VMware Response to Apache Log4j Remote Code Execution Vulnerabilities (CVE-2021-44228, CVE-2021-45046)

1. Impacted Products VMware Horizon VMware vCenter Server VMware HCX VMware NSX-T Data Center VMware Unified Access Gateway VMware WorkspaceOne Access VMware Identity Manager VMware vRealize Operations VMware vRealize Operations Cloud Cloud Proxy VMware vRealize Automation VMware vRealize...

VMware Response to Apache Log4j Remote Code Execution Vulnerabilities (CVE-2021-44228, CVE-2021-45046)

1. Impacted Products Under Evaluation VMware Horizon VMware vCenter Server VMware HCX VMware NSX-T Data Center VMware Unified Access Gateway VMware WorkspaceOne Access VMware Identity Manager VMware vRealize Operations VMware vRealize Operations Cloud Proxy VMware vRealize Automation VMware...

CVE-2021-41311

Affected versions of Atlassian Jira Server and Data Center allow attackers with access to an administrator account that has had its access revoked to modify projects' Users & Roles settings, via a Broken Authentication vulnerability in the /plugins/servlet/project-config/PROJECT/roles endpoint. T...

Authentication flaw

Affected versions of Atlassian Jira Server and Data Center allow a user who has had their Jira Service Management access revoked to export audit logs of another user's Jira Service Management project via a Broken Authentication vulnerability in the /plugins/servlet/audit/resource endpoint. The...

Authentication flaw

Affected versions of Atlassian Jira Server and Data Center allow attackers with access to an administrator account that has had its access revoked to modify projects' Users & Roles settings, via a Broken Authentication vulnerability in the /plugins/servlet/project-config/PROJECT/roles endpoint. T...

CVE-2021-41309

Affected versions of Atlassian Jira Server and Data Center allow a user who has had their Jira Service Management access revoked to export audit logs of another user's Jira Service Management project via a Broken Authentication vulnerability in the /plugins/servlet/audit/resource endpoint. The...

CVE-2021-41309

The CVE-2021-41309 issue affects Atlassian Jira Server and Data Center (pre-8.19.1) and is due to a Broken Authentication flaw in the /plugins/servlet/audit/resource endpoint. A user whose Jira Service Management access has been revoked can export audit logs from another user’s project. Reported ...

PT-2021-23263 · Atlassian · Jira

Name of the Vulnerable Software and Affected Versions: Atlassian Jira Server and Data Center versions prior to 8.19.1 Description: The issue allows a user who has had their Jira Service Management access revoked to export audit logs of another user's Jira Service Management project via a Broken...

PT-2021-23266 · Atlassian · Jira

Name of the Vulnerable Software and Affected Versions: Atlassian Jira Server and Data Center versions prior to 8.19.1 Description: The issue allows attackers with access to an administrator account that has had its access revoked to modify projects' Users & Roles settings. This is achieved throug...

Huawei CloudEngine 安全漏洞

Huawei CloudEngine is a data center switch from Huawei, a Chinese company. Huawei products are vulnerable to a memory leak that could be exploited by an attacker to cause a memory exhaustion...

Atlassian Jira授权问题漏洞

Atlassian Jira is a defect tracking management system from Atlassian Australia. The system is mainly used to track and manage various types of issues and defects in the workplace. An authorization issue vulnerability exists in Atlassian Jira Server and Data Center, which stems from the product's...

Unauthorized user can add administrator groups to filter subscriptions - CVE-2021-43946

Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers to add administrator groups to filter subscriptions via a Broken Access Control vulnerability in the /secure/EditSubscription.jspa endpoint. The affected versions are before version 8.13.21, and from...

Template Injection in Email Templates leads to code execution on Jira Service Management Server - CVE-2021-43944

This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Affected versions of Atlassian Jira Server and Data Center allow remote attackers with administrator permissions to execute arbitrary code via Template Injecti...

Stored XSS on /rest/jpo/1.0/hierarchyConfiguration via issueTypes parameter - CVE-2021-43945

Affected versions of Atlassian Jira Server and Data Center allow remote attackers with Roadmaps Administrator permissions to inject arbitrary HTML or JavaScript via a Stored Cross-Site Scripting SXSS vulnerability in the /rest/jpo/1.0/hierarchyConfiguration endpoint. The affected versions are...

jira-importers-plugin has misconfigured XSRF protection - CVE-2021-43941

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify several resources including CsvFieldMappingsPage.jspa and ImporterValueMappingsPage.jspa via a Cross-Site Request Forgery CSRF vulnerability in the jira-importers-plugin. The affected versions are before...

Denial of service via an OutOfMemoryError (Tomcat CVE-2021-42340)

Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to impact the application's availability via CVE-2021-42340, a Denial of Service DoS vulnerability in Apache Tomcat. The affected versions of Atlassian Jira Server and Data Center are before version 8.21.0...

Multiple Huawei products weak security algorithm vulnerabilities

Huawei USG9500 is a data center firewall product, Huawei IPS Module is an Intrusion Prevention System IPS module, and NGFW Module is a Next Generation Firewall NGFW module. A security vulnerability exists in several Huawei products due to the use of weak security encryption algorithms when...

Adopting a Zero Trust approach throughout the lifecycle of data

Instead of believing everything behind the corporate firewall is safe, the Zero Trust model assumes breach and verifies each request as though it originates from an uncontrolled network. Regardless of where the request originates or what resource it accesses, Zero Trust teaches us to “never trust...

Huawei CloudEngine Resource Management Error Vulnerability

Huawei CloudEngine is a data center switch from Huawei China. Huawei CloudEngine is vulnerable to a resource management error, which can be exploited by attackers to cause a service exception by sending a specific tampered message...

(Vulnerability) The vulnerability of the Atlassian Confluence Server web server and the Confluence Data Center, related to incorrect processing of Object Graph Navigation Language (OGNL) expressions, allows attackers to execute arbitrary code.

The vulnerability of the Atlassian Confluence Server web server and the Confluence Data Center are related to incorrect processing of expressions in the Object Graph Navigation Language OGNL. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...