The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a database and tools to fix them.

Computer vulnerabilities of NETASQ

computer threat 30263

Stormshield Network Security, Netasq: Cross Site Scripting via Certificate-based Authentication

Synthesis of the vulnerability

An attacker can trigger a Cross Site Scripting via Certificate-based Authentication of Stormshield Network Security or Netasq, in order to run JavaScript code in the context of the web site.
Severity: 2/4.
Creation date: 06/09/2019.
Identifiers: CERTFR-2019-AVI-426, STORM-2019-014, VIGILANCE-VUL-30263, VU#672565.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can trigger a Cross Site Scripting via Certificate-based Authentication of Stormshield Network Security or Netasq, in order to run JavaScript code in the context of the web site.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability note 30262

Stormshield Network Security, Netasq: Cross Site Request Forgery via Webadmin

Synthesis of the vulnerability

An attacker can trigger a Cross Site Request Forgery via Webadmin of Stormshield Network Security or Netasq, in order to force the victim to perform operations.
Severity: 2/4.
Creation date: 06/09/2019.
Identifiers: STORM-2019-012, VIGILANCE-VUL-30262.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can trigger a Cross Site Request Forgery via Webadmin of Stormshield Network Security or Netasq, in order to force the victim to perform operations.
Full Vigil@nce bulletin... (Free trial)

cybersecurity announce CVE-2019-1125

Intel 64-bit CPU: information disclosure via SWAPGS

Synthesis of the vulnerability

A local attacker can read a memory fragment via SWAPGS of Intel 64-bit CPU, in order to obtain sensitive information.
Severity: 1/4.
Creation date: 07/08/2019.
Identifiers: 1103505, CERTFR-2019-AVI-375, CERTFR-2019-AVI-376, CERTFR-2019-AVI-381, CERTFR-2019-AVI-390, CERTFR-2019-AVI-391, CERTFR-2019-AVI-392, CERTFR-2019-AVI-417, CERTFR-2019-AVI-418, CERTFR-2019-AVI-428, CERTFR-2019-AVI-440, CERTFR-2019-AVI-458, CERTFR-2019-AVI-467, CERTFR-2019-AVI-486, CVE-2019-1125, DLA-1884-1, DLA-1885-1, DSA-4495-1, DSA-4497-1, FEDORA-2019-6bda4c81f4, FEDORA-2019-e37c348348, K31085564, openSUSE-SU-2019:1923-1, openSUSE-SU-2019:1924-1, RHSA-2019:2405-01, RHSA-2019:2411-01, RHSA-2019:2473-01, RHSA-2019:2476-01, RHSA-2019:2600-01, RHSA-2019:2609-01, RHSA-2019:2695-01, RHSA-2019:2696-01, RHSA-2019:2730-01, RHSA-2019:2899-01, RHSA-2019:2900-01, RHSA-2019:2975-01, RHSA-2019:3220-01, SB10297, SSA:2019-226-01, STORM-2019-007, SUSE-SU-2019:14157-1, SUSE-SU-2019:2068-1, SUSE-SU-2019:2069-1, SUSE-SU-2019:2070-1, SUSE-SU-2019:2071-1, SUSE-SU-2019:2072-1, SUSE-SU-2019:2073-1, SUSE-SU-2019:2262-1, SUSE-SU-2019:2263-1, SUSE-SU-2019:2299-1, SUSE-SU-2019:2430-1, SUSE-SU-2019:2450-1, SWAPGS, Synology-SA-19:32, USN-4093-1, USN-4094-1, USN-4095-1, USN-4095-2, USN-4096-1, VIGILANCE-VUL-29962.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

A local attacker can read a memory fragment via SWAPGS of Intel 64-bit CPU, in order to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial)

cybersecurity threat CVE-2018-0202 CVE-2018-1000085

ClamAV: vulnerability

Synthesis of the vulnerability

A vulnerability of ClamAV was announced.
Severity: 2/4.
Number of vulnerabilities in this bulletin: 2.
Creation date: 02/03/2018.
Identifiers: CVE-2018-0202, CVE-2018-1000085, DLA-1307-1, openSUSE-SU-2018:0825-1, openSUSE-SU-2018:2406-1, STORM-2018-003, SUSE-SU-2018:0809-1, SUSE-SU-2018:0863-1, SUSE-SU-2018:2323-1, USN-3592-1, USN-3592-2, VIGILANCE-VUL-25413.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

