Arista Networks EOS Improper Privilege Management (SA0082)

On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundancy protocol configured with RPR or SSO, an existing unprivileged user can login to the standby supervisor as a root user, leading to a privilege escalation. Valid user credentia...

Security Bulletin: Sterling Control Center v6.2.1 is vulnerable due to Apache ActiveMQ issue

Summary Sterling Control Center v6.2.1 is dependent on Apache ActiveMQ, which is vulnerable to CVE-2022-41678. Vulnerability Details CVEID:CVE-2022-41678 DESCRIPTION: Apache ActiveMQ could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe...

Security Bulletin: IBM Sterling Control Center v6.2.1 and v6.3.1 is vulnerable and reported in [All] Spring Framework.

Summary Security Bulletin: Sterling Control Center v6.2.1 and v6.3.1 is vulnerable in All Spring Framework for CVE-2024-22233 Publicly disclosed vulnerability. Vulnerability Details CVEID:CVE-2024-22233 DESCRIPTION: VMware Tanzu Spring Framework is vulnerable to a denial of service, caused by a...

Malicious code in @diotoborg/tenetur-eos-commodi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a12c017facfbfbf6b47a6546a3f8ef07f719e7d86d9db1487c8252879095215b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8659 Malicious code in @diotoborg/tenetur-eos-commodi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a12c017facfbfbf6b47a6546a3f8ef07f719e7d86d9db1487c8252879095215b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @diotoborg/eos-eum (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7ce102c4972b37b303b2e013794f1674ce9a529b5456a5fed48cc62fd501769f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8287 Malicious code in @diotoborg/eos-eum (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7ce102c4972b37b303b2e013794f1674ce9a529b5456a5fed48cc62fd501769f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @diotoborg/quos-eos (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 62034fc9439a43440c50451e1cb6b0ad5411faec5344feaf219cb86c2bdffb03 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8584 Malicious code in @diotoborg/quos-eos (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 62034fc9439a43440c50451e1cb6b0ad5411faec5344feaf219cb86c2bdffb03 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @diotoborg/laboriosam-eos (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7cbbb48c7b88fa6421d317a4da7f2e3536d4c6cc99235b81a7a8a592b7504b60 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @diotoborg/eos-quidem (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d8b6a117394500d8146d0a6c68963806c04530173bd296b0eb1056f796dae225 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8288 Malicious code in @diotoborg/eos-quidem (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d8b6a117394500d8146d0a6c68963806c04530173bd296b0eb1056f796dae225 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @diotoborg/at-eos (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8c39735caa2d27399c1cdd3e469549b98a191de327828414c58394d48a9b2558 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8152 Malicious code in @diotoborg/at-eos (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8c39735caa2d27399c1cdd3e469549b98a191de327828414c58394d48a9b2558 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @diotoborg/ipsam-atque-eos (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 41de99886b295fc13e1852618b305095f1eb5dc2a9e2dadc986ee98cfa80a062 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Advisory 0103

Security Advisory 0103 . CSAF PDF Date: July 23, 2024 Revision | Date | Changes ---|---|--- 1.0 | July 23, 2024 | Initial release The CVE-ID tracking this issue: CVE-2024-6858 CVSSv3.1 Base Score: 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Common Weakness Enumeration: CWE-287 Improper...

Security Advisory 0102

Security Advisory 0102 . CSAF PDF Date: August 9, 2024 Revision | Date | Changes ---|---|--- 1.0 | July 23, 2024 | Initial release 1.1 | August 9, 2024 | Clarification of affected systems The CVE-ID tracking this issue: CVE-2024-27891 CVSSv3.1 Base Score: 5.3...

Understanding the Hidden Cyber Risk from Tech Debt (EoL/EoS)

End-of-life EoL and end-of-support EoS hardware, software, and operating systems exist in every single technology environment, and they are an exponential multiplier of cyber risk. By definition, vulnerabilities with EoL/EoS technology are unpatchable. In some cases, IT teams can pay for extended...

Security Advisory 0101

Security Advisory 0101 PDF Date: July 9, 2024 Revision | Date | Changes ---|---|--- 1.0 | July 9, 2024 | Initial release 1.1 | Dec 23, 2024 | Update Vulnerability Assessment for EAP and accounting, Update fixed EOS release The CVE-ID tracking this issue: CVE-2024-3596 CVSSv3.1 Base Score: 9.0...

Malicious code in @zitterorg/saepe-eos (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b10349f2016d9a45288cebba6a70030779a7aca3990d8a1ebdd1f006d46c8500 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...