CVE-2022-30232

A CWE-20: Improper Input Validation vulnerability exists that could cause potential remote code execution when an attacker is able to intercept and modify a request on the same network or has configuration access to an ION device on the network. Affected Products: Wiser Smart, EER21000 & EER21001...

Inductive Automation Ignition 路径遍历漏洞

Inductive Automation Ignition is a suite of integrated software platforms for SCADA systems from Inductive Automation, Inc. The platform supports SCADA data acquisition and monitoring systems, HMI human machine interface, and more. A path traversal vulnerability exists in Inductive Automation...

CVE-2021-43483

An Access Control vulnerability exists in CLARO KAON CG3000 1.00.67 in the router configuration, which could allow a malicious user to read or update the configuraiton without authentication...

The vulnerability of the TP-240 interface board’s microprogramming software in MiCollab and MiVoice Business Express systems, related to errors in processing XML messages, allows attackers to read and modify the configuration of the vulnerable device or trigger a service failure.

The vulnerability of the TP-240 interface board’s microprogramming software, used in the MiCollab and MiVoice Business Express collaboration platforms, is related to errors in processing XML messages. Exploiting this vulnerability allows an attacker to read and modify the configuration of the...

Palo Alto Networks PAN-OS 安全漏洞

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks, Inc. for its firewall appliances. A security vulnerability exists in Palo Alto Networks PAN-OS that allows password cracking attacks on accounts in normal non-fips - cc mode of operation. An attacker could exploit t...

CVE-2022-24715

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Authenticated users, with access to the configuration, can create SSH resource files in unintended directories, leading to the execution of arbitrary code. This issue has been resolved in versions 2.8.6...

CVE-2022-24715

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Authenticated users, with access to the configuration, can create SSH resource files in unintended directories, leading to the execution of arbitrary code. This issue has been resolved in versions 2.8.6...

CVE-2022-24715 Arbitrary code execution for authenticated users in Icinga Web 2

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Authenticated users, with access to the configuration, can create SSH resource files in unintended directories, leading to the execution of arbitrary code. This issue has been resolved in versions 2.8.6...

CVE-2022-22509

In Phoenix Contact FL SWITCH Series 2xxx in version 3.00 an incorrect privilege assignment allows an low privileged user to enable full access to the device configuration...

OPENSUSE-SU-2021:4109-1 Security update for logback

This update for logback fixes the following issues: Upgrade to version 1.2.8 + In response to log4Shell/CVE-2021-44228, all JNDI lookup code in logback has been disabled until further notice. This impacts ContextJNDISelector and insertFromJNDI element in configuration files. + Also in response to...

PT-2021-6084

Name of the Vulnerable Software and Affected Versions logback versions 1.2.7 and prior Description The issue is related to the deserialization mechanism in the logback library, which can be exploited by an attacker with the required privileges to edit configuration files. This could allow the...

PT-2021-5597

Name of the Vulnerable Software and Affected Versions Log4j version 1.2 Description The issue is related to the JMSAppender in Log4j 1.2, which is vulnerable to deserialization of untrusted data. An attacker with write access to the Log4j configuration can provide TopicBindingName and...

PT-2021-23924 · Aim · Aim

Name of the Vulnerable Software and Affected Versions: Aim versions prior to 3.1.0 Description: Aim is an open-source, self-hosted machine learning experiment tracking tool. The issue allows for a path traversal attack, which can be exploited by manipulating variables that reference files with...

The vulnerability in the web interface of Cisco Firepower Management Center’s software management interface allows a perpetrator to gain unauthorized access to confidential configuration information.

The vulnerability of the Cisco Firepower Management Center’s software network management interface is related to errors in the encryption of confidential information stored in the graphical interface configuration monitor. Exploiting this vulnerability can allow an attacker to gain unauthorized...

Improper handling of equivalent directory names on Windows

Jenkins stores jobs and other entities on disk using their name shown on the UI as file and folder names. On Windows, when specifying a file or folder with a trailing dot character example., the file or folder will be treated as if that character was not present example. As both are legal names f...

D-link Dcs-932L和D-link Dcs-5000L 安全漏洞

D-link Dcs-5000L is an Ip network surveillance camera. d-link Dcs-932L is a network surveillance camera. d-link DCS-5000L and DCS-932L elevation of privilege vulnerability, an attack to can be exploited to compromise the camera configuration and allow a malicious user on the LAN to access the...

D-link Dcs-932L和D-link Dcs-5000L 授权问题漏洞

D-link Dcs-5000L is an Ip network surveillance camera. d-link Dcs-932L is a network surveillance camera. a security vulnerability exists in the D-Link DCS-5000L and DCS-932L, which stems from the lack of an effective trust management mechanism in the network system or product. An attacker could...

Vulnerabilities fixed in Cisco products

Vulnerabilities have been fixed in Cisco products. The vulnerabilities allow a malicious party to carry out attacks execute attacks that result in the following categories of damage: Denial-of-Service DoS. Bypassing authentication Bypassing security measure The vulnerability with attribute...

CVE-2020-4885

IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server 11.5 could allow a local user to access and change the configuration of Db2 due to a race condition of a symbolic link,. IBM X-Force ID: 190909...

CVE-2021-3528

A flaw was found in noobaa-operator in versions before 5.7.0, where internal RPC AuthTokens between the noobaa operator and the noobaa core are leaked into log files. An attacker with access to the log files could use this AuthToken to gain additional access into noobaa deployment and can...