Our Analyses
What it means for your servers
The security stories that matter, explained by our team — with the concrete steps to take.
The security stories that matter, explained by our team — with the concrete steps to take.
Collected every two hours from specialised publications — each link leads to the original article.
nettle: Out of bounds memory access in signature verification (CVE-2021-20305) For more details about the security issue(s), including the impact, a CVSS score…
kernel: out-of-bounds read in libiscsi module (CVE-2021-27364) * kernel: heap buffer overflow in the iSCSI subsystem (CVE-2021-27365) * kernel: iscsi: unrestri…
Fix issue where chromium would crash upon accessing components/cast_*. Thanks to Gentoo for the patch. It also fixes some security issues, because why not: CVE…
Cyku Hong from DEVCORE discovered that php-nette, a PHP MVC framework, is vulnerable to a code injection attack by passing specially formed parameters to URL t…
Updated ant packages fix security vulnerability: As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so tha…
flatpak: "file forwarding" feature can be used to gain unprivileged access to files (CVE-2021-21381) For more details about the security issue(s), including th…
This is the monthly .NET Core 3.1 update for March 2021. Release notes: https://github.com/dotnet/core/blob/main/release-notes/3.1/3.1.13/3.1.13.md This update…
This is the monthly .NET Core 3.1 update for March 2021. Release notes: https://github.com/dotnet/core/blob/main/release-notes/3.1/3.1.13/3.1.13.md This update…
IT infrastructure management provider SolarWinds on Thursday released a new update to its Orion networking monitoring tool with fixes for four security vulnera…
Researchers have discovered three vulnerabilities capable of granting attackers root privileges on Linux systems if they are able to gain access through other …
The Apache Software Foundation on Friday addressed a high severity vulnerability in Apache OFBiz that could have allowed an unauthenticated adversary to remote…
On case-insensitive file systems with support for symbolic links, if Git is configured globally to apply delay-capable clean/smudge filters (such as Git LFS), …
Enterprise cloud security firm Qualys has become the latest victim to join a long list of entities to have suffered a data breach after zero-day vulnerabilitie…
Cisco has addressed a maximum severity vulnerability in its Application Centric Infrastructure (ACI) Multi-Site Orchestrator (MSO) that could allow an unauthen…
An information disclosure vulnerability in libjpeg-turbo allow remote attackers to obtain sensitive information.
Researchers have found a new vulnerability affecting Linux devices. Dubbed BleedingTooth, the Bluetooth vulnerability allows remote code execution on targetNew…
A directory traversal vulnerability was discovered in python-flask-cors, a Flask extension for handling Cross Origin Resource Sharing (CORS), allowing to acces…
Google security researchers are warning of a new set of zero-click vulnerabilities in the Linux Bluetooth software stack that can allow a nearby unauthenticate…
The package chromium before version 86.0.4240.75-1 is vulnerable to multiple issues including arbitrary code execution, access restriction bypass, information …
In Eclipse Web Tools Platform, a component of the Eclipse IDE, XML and DTD files referring to external entities could be exploited to send the contents of loca…
x86 pv: Crash when handling guest access to MSR_MISC_ENABLE [XSA-333, CVE-2020-25602] (#1881619) Missing unlock in XENMEM_acquire_resource error path [XSA-334,…
**PHP version 7.4.11** (01 Oct 2020) **Core:** * Fixed bug php#79699 (PHP parses encoded cookie names so malicious `__Host-` cookies can be sent). (**CVE-2020-…
rack-cors would allow unintended access to files over the network.
**PHP version 7.4.11** (01 Oct 2020) **Core:** * Fixed bug php#79699 (PHP parses encoded cookie names so malicious `__Host-` cookies can be sent). (**CVE-2020-…
