128 matches found
csm path traversal vulnerability
csm is a csm-aut open source automation and orchestration framework for IOS-XR devices. csm 3.5 and earlier versions have a path traversal vulnerability that stems from a failure of Flask's sendfile function to properly filter special elements in a resource or file path, which can be exploited by...
CVE-2022-31530
The csm-aut/csm repository through 3.5 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...
Path traversal
The csm-aut/csm repository through 3.5 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...
CVE-2022-31530
The csm-aut/csm repository through 3.5 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...
CVE-2022-31530
The CVE-2022-31530 issue affects the csm-aut/csm repository up to version 3.5. Root cause: unsafe use of Flask’s send_file function, which allows absolute path traversal. Impact: an attacker could access arbitrary files/directories on the file system. The Red Hat, ENISA, CNVD, CVE databases corro...
csm 路径遍历漏洞
csm is a csm-aut open source automation and orchestration framework for IOS-XR devices. csm 3.5 and earlier versions have a path traversal vulnerability that stems from a failure of Flask's sendfile function to properly filter special elements in a resource or file path, which can be exploited by...
Cross site scripting
The administration interface of the Raytion Custom Security Manager Raytion CSM in Version 7.2.0 allows reflected Cross-site Scripting XSS...
CVE-2022-29931
CVE-2022-29931 affects Raytion Custom Security Manager (CSM) administration interface in version 7.2.0, where a reflected Cross-site Scripting (XSS) vulnerability exists. The vulnerability arises in the admin UI and could allow injection of malicious scripts into the browser for victims visiting ...
Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU - Oct 2021 - Includes Oracle October 2021 CPU
Summary Multiple vulnerabilities has been identified in IBM Java. IBM SDK, Java Technology Edition Quarterly CPU - Oct 2021 - Includes Oracle October 2021 CPU Copy Services Manager has a dependency on Java. Version CSM 6.3.1 and prior are therefore exposed by this vulnerability. CSM 6.3.2 ships a...
Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU - Oct 2021 - Includes Oracle October 2021 CPU
Summary Multiple vulnerabilities has been identified in IBM Java. IBM SDK, Java Technology Edition Quarterly CPU - Oct 2021 - Includes Oracle October 2021 CPU CVE-2021-35560, CVE-2021-35586, CVE-2021-35578, CVE-2021-35564, CVE-2021-35559, CVE-2021-35556, CVE-2021-35565, CVE-2021-35588,...
Security Bulletin: IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 and Liberty 17.0.0.3 through 21.0.0.9 could allow a remote user to enumerate usernames due to a difference of responses from valid and invalid login attempts. IBM X-Force ID: 205202.
Summary Copy Services Manager is dependant on the capabilities of IBM Websphere application server versions that have been identified by this CVE. CSM version 6.3.1 and earlier versions ship with the versions that have been identified as having this weakness. CSM version 6.3.2 contains an updated...
CVE-2022-26158
CVE-2022-26158 affects Cherwell Service Management (CSM) 10.2.3 web application, where a client-controlled Host header is reflected and can trigger a 302 redirect to an attacker-controlled page by injecting a malicious URL in Host. This creates an indirect navigation/redirect vulnerability. Affec...
CVE-2022-26157
CVE-2022-26157 affects Cherwell Service Management (CSM) 10.2.3. The issue is that the ASP.NET_Sessionid cookie is not protected with the Secure flag, allowing potential interception if traffic is not encrypted. The available documents consistently describe: the vulnerable component is the ASP.NE...
CVE-2022-26156
CVE-2022-26156 affects Cherwell Service Management (CSM) web application, version 10.2.3. The issue is an injection of a malicious payload into the RelayState= parameter of the HTTP request body, causing form-action hijacking by altering the form submission URL to an attacker-controlled endpoint....
CVE-2022-26155
Cherwell Service Management (CSM) web application, version 10.2.3, is affected by an XSS vulnerability exploitable via a payload in the SAMLResponse parameter of the HTTP request body. The issue is documented across multiple sources (NVD, Red Hat, CVE repositories) with the same root cause: unesc...
Cisco Security Manager Cross-Site Scripting Vulnerability (CNVD-2022-06385)
Cisco Security Manager CSM is a set of enterprise-class management applications from Cisco USA, which is mainly used to configure firewall, VPN and intrusion protection security services on Cisco networks and security devices.Cisco Security Manager has a cross-site scripting vulnerability, which...
CVE-2021-3786
A potential vulnerability in the SMI callback function used in CSME configuration of some Lenovo Notebook and ThinkPad systems could be used to leak out data out of the SMRAM range...
CVE-2020-0541
Out-of-bounds write in subsystem for IntelR CSME versions before 12.0.64, 13.0.32, 14.0.33 and 14.5.12 may allow a privileged user to potentially enable escalation of privilege via local access...
CVE-2020-0533
Reversible one-way hash in IntelR CSME versions before 11.8.76, 11.12.77 and 11.22.77 may allow a privileged user to potentially enable escalation of privilege, denial of service or information disclosure via local access...
