GHSA-FH5V-5F35-2RV2 Insertion of Sensitive Information into Log File in ansible

A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucketpipelinevariable module. This flaw allows an attacker to steal bitbucketpipeline credentials. The highest threat from this vulnerabili...

CVE-2021-20180

A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucketpipelinevariable module. This flaw allows an attacker to steal bitbucketpipeline credentials. The highest threat from this vulnerabili...

DEBIAN-CVE-2021-20180

A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucketpipelinevariable module. This flaw allows an attacker to steal bitbucketpipeline credentials. The highest threat from this vulnerabili...

UBUNTU-CVE-2021-20180

A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucketpipelinevariable module. This flaw allows an attacker to steal bitbucketpipeline credentials. The highest threat from this vulnerabili...

CVE-2021-20180

A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucketpipelinevariable module. This flaw allows an attacker to steal bitbucketpipeline credentials. The highest threat from this vulnerabili...

IBM Spectrum Protect Plus和IBM Spectrum Copy Data Management拒绝服务漏洞

IBM Spectrum Protect Plus and IBM Spectrum Copy Data Management are both products of IBM Corporation, U.S.A. IBM Spectrum Protect Plus is a data protection platform. The platform provides enterprises with a single point of control and management and supports backup and recovery for virtual,...

Security Bulletin: Vulnerability in IBM Dojo affects IBM Spectrum Protect for Workstations Central Administration Console (CVE-2021-23450)

Summary IBM Spectrum Protect for Workstations Central Administration Console may be affected by a vulnerability in IBM Dojo CVE-2021-23450 which could allow a remote attacker to execute arbitrary code on the system. Vulnerability Details CVEID: CVE-2021-23450 DESCRIPTION: Dojo could allow a remot...

CVE-2022-22354

IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.2 and IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 do not limit the length of a connection which could allow for a Slowloris HTTP denial of service attack to take place. This can cause the Admin Console to become unresponsive. IBM...

Design/Logic Flaw

IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.2 and IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 do not limit the length of a connection which could allow for a Slowloris HTTP denial of service attack to take place. This can cause the Admin Console to become unresponsive. IBM...

CVE-2022-22354

IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.2 and IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 do not limit the length of a connection which could allow for a Slowloris HTTP denial of service attack to take place. This can cause the Admin Console to become unresponsive. IBM...

CVE-2022-22354

CVE-2022-22354 affects IBM Spectrum Protect Plus (10.1.0.0–10.1.9.2) and IBM Spectrum Copy Data Management (2.2.0.0–2.2.14.3). The issue is that connections are not length-limited, enabling a Slowloris HTTP denial-of-service attack that can render the Admin Console unresponsive. Affected products...

Cross-site Scripting (XSS)

nacos-console is vulnerable to cross-site scripting. The vulnerability exists because the library does not set the xssFilter option in the ConsoleConfig.java, allowing an attacker to inject and execute malicious javascript through the pageSize and pageNo parameters...

CVE-2022-22354

IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.2 and IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 do not limit the length of a connection which could allow for a Slowloris HTTP denial of service attack to take place. This can cause the Admin Console to become unresponsive. IBM...

IBM Spectrum Protect Plus和IBM Spectrum Copy Data Management 安全漏洞

IBM Spectrum Protect Plus and IBM Spectrum Copy Data Management are both products of IBM Corporation, U.S.A. IBM Spectrum Protect Plus is a data protection platform. The platform provides enterprises with a single point of control and management and supports backup and recovery for virtual,...

The vulnerability of the Fortinet FortiAP-C console’s microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the Fortinet FortiAP-C console software involves the lack of measures taken to neutralize special elements used in the operating system’s command line interface. Exploiting this vulnerability allows an attacker to execute arbitrary commands through the CLI command line...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.10.3 security update

Red Hat OpenShift Container Platform release 4.10.3 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which...

UNIVERGE WA Series vulnerable to OS command injection

Overview UNIVERGE WA Series provided by NEC Platforms, Ltd. contains an OS command injection vulnerability. Remote system maintenance feature of UNIVERGE WA series "Local maintenance console/Remote maintenance console/Web based remote console maintenance" contains an OS command injection...

CVE-2022-26355 Citrix Federated Authentication Service (FAS)

Citrix Federated Authentication Service FAS 7.17 - 10.6 causes deployments that have been configured to store a registration authority certificate's private key in a Trusted Platform Module TPM to incorrectly store that key in the Microsoft Software Key Storage Provider MSKSP. This issue only...

Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter which could be "__proto__". The prototype pollution has very limited control in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js >= 12.22.9 >= 14.18.3 >= 16.13.2 and >= 17.3.1 use a null protoype for the object these properties are being assigned to.

...

Important: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.3.6 security updates and bug fixes

Red Hat Advanced Cluster Management for Kubernetes 2.3.6 General Availability release images, which provide security updates and bug fixes. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a...