‼ CVE-2020-3563 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in the packet processing functionality of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to inefficient memory management. An attacker could exploit this vulnerability by sending a large number of TCP packets to a specific port on an affected device. A successful exploit could allow the attacker to exhaust system memory, which could cause the device to reload unexpectedly. No manual intervention is needed to recover the device after it has reloaded.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-3565 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in the TCP Intercept functionality of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured Access Control Policies (including Geolocation) and Service Polices on an affected system. The vulnerability exists because TCP Intercept is invoked when the embryonic connection limit is reached, which can cause the underlying detection engine to process the packet incorrectly. An attacker could exploit this vulnerability by sending a crafted stream of traffic that matches a policy on which TCP Intercept is configured. A successful exploit could allow the attacker to match on an incorrect policy, which could allow the traffic to be forwarded when it should be dropped. In addition, the traffic could incorrectly be dropped.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-3317 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in the ssl_inspection component of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to crash Snort instances. The vulnerability is due to insufficient input validation in the ssl_inspection component. An attacker could exploit this vulnerability by sending a malformed TLS packet through a Cisco Adaptive Security Appliance (ASA). A successful exploit could allow the attacker to crash a Snort instance, resulting in a denial of service (DoS) condition.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-3585 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in the TLS handler of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 1000 Series firewalls could allow an unauthenticated, remote attacker to gain access to sensitive information. The vulnerability is due to improper implementation of countermeasures against the Bleichenbacher attack for cipher suites that rely on RSA for key exchange. An attacker could exploit this vulnerability by sending crafted TLS messages to the device, which would act as an oracle and allow the attacker to carry out a chosen-ciphertext attack. A successful exploit could allow the attacker to perform cryptanalytic operations that may allow decryption of previously captured TLS sessions to the affected device. To exploit this vulnerability, an attacker must be able to perform both of the following actions: Capture TLS traffic that is in transit between clients and the affected device Actively establish a considerable number of TLS connections to the affected device📖 Read
via "National Vulnerability Database".
‼ CVE-2020-3599 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in the web-based management interface of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.📖 Read
via "National Vulnerability Database".
🕴 Oracle Releases Another Mammoth Security Patch Update 🕴
📖 Read
via "Dark Reading".
October's CPU contains 402 patches for vulnerabilities across 29 product sets, many of which are remotely executable without the need for authentication.📖 Read
via "Dark Reading".
Dark Reading
Oracle Releases Another Mammoth Security Patch Update
October's CPU contains 402 patches for vulnerabilities across 29 product sets, many of which are remotely executable without the need for authentication.
🕴 FIRST Announces Cyber-Response Ethical Guidelines 🕴
📖 Read
via "Dark Reading".
The 12 points seek to provide security professionals with advice on ethical behavior during incident response.📖 Read
via "Dark Reading".
Dark Reading
FIRST Announces Cyber-Response Ethical Guidelines
The 12 points seek to provide security professionals with advice on ethical behavior during incident response.
‼ CVE-2020-27615 ‼
📖 Read
via "National Vulnerability Database".
The Loginizer plugin before 1.6.4 for WordPress allows SQL injection (with resultant XSS), related to loginizer_login_failed and lz_valid_ip.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-9749 ‼
📖 Read
via "National Vulnerability Database".
Adobe Animate version 20.5 (and earlier) is affected by an out-of-bounds read vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted .fla file in Animate.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-24421 ‼
📖 Read
via "National Vulnerability Database".
Adobe InDesign version 15.1.2 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious .indd file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-17355 ‼
📖 Read
via "National Vulnerability Database".
Arista EOS before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x before 4.24.2F allows remote attackers to cause a denial of service (restart of agents) by crafting a malformed DHCP packet which leads to an incorrect route being installed.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-27619 ‼
📖 Read
via "National Vulnerability Database".
In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-27620 ‼
📖 Read
via "National Vulnerability Database".
The Cosmos Skin for MediaWiki through 1.35.0 has stored XSS because MediaWiki messages were not being properly escaped. This is related to wfMessage and Html::rawElement, as demonstrated by CosmosSocialProfile::getUserGroups.📖 Read
via "National Vulnerability Database".
⚠ Time for a mobile privacy reset? ⚠
📖 Read
via "Naked Security".
Can you remember which permissions you gave to what apps, and why? Nor can we... time for a reset!📖 Read
via "Naked Security".
Naked Security
iOS 14 and Android 11 privacy tips – top 5 things to check
Can you remember which permissions you gave to what apps, and why? Nor can we… time for a reset!
🕴 Implementing Proactive Cyber Controls in OT: Myths vs. Reality 🕴
📖 Read
via "Dark Reading".
Debunking the myths surrounding the implementation of proactive cyber controls in operational technology.📖 Read
via "Dark Reading".
Dark Reading
Implementing Proactive Cyber Controls in OT: Myths vs. Reality
Debunking the myths surrounding the implementation of proactive cyber controls in operational technology.
❌ Feds: Iran Behind ‘Proud Boys’ Email Attacks on Democratic Voters ❌
📖 Read
via "Threat Post".
Messages that threaten people to ‘vote for Trump or else’ are part of foreign adversaries’ attempts to interfere with the Nov. 3 election, according to feds.📖 Read
via "Threat Post".
Threat Post
Feds: Iran Behind ‘Proud Boys’ Email Attacks on Democratic Voters
Messages that threaten people to ‘vote for Trump or else’ are part of foreign adversaries’ attempts to interfere with the Nov. 3 election, according to feds.
🕴 Need for 'Guardrails' in Cloud-Native Applications Intensifies 🕴
📖 Read
via "Dark Reading".
With more organizations shifting to cloud services in the pandemic, experts say the traditionally manual process of securing them will be replaced by automated tools in 2021 and beyond.📖 Read
via "Dark Reading".
Dark Reading
Need for 'Guardrails' in Cloud-Native Applications Intensifies
With more organizations shifting to cloud services in the pandemic, experts say the traditionally manual process of securing them will be replaced by automated tools in 2021 and beyond.
‼ CVE-2020-27642 ‼
📖 Read
via "National Vulnerability Database".
A cross-site scripting (XSS) vulnerability exists in the 'merge account' functionality in admins.js in BigBlueButton Greenlight 2.7.6.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-27638 ‼
📖 Read
via "National Vulnerability Database".
receive.c in fastd before v21 allows denial of service (assertion failure) when receiving packets with an invalid type code.📖 Read
via "National Vulnerability Database".
🦿 1Password for Linux desktop app now available in beta 🦿
📖 Read
via "Tech Republic".
A full Linux version of the popular password manager is expected early next year.📖 Read
via "Tech Republic".
TechRepublic
1Password for Linux desktop app now available in beta
A full Linux version of the popular password manager is expected early next year.
🕴 McAfee Raises $740M in Second IPO 🕴
📖 Read
via "Dark Reading".
The security software giant and its investors sold 37 million shares priced at $20 each, putting McAfee's value around $8.6 billion.📖 Read
via "Dark Reading".
Dark Reading
McAfee Raises $740M in Second IPO
The security software giant and its investors sold 37 million shares priced at $20 each, putting McAfee's value around $8.6 billion.