud Security Products

Researchers say they have discovered a unique malware family capable of gaining admin rights on targeted systems by uninstalling cloud-security products. Instances of the malicious activity are tied to coin-mining malware targeting Linux servers. Palo Alto Networks’ Unit 42, which published the...

PuTTY SCP Multiple Spoofing Vulnerabilities - Windows

PuTTY is prone to multiple spoofing vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:putty:putty"; ifdescription...

Security Advisory 0039

Security Advisory 0039 PDF Date: January 16th, 2019 Version: 1.0 Revision | Date | Changes ---|---|--- 1.0 | January 16th, 2019 | Initial Release The CVE-IDs tracking this issue are CVE-2018-16873, CVE-2018-16874 and CVE-2018-16875 Description This advisory is to document the impact of...

36-Year-Old SCP Clients' Implementation Flaws Discovered

A set of 36-year-old vulnerabilities has been uncovered in the Secure Copy Protocol SCP implementation of many client applications that can be exploited by malicious servers to overwrite arbitrary files in the SCP client target directory unauthorizedly. Session Control Protocol SCP, also known as...

Man-in-the-Middle (MitM)

python27-python is vulnerable to man-in-the-middle MitM attacks. The vulnerability exists as the HTTP clients in the 1 httplib, 2 urllib, 3 urllib2, and 4 xmlrpclib libraries in CPython aka Python 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not a check the certificate...

Information Disclosure

Firefox is vulnerable to information disclosure. Network connection is preserved for favicon resource retrieval after the browser is closed. This allows remote web servers to track users by observing network traffic from multiple IP addresses...

Denial Of Service (DoS)

libvncserver is vulnerable to denial of service DoS attacks. The vulnerability exists as an integer overflow in the MallocFrameBuffer function in vncviewer.c in LibVNCServer 0.9.9 and earlier allows remote VNC servers to cause a denial of service crash and possibly execute arbitrary code via an...

Improper Certificate Common Name Verification Allows Spoofing SSL Servers

org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows...

Arbitrary Code Execution

pidgin is vulnerable to arbitrary code execution attacks. The vulnerability exists through a buffer overflow issue in http.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.7 allows remote servers to execute arbitrary code via a long HTTP header...