1892 matches found
zeek -- null-pointer dereference vulnerability
Jon Siwek of Corelight reports: Fix null-pointer dereference when encountering an invalid enum name in a config/input file that tries to read it into a setenum. For those that have such an input feed whose contents may come from external/remote sources, this is a potential DoS vulnerability...
Passwords stored in plain text by jabber
jabber 1.41 and earlier stores passwords unencrypted in its global configuration file hudson.plugins.jabber.im.transport.JabberPublisher.xml on the Jenkins controller as part of its configuration. These passwords can be viewed by users with access to the Jenkins controller file system. jabber 1.4...
CVE-2021-27275
This vulnerability allows remote attackers to disclose sensitive information and delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be...
CallObfuscator - Obfuscate Specific Windows Apis With Different APIs
Obfuscate hide the PE imports from static/dynamic analysis tools. Theory This's pretty forward, let's say I've used VirtualProtect and I want to obfuscate it with Sleep, the tool will manipulate the IAT so that the thunk that points to VirtualProtect will point instead to Sleep, now at executing...
CVE-2021-1443
A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrary code with root privileges on the underlying operating system of an affected device. The vulnerability exists because the affected software improperly sanitizes values that are...
Cisco IOS XE Software 操作系统命令注入漏洞
Cisco IOS XE is a set of modular operating system based on Linux kernel developed by Cisco for its network equipment. A command injection vulnerability exists in the web UI of Cisco IOS XE. The vulnerability stems from the affected software not properly validating values parsed from a specific...
Schneider Electric Interactive Graphical SCADA System 缓冲区错误漏洞
Schneider Electric Interactive Graphical SCADA System IGSS is a SCADA Data Acquisition and Supervisory System system for monitoring and controlling industrial processes from Schneider Electric, France. A buffer overflow vulnerability exists in Interactive Graphical SCADA System IGSS Definition...
Execution of untrusted code through config file
Impact It is possible to run arbitrary commands through the yaml.load method. This could allow an attacker with local access to the host to run arbitrary code by running the application with a specially crafted YAML configuration file. Workarounds Manually adjust yaml.load to yaml.safeload For mo...
GHSA-8278-88VV-X98R Execution of untrusted code through config file
Impact It is possible to run arbitrary commands through the yaml.load method. This could allow an attacker with local access to the host to run arbitrary code by running the application with a specially crafted YAML configuration file. Workarounds Manually adjust yaml.load to yaml.safeload For mo...
Security Bulletin: IBM Cloud Private is vulnerable to Kubernetes vulnerabilities (CVE-2020-8566, CVE-2020-8565, CVE-2020-8563, CVE-2020-8564)
Summary IBM Cloud Private is vulnerable to Kubernetes vulnerabilities Vulnerability Details CVEID: CVE-2020-8566 DESCRIPTION: Kubernetes could allow a local authenticated attacker to obtain sensitive information, caused by a flaw when Ceph RBD volumes are supported and kube-controller-manager is...
CVE-2020-8030
CVE-2020-8030 affects SUSE CaaS Platform 4.5, specifically the scuba/skuba join workflow that uses insecure temporary files in /tmp. The root cause is insecure handling of temporary files, enabling a local attacker to leak the bootstrapToken or modify the configuration file before it is processed...
LanProxy 0.1 Directory Traversal Vulnerability - Active Check
LanProxy is prone to a directory traversal vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
CVE-2020-27542
Rostelecom CS-C2SHW 5.0.082.1 is affected by: Bash command injection. The camera reads configuration from QR code including network settings. The static IP configuration from QR code is copied to the file /config/ip-static and after reboot data from this file is inserted into bash command without...
CVE-2021-21605
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows users with Agent/Configure permission to choose agent names that cause Jenkins to override the global config.xml file...
Cisco AnyConnect Secure Mobility Client for Windows 代码问题漏洞
Cisco AnyConnect Secure Mobility Client for Windows is a Windows-based secure mobility client from Cisco that provides secure access to networks and applications from any device. A security vulnerability exists in the Cisco AnyConnect Secure Mobility Client for Windows that stems from insufficien...
PT-2021-14655 · Jenkins · Jenkins Tracetronic Ecu-Test Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins TraceTronic ECU-TEST Plugin versions 2.23.1 and earlier Description: The issue allows credentials to be stored unencrypted in the global configuration file on the Jenkins controller, making them accessible to users with access to the...
Ethereum Aleth Denial of Service Vulnerability
Ethereum Aleth is a C++-based client application from the Ethereum community that supports the Ethereum protocol. A denial of service vulnerability exists in Aleth Ethereum C++ client version =1.8.0, which originates in the config.json file and may result in a denial of service. No details of the...
Ethereum Aleth 缓冲区错误漏洞
Ethereum Aleth is a C++-based client application from the Ethereum community that supports the Ethereum protocol. A denial of service vulnerability exists in Aleth Ethereum C++ client version =1.8.0, which originates in the config.json file and may result in a denial of service. No details of the...
Multiple Veritas Product Security Vulnerabilities
Veritas Infoscale and others are products of Veritas, Inc.Veritas Infoscale is a highly available virtualized storage software.Veritas Foundation For Windows is a backup, storage management software.Veritas Foundation HA For Veritas Foundation HA For Windows is a backup, storage management...