A vulnerability of ClamAV was announced.
Full Vigil@nce bulletin... (Free trial)

computer threat alert CVE-2017-12374 CVE-2017-12375 CVE-2017-12376

ClamAV: seven vulnerabilities

Synthesis of the vulnerability

An attacker can use several vulnerabilities of ClamAV.
Severity: 3/4.
Number of vulnerabilities in this bulletin: 7.
Creation date: 26/01/2018.
Identifiers: CVE-2017-12374, CVE-2017-12375, CVE-2017-12376, CVE-2017-12377, CVE-2017-12378, CVE-2017-12379, CVE-2017-12380, DLA-1261-1, FEDORA-2018-958b22c73f, openSUSE-SU-2018:0258-1, STORM-2018-002, SUSE-SU-2018:0254-1, SUSE-SU-2018:0255-1, USN-3550-1, USN-3550-2, VIGILANCE-VUL-25165.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can use several vulnerabilities of ClamAV.
Full Vigil@nce bulletin... (Free trial)

cybersecurity vulnerability CVE-2017-11423

libmspack: denial of service via CAB

Synthesis of the vulnerability

An attacker can generate a fatal error via CAB of libmspack, in order to trigger a denial of service.
Severity: 2/4.
Creation date: 18/08/2017.
Identifiers: CVE-2017-11423, DLA-1279-1, DSA-3946-1, FEDORA-2017-982bfabc4e, FEDORA-2017-b97f9d82dc, openSUSE-SU-2018:0258-1, openSUSE-SU-2018:0825-1, STORM-2018-003, SUSE-SU-2018:0254-1, SUSE-SU-2018:0255-1, SUSE-SU-2018:0809-1, SUSE-SU-2018:0863-1, USN-3394-1, VIGILANCE-VUL-23563.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can generate a fatal error via CAB of libmspack, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial)

vulnerability alert CVE-2017-6419

ClamAV: buffer overflow via mspack/lzxd.c

Synthesis of the vulnerability

An attacker can generate a buffer overflow via mspack/lzxd.c of ClamAV, in order to trigger a denial of service, and possibly to run code.
Severity: 3/4.
Creation date: 07/08/2017.
Identifiers: CVE-2017-6419, DLA-1279-1, DSA-3946-1, FEDORA-2017-982bfabc4e, FEDORA-2017-b97f9d82dc, FEDORA-2018-958b22c73f, FEDORA-2018-cb339851e7, openSUSE-SU-2018:0258-1, openSUSE-SU-2018:0825-1, STORM-2018-003, SUSE-SU-2018:0254-1, SUSE-SU-2018:0255-1, SUSE-SU-2018:0809-1, SUSE-SU-2018:0863-1, USN-3393-1, USN-3393-2, USN-3394-1, VIGILANCE-VUL-23455.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can generate a buffer overflow via mspack/lzxd.c of ClamAV, in order to trigger a denial of service, and possibly to run code.
Full Vigil@nce bulletin... (Free trial)

computer weakness CVE-2012-6706

unrar: memory corruption via VMSF_DELTA

Synthesis of the vulnerability

An attacker can generate a memory corruption via VMSF_DELTA of unrar, in order to trigger a denial of service, and possibly to run code.
Severity: 2/4.
Creation date: 23/06/2017.
Identifiers: bulletinjul2017, CERTFR-2017-AVI-238, CVE-2012-6706, DLA-1003-1, openSUSE-SU-2017:1658-1, openSUSE-SU-2017:1797-1, openSUSE-SU-2018:0825-1, SB10205, STORM-2018-003, SUSE-SU-2017:1716-1, SUSE-SU-2017:1745-1, SUSE-SU-2017:1760-1, SUSE-SU-2018:0809-1, SUSE-SU-2018:0863-1, VIGILANCE-VUL-23073.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can generate a memory corruption via VMSF_DELTA of unrar, in order to trigger a denial of service, and possibly to run code.
Full Vigil@nce bulletin... (Free trial)

computer weakness 19729

Netasq, Stormshield Network Security: Man-in-the-Middle via NSRPC Client

Synthesis of the vulnerability

An attacker can act as a Man-in-the-Middle via NSRPC on Netasq or Stormshield Network Security, in order to obtain administrator privileges.
Severity: 2/4.
Creation date: 30/05/2016.
Identifiers: STORM-2016-001, VIGILANCE-VUL-19729.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

The Netasq and Stormshield Network Security products use the NSRPC client.

However, an attacker can alter the size of NSRPC message, to perform a brute force, to get the administrator password hash.

