Bachmann Electronic All M-Base Controllers 加密问题漏洞

Bachmann Electronic All M-Base Controllers is a controller system from Bachmann, Germany, used to control networks. A cryptographic issue vulnerability exists in Bachmann Electronic All M-Base Controllers that stems from not properly using the relevant cryptographic algorithms, resulting in...

All Bachmann M1 System Processor Modules

1. EXECUTIVE SUMMARY CVSS v3 7.2 ATTENTION: Exploitable remotely/low attack complexity Vendor: Bachmann Electronic, GmbH Equipment: All M-Base Controllers Vulnerability: Use of Password Hash with Insufficient Computational Effort 2. REPOSTED INFORMATION This updated advisory is a follow-up to the...

389-ds-base: sync_repl NULL pointer dereference in sync_create_state_control()

A flaw was found In 389-ds-base. When the Content Synchronization plugin is enabled, an authenticated user can reach a NULL pointer dereference using a specially crafted query. This flaw allows an authenticated attacker to cause a denial of service. The highest threat from this vulnerability is t...

Moderate: Red Hat Security Advisory: 389-ds:1.4 security and bug fix update

An update for the 389-ds:1.4 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

389-ds:1.4 security and bug fix update

An update is available for 389-ds-base. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list 389 Directory Server is an LDAP version 3 LDAPv3 compliant server. The ba...

Security Bulletin: IBM® Db2® could allow an authenticated user to overwrite arbitrary files due to improper group permissions. (CVE-2020-4945)

Summary IBM Db2 for Linux, UNIX and Windows includes DB2 Connect Server could allow an authenticated user to overwrite arbirary files due to improper group permissions. Vulnerability Details CVEID: CVE-2020-4945 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server could...

rpm security update

An update is available for rpm. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The RPM Package Manager RPM is a command-line driven package management system...

Security Bulletin: Multiplie vulnerabilities Have Been Identified In IBM Security Verify Privilege Manager

Summary Multiplie vulnerabilities identified in IBM Security Verify Privilege Manager previously known as IBM Security Privilege Manager has been addressed in the release 11.0 Vulnerability Details CVEID: CVE-2020-4609 DESCRIPTION: IBM Security Sevret Server is vulnerable to a buffer overflow,...

MITRE introduces D3FEND framework

The US National Security Agency NSA has announced it will fund the development of a knowledge base of defensive countermeasures for the most common techniques used by malicious threat actors. The project will be made available through MITRE and will be called D3FEND as it complements MITRE’s...

Medium: 389-ds-base

Issue Overview: When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in the LDAP database. CVE-2020-35518 Affected Packages: 389-ds-base Note:...

SUSE: Security Advisory (SUSE-SU-2021:14753-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Weak Password Vulnerability in the web management platform of China Control Time & Attendance Machine

CCTC Intelligent Technology Co., Ltd. generally refers to Entropy Base Technology Co., Ltd. which is a globally recognized company with biometrics as its core technology. A weak password vulnerability exists in the web-based management platform of ZhongControl Time and Attendance Machine, which c...

Important: slapi-nis

Issue Overview: A flaw was found in slapi-nis. A NULL pointer dereference during the parsing of the Binding DN could allow an unauthenticated attacker to crash the 389-ds-base directory server. The highest threat from this vulnerability is to system availability. CVE-2021-3480 Affected Packages:...

Arbitrary File Download Vulnerability in Web Management Platform of Time Attendance Machine of China Control

CCTC Intelligent Technology Co., Ltd. generally refers to Entropy Base Technology Co., Ltd. which is a globally recognized company with biometrics as its core technology. An arbitrary file download vulnerability exists in the web management platform of ZhongControl Attendance Machine, which can b...

The vulnerability of PHPKB knowledge base software, related to insufficient validation of input data, allows attackers to gain unauthorized access to protected information.

The vulnerability of the PHPKB knowledge base software is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

Security Bulletin: IBM Cloud Transformation Advisor is affected by Node.js vulnerability

Summary IBM Cloud Transformation Advisor has addressed Node.js vulnerability CVE-2021-23337 Vulnerability Details CVEID: CVE-2021-23337 DESCRIPTION: Node.js lodash module could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by a command injection flaw in...

Security Bulletin: A vulnerability in IBM WebSphere Liberty affects IBM WIoTP MessageGateway

Summary There is a Dojo vulnerability in IBM WebSphere Liberty that affects IBM WIoTP MessageGateway. Vulnerability Details CVEID: CVE-2020-5258 DESCRIPTION: Dojo dojo could allow a remote attacker to inject arbitrary code on the system, caused by a prototype pollution flaw. By injecting other...

CVE-2020-36385

An issue was discovered in the Linux kernels Userspace Connection Manager Access for RDMA. This could allow a local attacker to crash the system, corrupt memory or escalate privileges. Mitigation Mitigation for this issue is either not available or the currently available options does not meet th...

Prismatic < 2.8 - Contributor+ Stored XSS

The plugin does not sanitise or validate some of its shortcode parameters, allowing users with a role as low as Contributor to set Cross-Site payload in them. A post made by a contributor would still have to be approved by an admin to have the XSS trigger able in the frontend, however, higher...

XStream: Unsafe deserizaliation of javax.sql.rowset.BaseRowSet

A flaw was found in xstream. A remote attacker may be able to load and execute arbitrary code from a remote host only by manipulating the processed input stream. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...