JSA10325 - CERT-CSA Option Vulnerability, Released 3/10/03

If you have configured CSA in "Enabled" mode for one or more groups, then it is possible for an authenticated user in one of those groups to access servers that are not listed in the "Application List". If you have configured CSA in "Enabled, and user can add applications" mode or configured in...

PT-2022-24279 · Esri · Arcgis Server

Name of the Vulnerable Software and Affected Versions: Esri ArcGIS Server versions 10.9.1 and below Description: The issue allows a remote, unauthenticated attacker to traverse the file system and access files outside of the intended directory on ArcGIS Server. This could lead to the disclosure o...

CVE-2022-41248

Jenkins BigPanda Notifier Plugin 1.4.0 and earlier does not mask the BigPanda API key on the global configuration form, increasing the potential for attackers to observe and capture it...

UBUNTU-CVE-2022-31143

GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. It was found that in affected versions there is an exposure of private information defined in setup of...

CVE-2021-40150

The web server of the E1 Zoom camera through 3.0.0.716 discloses its configuration via the /conf/ directory that is mapped to a publicly accessible path. In this way an attacker can download the entire NGINX/FastCGI configurations by querying the /conf/nginx.conf or /conf/fastcgi.conf URI...

CVE-2022-29877

A vulnerability has been identified in SICAM P850 All versions V3.00, SICAM P850 All versions V3.00, SICAM P850 All versions V3.00, SICAM P850 All versions V3.00, SICAM P850 All versions V3.00, SICAM P850 All versions V3.00, SICAM P850 All versions V3.00, SICAM P850 All versions V3.00, SICAM P850...

DRUPAL-CONTRIB-2022-040

The Wingsuit module enables site builders to build UI Patterns and|or Twig Components with Storybook and use them without any mapping code in Drupal. The module doesn't have an access check for the admin form allowing an attacker to view and modify the Wingsuit configuration...

PT-2022-19392 · Jenkins · Jenkins Google Compute Engine Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Google Compute Engine Plugin versions 4.3.8 and earlier Description: The issue allows private keys to be stored unencrypted in cloud agent config.xml files on the Jenkins controller. This can be viewed by users with Agent/Extended Rea...

CVE-2022-20782

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to obtain sensitive information from an affected device. This vulnerability is due to improper enforcement of administrative privilege levels for high-value...

Exposure of server configuration in github.com/go-vela/server

Impact What kind of vulnerability is it? Who is impacted? The ability to expose configuration set in the Vela server via pipeline template functionality. It impacts all users of Vela. Sample of template exposing server configuration using Sprig's env function: yaml metadata: template: true steps:...

CVE-2022-22152

A Protection Mechanism Failure vulnerability in the REST API of Juniper Networks Contrail Service Orchestration allows one tenant on the system to view confidential configuration details of another tenant on the same system. By utilizing the REST API, one tenant is able to obtain information on...

Apache Apisix 访问控制错误漏洞

Apache Apisix is a cloud-native microservices API gateway service from the Apache Foundation in the United States. The software is based on OpenResty and etcd for dynamic routing and plug-in hot-loading, and is suitable for API management in microservice systems. an authorization issue...

PT-2021-13743 · Unknown · Sma 100 Series

Name of the Vulnerable Software and Affected Versions: SMA100 series affected versions not specified Description: The issue is related to an improper access control, allowing multiple restricted management APIs to be accessible without requiring a user login. This could potentially expose...

NETGEAR 安全漏洞

NETGEAR is a router from the American company NETGEAR. A hardware device that connects two or more networks and acts as a gateway between networks. A security vulnerability exists in NETGEAR routers that could be exploited by a network neighbor attacker to disclose sensitive information about...

Information disclosure

Information disclosure: The main configuration, including users and their hashed passwords, is exposed by an unprotected web server resource and can be accessed without authentication. Additionally, device details are exposed which include the serial number and the firmware version by another...

CVE-2021-41385

The third party intelligence connector in Securonix SNYPR 6.3.1 Build 1842950302 allows an authenticated user to obtain access to server configuration details via SSRF...

CVE-2021-34771

A vulnerability in the Cisco IOS XR Software CLI could allow an authenticated, local attacker to view more information than their privileges allow. This vulnerability is due to insufficient application of restrictions during the execution of a specific command. An attacker could exploit this...

Schneider Electric EnerlinÕX ComÕX 安全漏洞

The Schneider Electric EnerlinÕX ComÕX is a compact plug-and-play gateway and data logger from Schneider Electric France that is an essential component of an entry-level energy management system. A security vulnerability exists in the Schneider Electric EnerlinÕX ComÕX 510 that stems from an...

Micro Focus Access Manager Information Disclosure Vulnerability

Micro Focus Access Manager Appliance is an application from Micro Focus UK. It is used to improve security and simplify management. An information disclosure vulnerability exists in Micro Focus Access Manager product, which can be exploited by attackers to expose information and disclose advanced...

CVE-2021-22506

Advance configuration exposing Information Leakage vulnerability in Micro Focus Access Manager product, affects all versions prior to version 5.0. The vulnerability could cause information leakage...