Remote file inclusion

A local file inclusion vulnerability in the FileServlet in all SearchBlox before 9.2.2 allows remote, unauthenticated users to read arbitrary files from the operating system via a /searchblox/servlet/FileServlet?col=url= request. Additionally, this may be used to read the contents of the SearchBl...

Cisco SD-WAN vManage Authorization Bypass (cisco-sa-vman-authorization-b-GUEpSLK)

The version of Cisco SD-WAN vManage installed on the remote host is affected by a vulnerability as referenced in the cisco-sa-vman-authorization-b-GUEpSLK advisory due to insufficient input validation for certain commands. An authenticated, remote attacker can exploit this, by sending crafted...

Trend Micro Worry-Free Business Security Access Control Error Vulnerability (CNVD-2021-28321)

Trend Micro Worry-Free Business Security is a suite of enterprise-class information security protection solutions from Trend Micro. The product provides anti-spam, anti-virus, network security and e-mail protection. An access control error vulnerability exists in Trend Micro Worry-Free Business...

CVE-2021-25244

CVE-2021-25244 corresponds to an improper access control vulnerability in Trend Micro Worry-Free Business Security 10.0 SP1. The issue allows an unauthenticated attacker to obtain various configuration information via the product’s web console (listed as listening on port 4343 by the ZDI advisory...

CVE-2021-25244

An improper access control vulnerability in Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to obtain various pieces of configuration informaiton...

CVE-2021-1128

A vulnerability in the CLI parser of Cisco IOS XR Software could allow an authenticated, local attacker to view more information than their privileges allow. The vulnerability is due to insufficient application of restrictions during the execution of a specific command. An attacker could exploit...

CVE-2021-1128: Insertion of Sensitive Information Into Sent Data

A vulnerability in the CLI parser of Cisco IOS XR Software could allow an authenticated, local attacker to view more information than their privileges allow. The vulnerability is due to insufficient application of restrictions during the execution of a specific command. An attacker could exploit...

Cisco Web Security Appliance Information Disclosure (cisco-sa-esa-wsa-sma-info-RHp44vAC)

According to its self-reported version, Cisco Web Security Appliance WSA is affected by a vulnerability in the authentication for the general purpose APIs due to the absence of a secure authentication token requirement when authenticating to the general purpose API. An unauthenticated, remote...

Cisco Content Security Management Appliance Information Disclosure (cisco-sa-esa-wsa-sma-info-RHp44vAC)

According to its self-reported version, Cisco Content Security Management Appliance SMA is affected by a vulnerability in the authentication for the general purpose APIs due to the absence of a secure authentication token requirement when authenticating to the general purpose API. An...

CVE-2021-1129

A vulnerability in the authentication for the general purpose APIs implementation of Cisco Email Security Appliance ESA, Cisco Content Security Management Appliance SMA, and Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to access general system information and...

CVE-2021-1129

A vulnerability in the authentication for the general purpose APIs implementation of Cisco Email Security Appliance ESA, Cisco Content Security Management Appliance SMA, and Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to access general system information and...

Cisco Email Security Appliance, Cisco Content Security Management Appliance, and Cisco Web Security Appliance Information Disclosure Vulnerability

A vulnerability in the authentication for the general purpose APIs implementation of Cisco Email Security Appliance ESA, Cisco Content Security Management Appliance SMA, and Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to access general system information and...

Multiple Cisco Products Licensing Issues Vulnerabilities

Cisco Content Security Management Appliance SMA and so on are products of the American Cisco Cisco company.Cisco Content Security Management Appliance is a set of content security management appliance.Cisco Email Security Appliance ESA is an email security appliance.Cisco Web Security Appliance W...

Apache Kylin Information Disclosure Vulnerability

Apache Kylin is an open source distributed analytic data warehouse from the Apache Software Foundation. The product mainly provides Hadoop/Spark on top of the SQL query interface and multi-dimensional analysis OLAP and other functions. Apache Kylin exists an information disclosure vulnerability,...

CVE-2020-13937

Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 4.0.0-alpha has one restful api which exposed Kylin's configuration information without any...

CVE-2020-13937

Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 4.0.0-alpha has one restful api which exposed Kylin's configuration information without any...

CVE-2020-13937: Insecure Storage of Sensitive Information

Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 4.0.0-alpha has one restful api which exposed Kylin's configuration information without any...

Advanced Access Manager < 6.6.2 - Authenticated Information Disclosure

The plugin’s aam/v1/authenticate and aam/v2/authenticate REST endpoints were set to respond to a successful login with a json-encoded copy of all metadata about the user, potentially exposing users’ information to an attacker or low-privileged user. This included items like the user’s hashed...

CVE-2020-3362 Cisco Network Services Orchestrator Information Disclosure Vulnerability

A vulnerability in the CLI of Cisco Network Services Orchestrator NSO could allow an authenticated, local attacker to access confidential information on an affected device. The vulnerability is due to a timing issue in the processing of CLI commands. An attacker could exploit this vulnerability b...

CVE-2020-3362: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability in the CLI of Cisco Network Services Orchestrator NSO could allow an authenticated, local attacker to access confidential information on an affected device. The vulnerability is due to a timing issue in the processing of CLI commands. An attacker could exploit this vulnerability b...