Our Analyses
What it means for your servers
The security stories that matter, explained by our team — with the concrete steps to take.
The security stories that matter, explained by our team — with the concrete steps to take.
Collected every two hours from specialised publications — each link leads to the original article.
**PHP version 7.4.11** (01 Oct 2020) **Core:** * Fixed bug php#79699 (PHP parses encoded cookie names so malicious `__Host-` cookies can be sent). (**CVE-2020-…
Writing advanced malware for a threat actor requires different groups of people with diverse technical expertise to put them all together. But can the code lea…
- Update to 4.3.1 - PowerDNS Security Advisory 2020-05 (CVE-2020-17482) Release notes: https://doc.powerdns.com/authoritative/changelog/4.2.html#change-4.3.1 S…
A potential HTTP request smuggling vulnerability in WEBrick was reported. WEBrick (bundled along with jruby) was too tolerant against
A potential HTTP request smuggling vulnerability in WEBrick was reported. WEBrick (bundled along with ruby2.3) was too tolerant against
While VPNs are supposed to protect users, the same tools can pose a threat to user security if found vulnerable.Fortinet VPN Flaw Exposes 200K Businesses To Mi…
An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if a no_renegotiation alert is sent with u…
A vulnerability in LinuxCIFS may allow a remote code execution via a command line option.
A vulnerability in gpsd could allow remote code execution.
A buffer overflow in libuv might allow remote attacker(s) to execute arbitrary code.
netqmail could be made to crash or run programs as any user (except root) if it received specially crafted network traffic.
- Update to 4.3.1 - PowerDNS Security Advisory 2020-05 (CVE-2020-17482) Release notes: https://doc.powerdns.com/authoritative/changelog/4.2.html#change-4.3.1 S…
The popular Chinese social media app TikTok has once again made it to the news. But this time, it's notTikTok Glitch Allows Multi-Factor Authentication Bypass …
An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages p…
url::recvline in url.cpp in libproxy 0.4.x through 0.4.15 allows a remote HTTP server to trigger uncontrolled recursion via a response composed of an infinite …
grub2 updates for boothole vulnerabilities in f31/f32.
Two issues have been found in nfdump, a netflow capture daemon. Both issues are related to either a buffer overflow or an integer overflow, which could result …
As the pandemic continues to accelerate the shift towards working from home, aÂslew of digital threatsÂhave capitalized on the health concern to exploit weakne…
Humans make mistakes, software has bugs and some of these bugs are exploitable vulnerabilities. The existence of vulnerabilities in software is not a new probl…
Dear Android users, if you use the Firefox web browser on your smartphones, make sure it has been updated to version 80 or the latest available version on the …
Email-Address-List could be made to remotely exhaust resources if it received specially crafted email data.
Apache Log4j could be made to remotely execute arbitrary code if it received specially crafted log data.
If a raw TCP socket is opened and connected to an endpoint that is fully configured with CURVE/ZAP, legitimate clients will not be able to exchange any message…
LibEtPan through 1.9.4, as used in MailCore 2 through 0.6.3 and other products, has a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server…
