CVE-2020-27589

CVE-2020-27589 affects Synopsys hub-rest-api-python (blackduck on PyPI) in versions 0.0.25–0.0.52, which do not validate SSL certificates in certain cases. According to the CVE entry, this yields a high-severity impact (CVSSv3.1: 7.5) with potential integrity impact and network exposure. No explo...

CVE-2019-14763

A vulnerability was found in the Linux kernel when using the "Synopsys DesignWare Core SuperSpeed USB 3.0 Controller", where a double-locking error in drivers/usb/dwc3/gadget.c may potentially cause a deadlock with fhid...

Apache Security Advisories Red Flag Wrong Versions in Patching Gaffe

Researchers have pinpointed errors in two dozen Apache Struts security advisories, which warn users of vulnerabilities in the popular open-source web app development framework. They say that the security advisories listed incorrect versions impacted by the vulnerabilities. The concern from this...

Critical Flaws in Amcrest HDSeries Camera Allow Complete Takeover

Two critical severity bugs have been publicly disclosed that impact Amcrest HDSeries model IPM-721S cameras. Both vulnerabilities open the consumer-grade $50 Wi-Fi cameras to complete takeover by remote, unauthenticated attackers. Mandar Satam, senior security researcher at Synopsys, found the si...

Podcast: Key Takeaways For DevOps in BSIMM9

Synopsys released its ninth annual Building Security in Maturity Model report BSIMM9 last week. The report tracked 120 firms to look at 116 unique activities among 415,000 developers. Gary McGraw, vice president of security technology at Synopsys, talked to the Threatpost about an emerging new...

A few words about Gartner’s “Magic Quadrant for Application Security Testing” 2018

February and March are the hot months for marketing reports. I already wrote about IDC and Forrester reports about Vulnerability Management-related markets. And this Monday, March 19, Gartner released new "Magic Quadrant for Application Security Testing". You can buy it on the official website fo...

US-CERT Warns of Crypto Bugs in IEEE Standard

Recent academic work focused on weak cryptographic protections in the implementation of the IEEE P1735 standard has been escalated to an alert published Friday by the Department of Homeland Security. DHS’ US-CERT warned the IEEE P1735 standard for encrypting electronic-design intellectual propert...

Multiple errors in DCE-RPC code.

Description Versions of Samba from 3.6.0 to 4.4.0 inclusive are vulnerable to denial of service attacks crashes and high cpu consumption in the DCE-RPC client and server implementations. In addition, errors in validation of the DCE-RPC packets can lead to a downgrade of a secure connection to an...

Remote DoS in Samba (AD) LDAP server.

Description All versions of Samba from 4.0.0 to 4.1.21 inclusive are vulnerable to an anonymous memory exhaustion attack in the samba daemon LDAP server. A malicious client can send packets that cause the LDAP server provided by the AD DC in the samba daemon process to consume unlimited memory an...