Read Time:2 Second
National Protective Security Authority begins its work
Daily Archives: March 14, 2023
CVE-2021-4195
Read Time:11 Second
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Firmanet Software and Technology Customer Relation Manager allows XSS Targeting HTML Attributes.This issue affects Customer Relation Manager: before 2022.03.13.
Can a quantum algorithm crack RSA cryptography? Not yet
Read Time:29 Second
Every CISO has encryption implementation decisions to make at a variety of levels and instances as they sort the support needed for business operations such as production, sales, support, data retention, and communication. These decisions tend to lean heavily on the “ease of use” doctrine and ubiquitousness of the various product offerings being considered. Therefore the alarming report on “research” conducted by a pool of Chinese researchers on the “possibility” that RSA cryptographic algorithm was breakable with a quantum algorithm has raised an eyebrow or two.
ZDI-23-231: Trend Micro TXOne StellarProtect Improper Access Control Privilege Escalation Vulnerability
Read Time:7 Second
This vulnerability allows remote attackers to escalate privileges on affected installations of Trend Micro TXOne StellarProtect. Authentication is required to exploit this vulnerability.
ZDI-23-232: PaperCut NG SecurityRequestFilter Authentication Bypass Vulnerability
Read Time:7 Second
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG. Authentication is not required to exploit this vulnerability.
ZDI-23-233: PaperCut NG SetupCompleted Improper Access Control Authentication Bypass Vulnerability
Read Time:7 Second
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG. Authentication is not required to exploit this vulnerability.
ZDI-23-234: Microsoft Print 3D WRL File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Read Time:12 Second
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Print 3D. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
liferea-stable-3720230314014609.1
Read Time:8 Second
FEDORA-FLATPAK-2023-1c344042b9
Packages in this update:
liferea-stable-3720230314014609.1
Update description:
Update to 1.14.1, includes fix for CVE-2023-1350.
CISA Adds CVE-2020-5741 and CVE-2021-39144 to the Known Exploited Vulnerabilities Catalog
Read Time:1 Minute, 29 Second
FortiGuard Labs is aware that the Cybersecurity & Infrastructure Security Agency (CISA) added CVE-2020-5741 (Plex Media Server remote code execution vulnerability) and CVE-2021-39144 (XStream Remote Code Execution Vulnerability) to their Known Exploited Vulnerabilities (KEV) catalog on March 10, 2023. The catalog lists vulnerabilities that are being actively exploited in the wild and require federal agencies to apply patches by the due date.Why is this Significant?This is significant because CVE-2020-5741 (Plex Media Server Remote Code Execution Vulnerability) and CVE-2021-39144 (XStream Remote Code Execution Vulnerability) on the CISA’s Known Exploited Vulnerabilities Catalog were observed to be actively exploited in the wild. As such, patches should be applied to both vulnerabilities as soon as possible.What is CVE-2020-5741?CVE-2020-5741 is a Remote Code Execution (RCE) vulnerability that affects Plex Media Server version 1.19.2 and prior. Successful exploitation allows a remote attacker to execute arbitrary Python code within the context of the application.What is CVE-2021-39144?CVE-2021-39144 is an Insecure Deserialization vulnerability that affects VMware library XStream version 1.4.17 and prior. The vulnerability is due to insufficient sanitizing of user supplied inputs in the application. A remote attacker could exploit this to execute arbitrary code within the context of the application, via uploading a crafted XML file.Have the Vendors Released a Patch for CVE-2020-5741 and CVE-2021-39144?Yes. Patches for CVE-2020-5741 and CVE-2021-39144 are available.What is the Status of Protection?FortiGuard Labs has the following IPS protection in place for CVE-2020-5741 and CVE-2021-39144:Plex.Media.Server.Dict.File.Remote.Code.Execution (CVE-2020-5741)VMWare.NSX.Manager.XStream.CVE-2021-39144.Deserialization (CVE-2021-39144)
liferea-1.14.1-1.fc37
Read Time:6 Second
FEDORA-2023-1ba7a77530
Packages in this update:
liferea-1.14.1-1.fc37
Update description:
Security fix for CVE-2023-1350