Our Analyses
What it means for your servers
The security stories that matter, explained by our team — with the concrete steps to take.
The security stories that matter, explained by our team — with the concrete steps to take.
Collected every two hours from specialised publications — each link leads to the original article.
As part of this month's Patch Tuesday, Microsoft today released a fresh batch of security updates to fix a total of 129 newly discovered security vulnerabiliti…
Cisco has patched a critical vulnerability in Jabber for Windows desktop collaboration app. Exploiting the flaw could allow remote codeCritical Vulnerability F…
Researchers found two security vulnerabilities affecting the Magento database plugin MAGMI. These flaws could allow remote code execution attacks. MAGMISerious…
As tensions between the U.S. and China heighten over data security issues, the Chinese government has taken a proactive step to protect users' privacy with a d…
It was discovered that the default configuration files for running the Lemonldap::NG Web SSO system on the Nginx web server were susceptible to authorisation b…
lemonldap-ng community fixed a vulnerability in the Nginx default configuration files (CVE-2020-24660). Debian package does not install any default site, but d…
It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication. An authen…
Heads up, WordPress admins! Another vulnerable WordPress plugin might have exposed your website to cyber threats. Reportedly, the File ManagerFile Manager Word…
Slack has recently fixed a critical remote code execution vulnerability affecting its desktop apps. This RCE flaw posed a seriousSlack Patched A Critical RCE F…
An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. Thi…
The update of squid3 released as DLA-2278-2 introduced a regression due to the updated fix for CVE-2019-12529. The new Kerberos authentication code prevented b…
Fabian Vogt reported that the Ark archive manager did not sanitise extraction paths, which could result in maliciously crafted archives with symlinks writing o…
Several vulnerabilities have been discovered in the X.Org X server. Missing input sanitising in X server extensions may result in local privilege escalation if…
PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to t…
A potential IMAP Man-in-the-Middle attack via a PREAUTH response (CVE-2020-14093). Mutt was ignoring an expired certificate and was proceeding with a connectio…
You're probably aware of the privacy concerns associated with Ring doorbells, but have you considered the risks that this popular IoT device poses to police of…
In HylaFAX+ through 7.0.2, the faxsetup utility calls chown on files in user-owned directories. By winning a race, a local attacker could use this to escalate …
Are your Linux servers secure? No machine connected to the internet is 100% secure, of course. In the words of security guru Bruce Schneier: “Security is a pro…
Multiple security issues were found in the OpenEXR image library, which could result in denial of service and potentially the execution of arbitrary code when …
Use of unsafe yaml load was fixed in ros-actionlib, the Robot OS actionlib library. For Debian 9 stretch, this problem has been fixed in version
Fossil before 2.10.2, 2.11.x before 2.11.2, and 2.12.x before 2.12.1 allows remote authenticated users to execute arbitrary code. An attacker must have check-i…
Several vulnerabilites have been reported against FreeRDP, an Open Source server and client implementation of the Microsoft RDP protocol. CVE-2014-0791
An issue has been found in ndpi, an extensible deep packet inspection library. The Oracle protocol dissector contains an heap-based buffer over-read, which cou…
The File Manager (gollem) module in Horde Groupware has allowed remote attackers to bypass Horde authentication for file downloads via a crafted fn parameter t…
