CVE-2021-20527

IBM Resilient SOAR V38.0 could allow a privileged user to create create malicious scripts that could be executed as another user. IBM X-Force ID: 198759...

SAP NetWeaver AS ABAP Denial of Service Vulnerability (CNVD-2021-29099)

SAP Netweaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. A denial of service vulnerability exists in SAP NetWeaver AS ABAP versions 731, 740, and 750. The vulnerability...

CVE-2021-27603

An RFC enabled function module SPIWAITMILLIS in SAP NetWeaver AS ABAP, versions - 731, 740, 750, allows to keep a work process busy for any length of time. An attacker could call this function module multiple times to block all work processes thereby causing Denial of Service and affecting the...

CVE-2021-27601

SAP NetWeaver AS Java Applications based on HTMLB for Java allows a basic-level authorized attacker to store a malicious file on the server. When a victim tries to open this file, it results in a Cross-Site Scripting XSS vulnerability and the attacker can read and modify data. However, the attack...

CVE-2021-27601

CVE-2021-27601 affects SAP NetWeaver AS Java (Applications based on HTMLB for Java). An authorized, basic-level attacker can store a malicious file on the server; when a victim opens that file, a Cross-Site Scripting (XSS) vulnerability can allow reading and modification of data. The root cause i...

CVE-2021-27603

The CVE-2021-27603 entry concerns SAP NetWeaver AS ABAP. It affects SAP NetWeaver AS ABAP versions 731, 740, and 750, where the RFC function module SPI_WAIT_MILLIS can be invoked to keep a work process busy, enabling an attacker to repeatedly call it and block all work processes, causing a Denial...

CVE-2021-27598

SAP NetWeaver AS JAVA (Customer Usage Provisioning Servlet) vulnerability CVE-2021-27598 affects SAP NetWeaver AS JAVA versions 7.31, 7.40, and 7.50. The root cause is a missing authorization check in the Customer Usage Provisioning Servlet, allowing an attacker to read statistical data such as p...

CVE-2021-28646

CVE-2021-28646 describes an insecure file-permissions flaw in Trend Micro Apex One, Apex One as a Service, and OfficeScan XG SP1 that could allow a local attacker to take control of a specific log file on affected installations. Connected sources indicate the root cause is improper log-file permi...

PT-2021-17537

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS Java affected versions not specified Description The issue allows a basic-level authorized attacker to store a malicious file on the server, which can lead to a Cross-Site Scripting XSS vulnerability when a victim attempts to...

PT-2021-3229

Name of the Vulnerable Software and Affected Versions Trend Micro Apex One affected versions not specified Trend Micro Apex One as a Service affected versions not specified Trend Micro OfficeScan XG SP1 affected versions not specified Description The issue is related to insecure file permissions,...

CVE-2021-27603: Undefined Security Weakness

An RFC enabled function module SPIWAITMILLIS in SAP NetWeaver AS ABAP, versions - 731, 740, 750, allows to keep a work process busy for any length of time. An attacker could call this function module multiple times to block all work processes thereby causing Denial of Service and affecting the...

CVE-2021-28645: Incorrect Permission Assignment for Critical Resource

An incorrect permission assignment vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target...

CVE-2021-25253: Incorrect Permission Assignment for Critical Resource

An improper access control vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service and OfficeScan XG SP1 on a resource used by the service could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to...

CVE-2021-28646: Incorrect Permission Assignment for Critical Resource

An insecure file permissions vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a local attacker to take control of a specific log file on affected installations...

CVE-2021-27598: Improper Access Control

SAP NetWeaver AS JAVA Customer Usage Provisioning Servlet, versions - 7.31, 7.40, 7.50, allows an attacker to read some statistical data like product version, traffic, timestamp etc. because of missing authorization check in the servlet...

CVE-2021-27601: Improper Neutralization of Input During Web Page Generation

SAP NetWeaver AS Java Applications based on HTMLB for Java allows a basic-level authorized attacker to store a malicious file on the server. When a victim tries to open this file, it results in a Cross-Site Scripting XSS vulnerability and the attacker can read and modify data. However, the attack...

CVE-2021-25250: Incorrect Permission Assignment for Critical Resource

An improper access control vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service and OfficeScan XG SP1 on a sensitive file could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute...

PT-2021-3228

Name of the Vulnerable Software and Affected Versions Trend Micro Apex One versions affected versions not specified Trend Micro Apex One as a Service versions affected versions not specified Trend Micro OfficeScan XG SP1 versions affected versions not specified Description The issue is related to...

A Quick Look Into Cloud Workload Protection Platforms (CWPPs)

The cloud security solutions market is growing rapidly, and there are many types of solutions to support your specific business needs. But figuring out the right tool—let alone the right type of tool—can be difficult. Gartner has five security archetypes that fall under the broader cloud security...

Hackers Targeting professionals With 'more_eggs' Malware via LinkedIn Job Offers

A new spear-phishing campaign is targeting professionals on LinkedIn with weaponized job offers in an attempt to infect targets with a sophisticated backdoor trojan called "moreeggs." To increase the odds of success, the phishing lures take advantage of malicious ZIP archive files that have the...