Apache Tomcat 10.0.0.M1 < 10.0.21

The version of Tomcat installed on the remote host is prior to 10.0.21. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat10.0.21security-10 advisory. - The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.3...

ai.h2o:h2o-clustering (>=3.32.1.1, <=3.44.0.2), ai.h2o:h2o-k8s (>=3.30.0.2, <=3.44.0.2) +217 more potentially affected by CVE-2022-21230 via org.nanohttpd:nanohttpd (>=2.2.0, <=2.3.1)

org.nanohttpd:nanohttpd MAVEN version =2.2.0, =3.32.1.1, =3.30.0.2, =3.34.0.3, =1.0.0, =1.0.0, =1.0.0, =3.8, =1.0, =1.1, =0.2.22, =0.2.22, =0.4.15 and more Source cves: CVE-2022-21230 Source advisory: SNYK:JAVA-ORGNANOHTTPD-2422798...

com.github.waffle:waffle-tomcat10 (2.3.0), org.apache.tomcat:tomcat-catalina (>=10.0.0-m1, <=10.0.0-m7) +5 more potentially affected by CVE-2020-13943 via org.apache.tomcat:tomcat-coyote (>=10.0.0-m1, <=10.0.0-m7)

org.apache.tomcat:tomcat-coyote MAVEN version =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =3.0.0-m2, =10.0.0.beta1, =10.0.0.beta1, =10.0.0.final Source cves: CVE-2020-13943 Source advisory: OSV:GHSA-F268-65QC-98VG...

FBI Issues Flash Alert on Actively Exploited FatPipe VPN Zero-Day Bug

The U.S. Federal Bureau of Investigation FBI has disclosed that an unidentified threat actor has been exploiting a previously unknown weakness in the FatPipe MPVPN networking devices at least since May 2021 to obtain an initial foothold and maintain persistent access into vulnerable networks,...

CVE-2021-43496

Clustering master branch as of commit 53e663e259bcfc8cdecb56c0bb255bd70bfcaa70 is affected by a directory traversal vulnerability. This attack can cause the disclosure of critical secrets stored anywhere on the system and can significantly aid in getting remote code access...

Directory traversal

Clustering master branch as of commit 53e663e259bcfc8cdecb56c0bb255bd70bfcaa70 is affected by a directory traversal vulnerability. This attack can cause the disclosure of critical secrets stored anywhere on the system and can significantly aid in getting remote code access...

CVE-2021-43496

Clustering master branch as of commit 53e663e259bcfc8cdecb56c0bb255bd70bfcaa70 is affected by a directory traversal vulnerability. This attack can cause the disclosure of critical secrets stored anywhere on the system and can significantly aid in getting remote code access...

CVE-2021-43496

Clustering master branch as of commit 53e663e259bcfc8cdecb56c0bb255bd70bfcaa70 is affected by a directory traversal vulnerability. This attack can cause the disclosure of critical secrets stored anywhere on the system and can significantly aid in getting remote code access...

CVE-2021-43496

The CVE-2021-43496 entry concerns the Clustering project where the master branch (commit 53e663e259bcfc8cdecb56c0bb255bd70bfcaa70) is affected by a directory traversal vulnerability. The connected nuclei template documents a Local File Inclusion/directory traversal flaw that can disclose sensitiv...

PT-2021-23856

Name of the Vulnerable Software and Affected Versions Clustering master branch as of commit 53e663e259bcfc8cdecb56c0bb255bd70bfcaa70 Description The issue is a directory traversal vulnerability that can cause the disclosure of critical secrets stored anywhere on the system, significantly aiding i...

CVE-2021-43496: Improper Limitation of a Pathname to a Restricted Directory

Clustering master branch as of commit 53e663e259bcfc8cdecb56c0bb255bd70bfcaa70 is affected by a directory traversal vulnerability. This attack can cause the disclosure of critical secrets stored anywhere on the system and can significantly aid in getting remote code access...

Cluster path traversal vulnerability

Clustering is an open source approximate order clustering by Varun Suresh personal developer in the USA. It is used for face verification experiments. Clustering suffers from a path traversal vulnerability that stems from a commit in the main branch of Clustering being affected by a directory...

FatPipe Networks WARP/IPVPN/MPVPN 10.2.2 Backdoor Account

FatPipe Networks WARP/IPVPN/MPVPN 10.2.2 Hidden Backdoor Account Write Access Vendor: FatPipe Networks Inc. Product web page: https://www.fatpipeinc.com Affected version: WARP / IPVPN / MPVPN 10.2.2r38 10.2.2r25 10.2.2r10 10.1.2r60p82 10.1.2r60p71 10.1.2r60p65 10.1.2r60p58s1 10.1.2r60p58...

FatPipe Networks WARP/IPVPN/MPVPN 10.2.2 Hidden Backdoor Account (Write Access)

Summary FatPipe Networks invented the concept of router-clustering, which provides the highest level of reliability, redundancy, and speed of Internet traffic for Business Continuity and communications. FatPipe WARP achieves fault tolerance for companies by creating an easy method of combining tw...

CVE-2021-22997

On all 7.x and 6.x versions fixed in 8.0.0, BIG-IQ HA ElasticSearch service does not implement any form of authentication for the clustering transport services, and all data used by ElasticSearch for transport is unencrypted. Note: Software versions which have reached End of Software Development...

CVE-2021-22997

On all 7.x and 6.x versions fixed in 8.0.0, BIG-IQ HA ElasticSearch service does not implement any form of authentication for the clustering transport services, and all data used by ElasticSearch for transport is unencrypted. Note: Software versions which have reached End of Software Development...

Authentication flaw

On all 7.x and 6.x versions fixed in 8.0.0, BIG-IQ HA ElasticSearch service does not implement any form of authentication for the clustering transport services, and all data used by ElasticSearch for transport is unencrypted. Note: Software versions which have reached End of Software Development...

CVE-2021-22997: Missing Authentication for Critical Function

On all 7.x and 6.x versions fixed in 8.0.0, BIG-IQ HA ElasticSearch service does not implement any form of authentication for the clustering transport services, and all data used by ElasticSearch for transport is unencrypted. Note: Software versions which have reached End of Software Development...

ai.h2o:h2o-clustering (>=3.32.1.1, <=3.44.0.2), ai.h2o:h2o-k8s (>=3.30.0.2, <=3.44.0.2) +3 more potentially affected by CVE-2020-13697 via org.nanohttpd:nanohttpd-nanolets (2.3.1)

org.nanohttpd:nanohttpd-nanolets MAVEN version 2.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.nanohttpd:nanohttpd-nanolets and may be impacted: - ai.h2o:h2o-clustering =3.32.1.1, =3.30.0.2, =3.34.0.3, =0.3.0, =2.0, =2.5 Source cves:...

ai.h2o:h2o-clustering (>=3.32.1.1, <=3.44.0.2), ai.h2o:h2o-k8s (>=3.30.0.2, <=3.44.0.2) +3 more potentially affected by CVE-2020-13697 via org.nanohttpd:nanohttpd-nanolets (2.3.1)

org.nanohttpd:nanohttpd-nanolets MAVEN version 2.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.nanohttpd:nanohttpd-nanolets and may be impacted: - ai.h2o:h2o-clustering =3.32.1.1, =3.30.0.2, =3.34.0.3, =0.3.0, =2.0, =2.5 Source cves:...