CVE-2020-17383

The CVE-2020-17383 entry documents a directory traversal vulnerability in Telos Z/IP One devices (versions before 4.0.0r). The underlying issue is lack of filtering/escaping of directory parameters and special characters, enabling an unauthenticated attacker to obtain root access to the device fi...

Cross-Site Request Forgery (CSRF) in livehelperchat/livehelperchat

Description A CSRF issue is found in the SettingsLive help configurationFile Configuration. It was found that no CSRF token validation is getting done as no CSRF token is getting passed with the request. Proof of Concept Actual Request POST /siteadmin/file/configuration HTTP/1.1 Host:...

CVE-2021-39971

Password vault has a External Control of System or Configuration Setting vulnerability.Successful exploitation of this vulnerability could compromise confidentiality...

CVE-2021-43333

The Datalogic DXU service on for example DL-Axist devices does not require authentication for configuration changes or disclosure of configuration settings...

[SECURITY] Fedora 34 Update: redis-6.2.6-1.fc34

Redis is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing se...

Denial Of Service (DoS)

xen is vulnerable to denial of service. The unofficial MATLAB extension for Visual Studio Code allows attackers to execute arbitrary code via a crafted workspace because of lint configuration settings...

Code injection

A vulnerability has been identified in SINEMA Remote Connect Client All versions V3.0 SP1. Affected devices allow to modify configuration settings over an unauthenticated channel. This could allow a local attacker to escalate privileges and execute own code on the device...

CVS Health Records for 1.1 Billion Customers Exposed

More than 1 billion records for CVS Health customers were left in the database of a third-party, unnamed vendor – exposed, unprotected, online. Researchers said the data points revealed could be strung together to create an extremely personal snapshot of someones’s medical situation. The glitch i...

EulerOS 2.0 SP3 : squid (EulerOS-SA-2021-1852)

According to the versions of the squid packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in Squid 2.x, 3.x, and 4.x through 4.8. Due to incorrect data management, it is vulnerable to information disclosure when...

Debian DSA-4899-1 : openjdk-11 - security update

It was discovered that the OpenJDK Java platform incompletely enforced configuration settings used in Jar signing verifications. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-4899. The...

Debian: Security Advisory (DSA-4899-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Vmware Carbon Black Cloud Authentication Bypass Vulnerability

Vmware Carbon Black Cloud is a Sass platform from Vmware USA that provides security checking and defense capabilities for cloud endpoints. VMware Carbon Black Cloud Workload 1.0.1 and prior versions have an authentication bypass vulnerability that could allow a user with network access to the...

CVE-2021-21982

VMware Carbon Black Cloud Workload appliance 1.0.0 and 1.01 has an authentication bypass vulnerability that may allow a malicious actor with network access to the administrative interface of the VMware Carbon Black Cloud Workload appliance to obtain a valid authentication token. Successful...

Squid 2.x < 4.14 / 5.x < 5.0.5 (SQUID-2020:11)

According to its banner, the version of Squid running on the remote host is 2.x prior to 4.14 or 5.x prior to 5.0.5. It is, therefore, affected by an HTTP request smuggling vulnerability due to improper input validation. This occurs for certain uriwhitespace in configuration settings. This proble...

CVE-2021-28967

The unofficial MATLAB extension before 2.0.1 for Visual Studio Code allows attackers to execute arbitrary code via a crafted workspace because of lint configuration settings...

Fedora 33 : nagios (2021-5689072a7e)

The remote Fedora 33 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-5689072a7e advisory. - Nagios 4.4.5 allows an attacker, who already has administrative access to change the URL for JSON CGIs configuration setting, to modify the Alert Histogram...

Privilege escalation

Snow Inventory Agent through 6.7.0 on Windows uses CPUID to report on processor types and versions that may be deployed and in use across an IT environment. A privilege-escalation vulnerability exists if CPUID is enabled, and thus it should be disabled via configuration settings...

CVE-2021-27579

Snow Inventory Agent through 6.7.0 on Windows uses CPUID to report on processor types and versions that may be deployed and in use across an IT environment. A privilege-escalation vulnerability exists if CPUID is enabled, and thus it should be disabled via configuration settings...

Code injection

A misconfiguration in Web-Sesame 2020.1.1.3375 allows an unauthenticated attacker to download the source code of the application, facilitating its comprehension code review. Specifically, JavaScript source maps were inadvertently included in the production Webpack configuration. These maps contai...

Privilege escalation

Improper privilege assignment vulnerability in the installer McAfee Application and Change Control MACC prior to 8.3.2 allows local administrators to change or update the configuration settings via a carefully constructed MSI configured to mimic the genuine installer. This version adds further...