An attacker can therefore act as a Man-in-the-Middle via NSRPC on Netasq or Stormshield Network Security, in order to obtain administrator privileges.
Full Vigil@nce bulletin... (Free trial)

vulnerability note CVE-2016-2105 CVE-2016-2106 CVE-2016-2107

OpenSSL: six vulnerabilities

Synthesis of the vulnerability

An attacker can use several vulnerabilities of OpenSSL.
Severity: 3/4.
Number of vulnerabilities in this bulletin: 6.
Creation date: 03/05/2016.
Identifiers: 1982949, 1985850, 1987779, 1993215, 1995099, 1998797, 2003480, 2003620, 2003673, 510853, 9010083, bulletinapr2016, bulletinapr2017, CERTFR-2016-AVI-151, CERTFR-2016-AVI-153, CERTFR-2018-AVI-160, cisco-sa-20160504-openssl, cpuapr2017, cpujan2018, cpujul2016, cpujul2017, cpujul2018, cpuoct2016, cpuoct2017, cpuoct2018, CTX212736, CTX233832, CVE-2016-2105, CVE-2016-2106, CVE-2016-2107, CVE-2016-2108, CVE-2016-2109, CVE-2016-2176, DLA-456-1, DSA-3566-1, ESA-2017-142, FEDORA-2016-05c567df1a, FEDORA-2016-1e39d934ed, FEDORA-2016-e1234b65a2, FG-IR-16-026, FreeBSD-SA-16:17.openssl, HPESBGN03728, HPESBHF03756, HT206903, JSA10759, K23230229, K36488941, K51920288, K75152412, K93600123, MBGSA-1603, MIGR-5099595, MIGR-5099597, NTAP-20160504-0001, openSUSE-SU-2016:1237-1, openSUSE-SU-2016:1238-1, openSUSE-SU-2016:1239-1, openSUSE-SU-2016:1240-1, openSUSE-SU-2016:1241-1, openSUSE-SU-2016:1242-1, openSUSE-SU-2016:1243-1, openSUSE-SU-2016:1273-1, openSUSE-SU-2016:1566-1, openSUSE-SU-2017:0487-1, PAN-SA-2016-0020, PAN-SA-2016-0028, RHSA-2016:0722-01, RHSA-2016:0996-01, RHSA-2016:1137-01, RHSA-2016:1648-01, RHSA-2016:1649-01, RHSA-2016:1650-01, RHSA-2016:2054-01, RHSA-2016:2055-01, RHSA-2016:2056-01, RHSA-2016:2073-01, SA123, SA40202, SB10160, SOL23230229, SOL36488941, SOL51920288, SOL75152412, SP-CAAAPPQ, SPL-119440, SPL-121159, SPL-123095, SSA:2016-124-01, STORM-2016-002, SUSE-SU-2016:1206-1, SUSE-SU-2016:1228-1, SUSE-SU-2016:1231-1, SUSE-SU-2016:1233-1, SUSE-SU-2016:1267-1, SUSE-SU-2016:1290-1, SUSE-SU-2016:1360-1, SUSE-SU-2018:0112-1, TNS-2016-10, USN-2959-1, VIGILANCE-VUL-19512, VN-2016-006, VN-2016-007.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

Several vulnerabilities were announced in OpenSSL.

An attacker can act as a Man-in-the-Middle and use the AES CBC algorithm with a server supporting AES-NI, in order to read or write data in the session. This vulnerability was initially fixed in versions 1.0.1o and 1.0.2c, but it was not disclosed at that time. [severity:3/4; CVE-2016-2108]

An attacker can act as a Man-in-the-Middle and use the AES CBC algorithm with a server supporting AES-NI, in order to read or write data in the session. [severity:3/4; CVE-2016-2107]

An attacker can generate a buffer overflow in EVP_EncodeUpdate(), which is mainly used by command line applications, in order to trigger a denial of service, and possibly to run code. [severity:2/4; CVE-2016-2105]

An attacker can generate a buffer overflow in EVP_EncryptUpdate(), which is difficult to reach, in order to trigger a denial of service, and possibly to run code. [severity:2/4; CVE-2016-2106]

An attacker can trigger an excessive memory usage in d2i_CMS_bio(), in order to trigger a denial of service. [severity:2/4; CVE-2016-2109]

An attacker can force a read at an invalid address in applications using X509_NAME_oneline(), in order to trigger a denial of service, or to obtain sensitive information. [severity:2/4; CVE-2016-2176]
Full Vigil@nce bulletin... (Free trial)
Our database contains other pages. You can request a free trial to read them.