Design/Logic Flaw

A vulnerability in the system resource management of Cisco Elastic Services Controller ESC could allow an unauthenticated, remote attacker to cause a denial of service DoS to the health monitor API on an affected device. The vulnerability is due to inadequate provisioning of kernel parameters for...

CVE-2021-1312

Cisco Elastic Services Controller (ESC) is affected by CVE-2021-1312, a DoS in the system resource management that can be triggered by a flood of crafted TCP packets to block TCP listen ports used by the health monitor API. The root cause is inadequate provisioning of kernel parameters for the ma...

CVE-2021-1312 Cisco Elastic Services Controller Denial of Service Vulnerability

A vulnerability in the system resource management of Cisco Elastic Services Controller ESC could allow an unauthenticated, remote attacker to cause a denial of service DoS to the health monitor API on an affected device. The vulnerability is due to inadequate provisioning of kernel parameters for...

Cisco Elastic Services Controller Denial of Service Vulnerability

A vulnerability in the system resource management of Cisco Elastic Services Controller ESC could allow an unauthenticated, remote attacker to cause a denial of service DoS to the health monitor API on an affected device. The vulnerability is due to inadequate provisioning of kernel parameters for...

CVE-2021-1312: Uncontrolled Resource Consumption

A vulnerability in the system resource management of Cisco Elastic Services Controller ESC could allow an unauthenticated, remote attacker to cause a denial of service DoS to the health monitor API on an affected device. The vulnerability is due to inadequate provisioning of kernel parameters for...

PT-2020-21871

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type identified as Global-buffer-overflow READ 1. The crash state involves functions such as vte write debug, send primary...

Kubernetes: Half-Blind SSRF found in kube/cloud-controller-manager can be upgraded to complete SSRF (fully crafted HTTP requests) in vendor managed k8s service.

Hello, Who we are : We’re two French security researchers and our respective names are Brice Augras and Christophe Hauquiert, we worked and found the vulnerability together. Brice Augras from https://www.groupe-asten.fr/ company - https://hackerone.com/reeverzax Christophe Hauquiert -...

Authentication flaw

A vulnerability in the REST API of Cisco Elastic Services Controller ESC could allow an unauthenticated, remote attacker to bypass authentication on the REST API. The vulnerability is due to improper validation of API requests. An attacker could exploit this vulnerability by sending a crafted...

CVE-2019-1867

CVE-2019-1867 affects Cisco Elastic Services Controller (ESC) REST API authentication; an unauthenticated, remote attacker could bypass REST API authentication due to improper validation of API requests, potentially executing arbitrary actions with administrative privileges. Exploitable on ESC re...

CVE-2019-1867 Cisco Elastic Services Controller REST API Authentication Bypass Vulnerability

A vulnerability in the REST API of Cisco Elastic Services Controller ESC could allow an unauthenticated, remote attacker to bypass authentication on the REST API. The vulnerability is due to improper validation of API requests. An attacker could exploit this vulnerability by sending a crafted...

CVE-2018-17491

EasyLobby Solo could allow a local attacker to gain elevated privileges on the system. By visiting the kiosk and typing "esc" to exit the program, an attacker could exploit this vulnerability to perform unauthorized actions on the computer...

WordPress: Stored XSS in Post Preview as Contributor

Root cause I noticed that the getthecontent makes a pregreplacecallback after all other validation and sanitization has been performed. function getthecontent $morelinktext = null, $stripteaser = false global $page, $more, $preview, $pages, $multipage; $post = getpost; ... if $preview // Preview...

UBUNTU-CVE-2018-19888

An invalid memory address dereference was discovered in the huffcode function libfaac/huff2.c in Freeware Advanced Audio Coder FAAC 1.29.9.2. The vulnerability causes a segmentation fault and application crash, which leads to denial of service in the HCBESC case...

PT-2018-15140

Name of the Vulnerable Software and Affected Versions FAAC version 1.29.9.2 Description A memory address dereference issue was found in the huffcode function, located in libfaac/huff2.c, which can cause a segmentation fault and application crash. This leads to a denial of service, specifically in...

CVE-2018-0106

CVE-2018-0106 affects the Cisco Elastic Services Controller (ESC) and its embedded ConfD server . The vulnerability is due to insufficient security restrictions in the ConfD directory/file structure, enabling an unauthenticated, local attacker to view sensitive information on the targeted system....

CVE-2018-0106

A vulnerability in the ConfD server of the Cisco Elastic Services Controller ESC could allow an unauthenticated, local attacker to access sensitive information on a targeted system. The vulnerability is due to insufficient security restrictions. An attacker could exploit this vulnerability by...

CVE-2018-0106: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability in the ConfD server of the Cisco Elastic Services Controller ESC could allow an unauthenticated, local attacker to access sensitive information on a targeted system. The vulnerability is due to insufficient security restrictions. An attacker could exploit this vulnerability by...

CVE-2017-6778

A vulnerability in the Elastic Services Controller ESC web interface of the Cisco Ultra Services Platform could allow an authenticated, remote attacker to acquire sensitive information. The vulnerability is due to the transmission of sensitive information as part of a GET request. An attacker cou...

CVE-2017-6778

Cisco Ultra Services Platform's Elastic Services Controller Web Interface (ESC) is affected. An authenticated, remote attacker can disclose sensitive deployment information via a GET request. Affected release: 21.0.v0.65839. Root cause: transmitting sensitive information as part of a GET request....

CVE-2017-6776: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web framework of Cisco Elastic Services Controller ESC could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface. The vulnerability is due to insufficient validation of user-supplied input by the affecte...