Vulnerabilities fixed in Dovecot

A malicious party could exploit the vulnerabilities to cause a denial-of-service and to read e-mail from other users. Dovecot has released updates to fix the vulnerabilities. For more information, see the following pages: CVE-2020-24386:...

HackerOne: Denial Of Service (Out Of Memory) on Updating Bounty Table [Urgent]

Hello, Summary: There is a bug in Updating Bounty Table section causing Denial Of Service , specifically loading up the memory usage Out Of Memory. This happens when you visit a corrupted bounty table of a target program. I didn't figure out yet how this issue happened but I am reporting it now...

Oracle Linux 8 : vim (ELSA-2020-4453)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-4453 advisory. - 1842755 - CVE-2019-20807 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has not test...

Default configuration

The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at...

PYSEC-2020-267

Red Discord Bot before version 3.4.1 has an unauthorized privilege escalation exploit in the Mod module. This exploit allows Discord users with a high privilege level within the guild to bypass hierarchy checks when the application is in a specific condition that is beyond that user's control. By...

Unauthorized privilege escalation in Mod module

Impact An unauthorized privilege escalation exploit has been discovered in the Mod module: this exploit allows Discord users with a high privilege level within the guild to bypass hierarchy checks when the application is in a specific condition that is beyond that user's control. By abusing this...

CVE-2020-16242

The affected Reason S20 Ethernet Switch is vulnerable to cross-site scripting XSS, which may allow an attacker to trick application users into performing critical application actions that include, but are not limited to, adding and updating accounts...

GHSA-55J9-849X-26H4 Remote Code Execution in Red Discord Bot

Impact A RCE exploit has been discovered in the Trivia module: this exploit allows Discord users with specifically crafted usernames to inject code into the Trivia module's leaderboard command. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive...

[SECURITY] Fedora 32 Update: clamav-0.102.4-1.fc32

Clam AntiVirus is an anti-virus toolkit for UNIX. The main purpose of this software is the integration with mail servers attachment scanning. The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet. The programs ar...

[SECURITY] Fedora 30 Update: clamav-0.102.3-1.fc30

Clam AntiVirus is an anti-virus toolkit for UNIX. The main purpose of this software is the integration with mail servers attachment scanning. The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet. The programs ar...

[SECURITY] Fedora 31 Update: clamav-0.102.3-1.fc31

Clam AntiVirus is an anti-virus toolkit for UNIX. The main purpose of this software is the integration with mail servers attachment scanning. The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet. The programs ar...

MS15-046: Description of the security update for Word 2013: May 12, 2015

Describes an update that resolves vulnerabilities in Microsoft Office that could allow remote code execution when an Office file that is located in the same network directory as a specially crafted library file is opened.IntroductionThis update resolves vulnerabilities in Microsoft Office that...

MS15-012: Description of the security update for Microsoft Excel 2013: February 10, 2015

Resolves vulnerabilities in Microsoft Office that could allow remote code execution if an attacker convinces a user to open or preview a specially crafted Office file in an affected version of Office software.IntroductionThis security update resolves vulnerabilities in Microsoft Office that could...

MS15-022: Description of the security update for Office Web Apps Server 2013: March 10, 2015

Resolves vulnerabilities in Office Web Apps Server 2013 that could allow remote code execution if an authenticated attacker sends specially crafted page content to a targeted computer that is running SharePoint Server.IntroductionThis update resolves vulnerabilities in Microsoft Office Web Apps...

Description of the security update for Office 2010: October 10, 2017

Description of the security update for Office 2010: October 10, 2017 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see Microsoft advisory...

MS15-013: Description of the security update for Microsoft Office 2013: February 10, 2015

MS15-013: Description of the security update for Microsoft Office 2013: February 10, 2015 Introduction This security update resolves vulnerabilities that could allow security feature bypass if a specially crafted file is opened in an affected edition of Microsoft Office. Summary Microsoft has...

February 11, 2020—KB4537764 (OS Build 14393.3504)

None None...

All in the (Ransomware) Family: 10 Ways to Take Action

In a world where everything is an “as-a-service,” it’s no surprise that ransomware-as-a-service RaaS is a hot ticket on the Dark Web. FortiGuard Labs has observed at least two significant ransomware families – Sodinokibi and Nemty – now being deployed as RaaS solutions. Meanwhile, cybercriminals...

Description of the security update for Office 2010: December 10, 2019

Description of the security update for Office 2010: December 10, 2019 Summary This security update resolves an information disclosure vulnerability that exists if Microsoft Excel incorrectly discloses the contents of its memory. To learn more about the vulnerability, see Microsoft Common...

Input validation

This improper link resolution vulnerability allows remote attackers to access system files. To fix this vulnerability, QNAP recommend updating QTS to their latest versions...