Security Bulletin: OpenSSL vulnerabilites impacting Aspera High-Speed Transfer Server, Aspera High-Speed Transfer Endpoint, Aspera Desktop Client 4.0 and earlier (CVE-2021-23839, CVE-2021-23840, CVE-2021-23841)

Summary The OpenSSL vulnerabilities CVE-2021-23839, CVE-2021-23840 and CVE-2021-23841 impact Aspera High-Speed Transfer Server, Aspera High-Speed Transfer Endpoint, and Aspera Desktop Client 4.0.0 and earlier. The fix is delivered in Aspera High-Speed Transfer Server, Aspera High-Speed Transfer...

ruby: Potential HTTP request smuggling in WEBrick

An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy which also has a po...

ruby: Potential HTTP request smuggling in WEBrick

An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy which also has a po...

Fedora: Security Advisory for curl (FEDORA-2021-eb5b7c53a9)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2020-4495

IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to bypass security restrictions, caused by improper access control. By sending a specially-crafted request to the REST API, an attacker could exploit this vulnerability to bypass access restrictions, and execute...

The vulnerability of the Exim message transfer agent, related to privilege management errors, allows a hacker to elevate their privileges within the system.

The vulnerability of the Exim message transfer agent is related to privilege management errors. Exploiting this vulnerability can allow an attacker to enhance their privileges within the system...

The vulnerability of the queue_run() function in the Exim message transfer agent allows for privilege escalation within the system by exploiting buffer overflows in the “queue”. This enables attackers to execute arbitrary code.

The vulnerability of the queuerun function in the Exim message transport agent is related to buffer overflow in the “queue”. Exploiting this vulnerability can allow an attacker to increase their privileges within the system and execute arbitrary code...

The vulnerability of the Exim message transfer agent, related to resource management errors, allows a attacker to perform denial-of-service attacks.

The vulnerability of the Exim message transfer agent is related to resource management errors. Exploiting this vulnerability allows a malicious actor to perform a Denial-of-Service attack by sending specially crafted data to the application...

The vulnerability of the Exim message transfer agent, related to the tracking of symbolic links, allows attackers to elevate their privileges within the system.

The vulnerability of the Exim message forwarding agent is related to the tracking of symbolic links. Exploiting this vulnerability can allow an attacker to increase their privileges within the system by creating a specially crafted symbolic link to a file and rewriting it with a malicious version...

CVE-2021-20380

IBM QRadar Advisor With Watson App 1.1 through 2.5 as used on IBM QRadar SIEM 7.4 could allow a remote user to obtain sensitive information from HTTP requests that could aid in further attacks against the system. IBM X-Force ID: 195712...

Mcafee Database Security Server 安全漏洞

Mcafee Database Security Server is a database security software from Mcafee USA. The software provides users with a holistic view of the database and the corresponding security status, protecting business-critical databases from external, internal and insider database threats in real time. A...

The vulnerability of the Template component in the Oracle Sales Offline remote management tool allows a attacker to trigger a service failure.

The vulnerability of the Template component in the Oracle Sales Offline remote management tool is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to trigger a service failure using the HTTP protocol...

The vulnerability of the Exim message transfer agent, related to security mechanisms that are lacking, allows attackers to increase their privileges.

The vulnerability of the Exim message transfer agent is related to deficiencies in security mechanisms. Exploiting this vulnerability can allow attackers to gain elevated privileges...

Duplication of Balance

Handle 0xsomeone Vulnerability details Impact It is possible to duplicate currently held ink or art within a Cauldron, thereby breaking the contract's accounting system minting units out of thin air. Proof of Concept The stir function of the Cauldron, which can be invoked via a Ladle operation,...

Business-central 信息泄露漏洞

Business-central is a software package. A security vulnerability exists in Business-central that originates when logging into the Business-central console, an HTTP request, when intercepted, discloses sensitive information such as usernames and passwords...

DEBIAN-CVE-2021-33620

Squid before 4.15 and 5.x before 5.0.6 allows remote servers to cause a denial of service affecting availability to all clients via an HTTP response. The issue trigger is a header that can be expected to exist in HTTP traffic without any malicious intent by the server...

ATT&CK Table for Sophisticated Spearphishing Campaign CSA

Summary See Technical Details section Technical Details Table 1 provides a summary of the MITRE ATT&CK techniques observed. Table 1: MITRE ATT&CK techniques observed Technique Title | Technique ID ---|--- Process Injection: Dynamic-link Library Injection | T1055.001 Ingress Tool Transfer | T1105...

DEBIAN-CVE-2020-35505

A NULL pointer dereference flaw was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0. This issue occurs while handling the 'Information Transfer' command. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of...

DEBIAN-CVE-2020-35506

A use-after-free vulnerability was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0 during the handling of the 'Information Transfer' command CMDTI. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of servi...

UBUNTU-CVE-2020-35505

A NULL pointer dereference flaw was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0. This issue occurs while handling the 'Information Transfer' command. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of...