ManageEngine ServiceDesk Plus Multiple Versions Authentication Bypass

Zoho ManageEngine ServiceDesk Plus versions 11.3 before 11302, 11.2 before 11208, 11.1 before 11145 and 11.0 before 11012 are vulnerable to authentication bypass that allows a few REST-API URLs without authentication. Note that Nessus has not tested for this issue but has instead relied only on t...

SUSE SLES12: libjavascriptcoregtk-4_0-18 / libwebkit2gtk-4_0-37 / etc (SUSE-SU-2022:0142-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0142-1 advisory. - Update to version 2.34.3 bsc1194019. - CVE-2021-30887: Fixed logic issue allowing unexpectedly unenforced Content Security Policy...

CVE-2021-39944

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. A permissions validation flaw allowed group members with a developer role to elevate their privilege ...

Cross site scripting

IBM Security Guardium 10.5, 10.6, 11.0, 11.1, 11.2, and 11.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

Security Bulletin: IBM Security Guardium is affected by an OpenLDAP vulnerability (CVE-2020-25692)

Summary IBM Security Guardium has fixed this vulnerability Vulnerability Details CVEID: CVE-2020-25692 DESCRIPTION: OpenLDAP is vulnerable to a denial of service, caused by a NULL pointer dereference. By sending a specially crafted TCP packet, a remote attacker could exploit this vulnerability to...

Security Bulletin: IBM Security Guardium is affected by the following vulnerabilities ( CVE-2021-29773, CVE-2021-2161)

Summary IBM Security Guardium has fixed these vulnerabilities Vulnerability Details CVEID: CVE-2021-29773 DESCRIPTION: IBM Security Guardium could allow a remote authenticated attacker to obtain sensitive information or modify user details caused by an insecure direct object vulnerability IDOR...

XML External Entity Reference in org.opencms:opencms-core

An XML external entity XXE vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document...

Security Bulletin: IBM Security Guardium is affected by kernel vulnerabilities

Summary IBM Security Guardium has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2019-10639 DESCRIPTION: Linux Kernel could allow a remote attacker to obtain sensitive information, caused by the use of a weak function to generate IP packet IDs. By sniffing the network, ...

CVE-2021-39874

In all versions of GitLab CE/EE since version 11.0, the requirement to enforce 2FA is not honored when using git commands...

Jetty 11.0.x < 11.0.1 Denial of Service

The version of Jetty installed on the remote host handles a request containing request headers with a large number of quality i.e. q parameters, the server may enter a denial of service DoS state due to high CPU usage. Note that the scanner has not tested for this issue but has instead relied onl...

Jetty < 9.4.39 Multiple Vulnerabilities

According to its self-reported version number, the instance of Jetty hosted on the remote web server is prior to 9.4.39, 10.0.x prior to 10.0.2 or 11.0.x prior to 11.0.2. It is, therefore, affected by multiple vulnerabilities: - An issue where CPU usage can reach 100% with a large invalid TLS...

CVE-2021-20569

IBM Security Secret Server up to 11.0 could allow an attacker to enumerate usernames due to improper input validation. IBM X-Force ID: 199243...

CVE-2021-20569

CVE-2021-20569 affects IBM Security Secret Server (up to 11.0). The flaw arises from improper input validation that could allow an attacker to enumerate usernames. The IBM security bulletin notes this as a vulnerability in IBM Security Verify Privilege Vault (formerly Secret Server) with a CVSS v...

Security Bulletin: Multiple Vulnerabilities Have Been Identified In IBM Security Verify Privilege Vault

Summary Multiple vulnerabilities identified in IBM Security Verify Privilege Vault previously known as IBM Security Secret Server have been addressed in the release 11.0. Vulnerability Details CVEID: CVE-2021-20569 DESCRIPTION: IBM Security Verify Privilege could allow an attacker to enumerate...

Security Bulletin: IBM Security Guardium is affected by an Escalation of Privileges vulnerability (CVE-2019-4422)

Summary IBM Security Guardium has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2019-4422 DESCRIPTION: IBM Security Guardium are vulnerable to a privilege escalation which could allow an authenticated user to change the accessmgr password. CVSS Base Score: 8.8 CVSS...

Apple macOS 输入验证错误漏洞

Apple macOS is a specialized operating system developed for Mac computers by Apple Inc. in the United States. An input validation error vulnerability exists in macOS due to insufficient validation of user-provided input in IOKit. A native application can execute arbitrary code using root...

Nvidia vGPU Software 输入验证错误漏洞

Nvidia vGPU Software is a management software from Nvidia, USA for providing GPU capabilities to virtual machines. The software supports multiple virtual machines to access the host's GPU, providing graphics performance and application compatibility for virtual machines. An input validation error...

jetty: buffer not correctly recycled in Gzip Request inflation

In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection, and if an attacker can send a request with a body that ...

Last Week’s Security news: Cisco ASA, BIG-IQ, vSphere, Solaris, Dlink, iPhone %s, DarkRadiation, Google schema, John McAfee

Hello, today I want to experiment with a new format. I will be reading last weeks news from my @avleonovnews channel, which I found the most interesting. I do this mostly for myself, but if you like it too, then that would be great. Please subscribe to my YouTube channel and my Telegram...

Security Bulletin: IBM Security Guardium is affected by an Information Exposure vulnerability (CVE-2020-4189)

Summary IBM Security Guardium has fixed this vulnerability Vulnerability Details CVEID: CVE-2020-4189 DESCRIPTION: IBM Security Guardium discloses sensitive information in the response headers that could be used in further attacks against the system. CVSS Base score: 4.3 CVSS Temporal Score: See:...