Advisories

The cPanel security team released an update that addresses the 2FA bypass vulnerability.

The Drupal security team released a security update to address a critical drupal core Remote Code Execution Vulnerability.

Cisco security released patches that address 17 vulnerabilities (high severity) for appliances that include Adaptive Security Appliance (ASA), Firepower Threat Defence (FTD) and Firepower Management Center (FMC).

Google released a security update (Chrome version 86.0.4240.111) that addresses high severity vulnerabilities affecting the Google Chrome bowser on Linux, Mac and Windows computers. We strongly urge all users to immediately update their browser.

Oracle released a critical patch update to address multiple security vulnerabilities in Oracle code and in third party components included in Oracle products. As is Oracle practice, the patches are cumulative which requires data base admins to also review the previous patches.

The Microsoft Security Response Center has released an advisory on a Remote Code Execution vulnerability that exists when the Windows TCP/IP stack improperly handles ICMPv6 Router Advertisement packets.

The Microsoft Security Response Center released another security advisory concerning a Remote Code Execution (RCE) vulnerability exists in Microsoft Outlook software when the software fails to properly handle objects in memory.

Microsoft Security Team advises that ‘an elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC).

The QNAP security team released updates that address two critical security vulnerabilities in the Helpdesk app that could enable potential attackers to take over unpatched QNAP network attached storage (NAS) devices.

Microsoft released cumulative updates and a service pack that addressed a remote code execution vulnerability found in Microsoft Exchange 2010, 2013, 2016, and 2019. This vulnerability affects unpatched exchange servers since 11th Feb 2020.

Emotet is a Trojan that is primarily spread through spam emails with the intent to steal sensitive and private information from compromised accounts.

The Cisco security team security patches for two high-severity vulnerabilities affecting its IOS XR software.

Security researchers have confirmed that installations of Fortigate VPN solutions with default settings allows an attacker to present a valid SSL certificate and carry out man-in-the-middle attacks on user connections.

An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol.

Intel security has released an advisory that addresses a potential security vulnerability in Intel® Active Management Technology (AMT), and Intel® Standard Manageability (ISM) that may allow escalation of privilege.

Adobe has released a security update for Adobe InDesign. All system administrators are advised to study the advisory and apply the appropriate actions.

CERT.UG/CC raises this advisory that provides information on a North Korean group known as BuggleBoys that targets financial sectors across the globe using a Remote Access Tool (RAT) malware for exploiting weak network and system defenses.

Cisco has released advisories addressing vulnerabilities in a range of products. All Network administrators are advised to study the advisory and apply the appropriate measures.

Drupal users should upgrade to the latest versions to mitigate against potential XSS vulnerabilities. Web administrators should review the detailed advisory.

Cisco has released its ASA, FMC and FTD Software Security Bundled Publication. This addresses 12 Cisco Security Advisories that describe 12 vulnerabilities in Cisco ASA and FTD Software.