Vulnerability fixed in Dell SonicWall

A vulnerability has been fixed in Dell SonicWall. It involves a domain name collision vulnerability. The web interface of SonicWall makes it possible for an attacker to obtain information about domain names used on an organization's internal network. organization. The attacker can register a foun...

CVE-2020-15214

In TensorFlow Lite before versions 2.2.1 and 2.3.1, models using segment sum can trigger a write out bounds / segmentation fault if the segment ids are not sorted. Code assumes that the segment ids are in increasing order, using the last element of the tensor holding them to determine the...

Technical Approaches to Uncovering and Remediating Malicious Activity

Summary This joint advisory is the result of a collaborative research effort by the cybersecurity authorities of five nations: Australia,1 Canada,2 New Zealand,34 the United Kingdom,5 and the United States.6 It highlights technical approaches to uncovering malicious activity and includes mitigati...

Security Bulletin: Publicly disclosed vulnerabilities from Kernel affect IBM Netezza Host Management

Summary Kernel is used by IBM Netezza Host Management. This bulletin provides mitigation for the reported CVEs Vulnerability Details CVEID: CVE-2020-12655 DESCRIPTION: Linux Kernel could allow a local attacker to bypass security restrictions, caused by a flaw in the xfsagfverify function in...

Exploit for CVE-2020-1472

CVE-2020-1472 POC Requires the latest impacket from GitHubh...

Exploit for CVE-2020-1472

CVE-2020-1472 - Zero-Logon POC !alt texthttps://github.com...

Security Bulletin: Multiple vulnerabilities in IBM Db2 affect IBM Cloud Pak System and IBM Cloud Pak System Software Suite

Summary IBM Db2 is shipped as a component of IBM Cloud Pak System and IBM Cloud Pak System Software Suite. Db2 is shipped as a component in Platform System Manager, as DB2 ptype and PureScale. Vulnerabilities have been identified in IBM Db2 and information about fixes are published in security...

CVE-2020-24566

In Octopus Deploy 2020.3.x before 2020.3.4 and 2020.4.x before 2020.4.1, if an authenticated user creates a deployment or runbook process using Azure steps and sets the step's execution location to run on the server/worker, then under certain circumstances the account password is exposed in...

CVE-2020-24566

In Octopus Deploy 2020.3.x before 2020.3.4 and 2020.4.x before 2020.4.1, if an authenticated user creates a deployment or runbook process using Azure steps and sets the step's execution location to run on the server/worker, then under certain circumstances the account password is exposed in...

Design/Logic Flaw

In Octopus Deploy 2020.3.x before 2020.3.4 and 2020.4.x before 2020.4.1, if an authenticated user creates a deployment or runbook process using Azure steps and sets the step's execution location to run on the server/worker, then under certain circumstances the account password is exposed in...

CVE-2020-24566: Insertion of Sensitive Information into Log File

In Octopus Deploy 2020.3.x before 2020.3.4 and 2020.4.x before 2020.4.1, if an authenticated user creates a deployment or runbook process using Azure steps and sets the step's execution location to run on the server/worker, then under certain circumstances the account password is exposed in...

jenkins-credentials-binding-plugin: information disclosure in build log when build contains no build steps

Jenkins Credentials Binding Plugin 1.22 and earlier does not mask i.e., replace with asterisks secrets in the build log when the build contains no build steps...

Important: kernel

Issue Overview: A flaw null pointer dereference in the Linux kernel cgroupv2 subsystem in versions before 5.7.10 was found in the way when reboot the system. A local user could use this flaw to crash the system or escalate their privileges on the system. CVE-2020-14356 A flaw was found in the Lin...

Enterprise Search 7.9.0 security update

Enterprise Search credential exposure flaw ESA-2020-11 Elastic Enterprise Search versions before 7.9.0 contain a credential exposure flaw in the App Search interface. If a user is given the ‘developer’ role, they will be able to view the administrator API credentials. These credentials could allo...

PT-2020-15684

Name of the Vulnerable Software and Affected Versions TrouSerS versions prior to 0.3.14 Description An issue was discovered where the creation of the system.data file is prone to symlink attacks if the tcsd daemon is started with root privileges. This could allow the tss user to create or corrupt...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Spectrum LSF Analytics

Summary There are multiple vulnerabilities in IBM®Runtime Environment Java™Version 7 used by IBM Spectrum LSF Analytics. IBM Spectrum LSF Analytics has addressed the applicable CVEs. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products an...

CVE-2020-14325

A vulnerability was found in Red Hat CloudForms which allows a malicious attacker to impersonate any user or create a non-existent user with any entitlement in the appliance and perform an API request. Mitigation Red Hat recommends upgrading to secured released versions, however, this flaw can be...

jenkins-credentials-binding-plugin: information disclosure in build log when build contains no build steps

Jenkins Credentials Binding Plugin 1.22 and earlier does not mask i.e., replace with asterisks secrets in the build log when the build contains no build steps...

[SECURITY] Fedora 31 Update: mailman-2.1.34-1.fc31

Mailman is software to help manage email discussion lists, much like Majordomo and Smartmail. Unlike most similar products, Mailman gives each mailing list a webpage, and allows users to subscribe, unsubscribe, etc. over the Web. Even the list manager can administer his or her list entirely from...

Node.js third-party modules: [systeminformation] Command Injection via insecure command formatting

I would like to report a Command Injection vulnerability in the systeminformation package. It allows an attacker to inject arbitrary OS commands. Module Module name: systeminformation Version: 4.26.10 npm page: https://www.npmjs.com/package/systeminformation Module Description System and OS...