My.DenyAll

Security Advisories and Release Notes

ADVISORY: Unauthenticated Remote Code Execution sur DenyAll Web Application Firewall
2017-09-22

The vulnerability allows attackers to remotely execute Shell commands through the PHP API running on the administration interface (port 3001/tcp) of the WAF.

Release note DA WAF 6.4 (LVS)
2017-09-18

This document details changes introduced by the 6.4 version for DenyAll Web Application Firewall.

Security Research Advisory: A remote command execute (RCE) has been discovered in Apache Struts 2
2017-09-13

A remote command execute (RCE) has been discovered in Apache Struts 2, affecting versions 2.1.2 to 2.3.33 and 2.5 to 2.5.12.

CVE-2017-6919 - Drupal 8.x access bypass vulnerability
2017-04-21

A critical access bypass vulnerability has been published and fixed by the Drupal Security team on 19th April 2017. A remote attacker can retrieve an access to a Drupal 8.x web site through the RESTful Web Services module using PATCH requests.

CVE-2017-7269 - Buffer Overflow Vulnerability on IIS 6.0
2017-04-14

A buffer overflow has been discovered in the WebDAV service in Internet Information Services ISS 6.0 in Microsoft Windows Server 2003 R2. The vulnerability can lead to remote code execution (RCE) but it can only be exploited if the WebDAV service is enabled.

Release note DA WAF 6.3 (LVS)
2017-03-31

This document details changes introduced by the 6.3 version for DenyAll Web Application Firewall.

CVE-2017-5638 - Apache Struts2 S2-045: Remote Code Execution Vulnerability
2017-03-10

A serious vulnerability was discovered in Apache Struts 2, affecting versions of Apache Struts 2.3.5–2.3.31 and 2.5–2.5.10

Release notes 5.5.12
2017-02-02

Release date: february 02 2017. Revision: r37843. This version is a maintenance release of the Long Term Support (LTS) v5.5.

Release notes 5.5.11
2016-11-17

Release date: November 17 2016. Revision: r36634. This version is a maintenance release of the Long Term Support (LTS) v5.5.

Release DAWAF Security Update v5-3.26
2016-10-19

The Security update security-update-v5-3.26-36281.bsu for DAWAF / WAM / WSF is now available. Download it from the / Tech Support / Download / iSuite DAWAF / SECURITY UPDATES FOR LTS I-SUITE & LVS DENYALL WAF section.

Release note DA WAF 6.2 (LVS)
2016-10-10

This document details changes introduced by the 6.2 version for DenyAll Web Application Firewall.

OpenSSL Vulnerability - OCSP Status Request extension unbounded memory growth
2016-09-28

OpenSSL versions 1.0.2i and 1.0.1u have been published on 22th September, 2016, to correct one high, one moderate and several low vulnerabilities.Four days later, new OpenSSL versions have been immediately released to fix 2 issues introduced in version 1.0.2i and 1.1.0a.

CVE-2016-5696 - Off-Path TCP - Shared challenge ack vulnerability
2016-08-17

On 08th August, 2016, a flow has been discovered in the Linux kernel's TCP/IP implementation of the challenge ACK rate limiting (RFC 5961). A man-in-the-middle attacker could inject malicious data into unsecured TCP connections.

Release notes 5.5.10
2016-07-22

Release date: July 21 2016. Revision: r35317. This version is a maintenance release of the Long Term Support (LTS) v5.5.

rWeb / sProxy 4.2.2
2016-07-19

This document details all changes introduced in rWeb 4.2.2 version

Drupal PSA-2016-001 - Remote Code Execution
2016-07-12

On 12th July, 2016, Drupal announces three highly critical remote execution vulnerabilities on contributed modules.

Release note Vulnerability Manager Enterprise Edition 6.2
2016-05-30

This document details all changes introduced in Vulnerability Manager Enterprise Edition 6.2 version

OpenSSL Security Advisory [11 May 2015]
2016-05-11

OpenSSL Vulnerabily are fixed in the 1.0.2h/1.0.1t versions (AES-NI CBC padding oracle attack). The patches are available in the Tech Support > Download > SECURITY UPDATES FOR I-SUITE & DENYALL WAF. Update_openssl-1.0.1t_v5.5.9.rse for LTS version and Update_openssl-1.0.2h_v6.1.rse for LVS version.

Release note DA WAF 6.1 (LVS)
2016-05-02

This document details changes introduced by the 6.1 version for DenyAll Web Application Firewall.

Product data: latest versions

current versions: i-Suite v5.5.12 (LTS) & DA-WAF v6.4.1

i-Suite 5.5.12 and DA-WAF 6.4.1 and the accompanying Release Notes are now available for download in the Updates section (Tech Support menu).

Bug fix:
Versions LTS 5.2.8-bf15 and LTS 5.5.12 can now be downloaded . Go to Tech Support, Updates section.

ADVISORY: Unauthenticated Remote Code Execution sur DenyAll Web Application Firewall2017-09-22

Release note DA WAF 6.4 (LVS)2017-09-18

Security Research Advisory: A remote command execute (RCE) has been discovered in Apache Struts 22017-09-13

CVE-2017-6919 - Drupal 8.x access bypass vulnerability2017-04-21

CVE-2017-7269 - Buffer Overflow Vulnerability on IIS 6.02017-04-14

Release note DA WAF 6.3 (LVS)2017-03-31

CVE-2017-5638 - Apache Struts2 S2-045: Remote Code Execution Vulnerability 2017-03-10

Release notes 5.5.122017-02-02

Release notes 5.5.112016-11-17

Release DAWAF Security Update v5-3.262016-10-19

Release note DA WAF 6.2 (LVS)2016-10-10

OpenSSL Vulnerability - OCSP Status Request extension unbounded memory growth2016-09-28

CVE-2016-5696 - Off-Path TCP - Shared challenge ack vulnerability2016-08-17

Release notes 5.5.102016-07-22

rWeb / sProxy 4.2.22016-07-19

Drupal PSA-2016-001 - Remote Code Execution2016-07-12

Release note Vulnerability Manager Enterprise Edition 6.22016-05-30

OpenSSL Security Advisory [11 May 2015]2016-05-11

Release note DA WAF 6.1 (LVS)2016-05-02