CVE-2024-42453: Missing Authorization

A vulnerability Veeam Backup & Replication allows low-privileged users to control and modify configurations on connected virtual infrastructure hosts. This includes the ability to power off virtual machines, delete files in storage, and make configuration changes, potentially leading to Denial of...

Cisco Application Policy Infrastructure Permissions, Privileges, and Access Controls (CVE-2015-4235)

Cisco Application Policy Infrastructure Controller APIC devices with software before 1.03o and 1.1 before 1.11j and Nexus 9000 ACI devices with software before 11.04o and 11.1 before 11.11j do not properly restrict access to the APIC filesystem, which allows remote authenticated users to obtain...

Cisco EPNM XSS

The vulnerability of the Web interface for managing Cisco Evolved Programmable Network Manager EPNM and Cisco Prime Infrastructure, a system for monitoring and managing network equipment, is related to the lack of protective measures for the web page structure. Exploiting this vulnerability allow...

Cisco Warns of Exploitation of Decade-Old ASA WebVPN Vulnerability

Cisco on Monday updated an advisory to warn customers of active exploitation of a decade-old security flaw impacting its Adaptive Security Appliance ASA. The vulnerability, tracked as CVE-2014-2120 CVSS score: 4.3, concerns a case of insufficient input validation in ASA's WebVPN login page that...

CISA and Partners Release Joint Guidance on PRC-Affiliated Threat Actor Compromising Networks of Global Telecommunications Providers

Today, CISA—in partnership with the National Security Agency NSA, the Federal Bureau of Investigation FBI, and international partners—released joint guidance, Enhanced Visibility and Hardening Guidance for Communications Infrastructure. Partners of this guidance include: Australian Signals...

ROS-20241203-22

The vulnerability in the Puppet Agent launcher app is due to the fact that the app silently ignores the settings of the Augeas before the first synchronization of the plugin. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service A vulnerability in...

ROS-20241203-23

The vulnerability in the Puppet Agent launcher app is due to the fact that the app silently ignores the settings of the Augeas before the first synchronization of the plugin. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service A vulnerability in...

PT-2024-37418

Name of the Vulnerable Software and Affected Versions: LXD versions 4.0 through 5.21.1 Description: A security issue was discovered in LXD's PKI mode, where a client's certificate could be used to bypass authentication if the certificate is present in the trust store, even if it is not signed by ...

PT-2024-37461

Name of the Vulnerable Software and Affected Versions: LXD versions prior to 5.21.1 Description: A restricted certificate could be added to the trust store with its restrictions not honoured in LXD's PKI mode. This occurs when the core.trust ca certificates configuration option is disabled, causi...

Hyper-converged Infrastructure Microsoft Azure Stack Privilege Escalation

The vulnerability of the Hyper-converged Infrastructure of Microsoft Azure Stack HCI is related to the use of strictly encrypted credentials. Exploiting this vulnerability can allow attackers to enhance their privileges...

Virtuozzo Hybrid Infrastructure 6.0 Update 1 Hotfix 11 (6.0.1-112)

This update provides security fixes. Vulnerability id: VSTOR-95697, VSTOR-95700 Security fixes for Backup Gateway...

Virtuozzo Hybrid Infrastructure 6.1 Update 1 Hotfix 9 (6.1.1-64)

This update provides security fixes. Vulnerability id: VSTOR-95697, VSTOR-95700 Security fixes for Backup Gateway...

Virtuozzo Hybrid Infrastructure 6.2 Update 1 Hotfix 4 (6.2.1-71)

This update provides security fixes. Vulnerability id: VSTOR-95697, VSTOR-95700 Security fixes for Backup Gateway...

Virtuozzo Hybrid Infrastructure 6.3 Hotfix 2 (6.3.0-180)

This update provides security fixes. Vulnerability id: VSTOR-95697, VSTOR-95700 Security fixes for Backup Gateway...

How Is API Abuse Different from Web Application Attacks by Bots?

API abuse and web application bot attacks are often confused. This is understandable, as both involve automated interactions and are usually executed by bots. Both attack vectors are prevalent; criminals are always eager to disrupt the foundations on which businesses base their operations to...

CVE-2024-53267 Vulnerability with bundle verification in sigstore-java

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. sigstore-java has insufficient verification for a situation where a validly-signed but "mismatched" bundle is presented as proof of inclusion into a transparency log. This bug impacts clients using any variation...

SINEC INS SFTP Code Execution

The vulnerability of the SFTP module in the SINEC INS software for managing network infrastructure is related to errors in file upload path cleaning. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2024-11666

Affected devices beacon to eCharge cloud infrastructure asking if there are any command they should run. This communication is established over an insecure channel since peer verification is disabled everywhere. Therefore, remote unauthenticated users suitably positioned on the network between an...

CVE-2024-11666

Affected devices beacon to eCharge cloud infrastructure asking if there are any command they should run. This communication is established over an insecure channel since peer verification is disabled everywhere. Therefore, remote unauthenticated users suitably positioned on the network between an...

CVE-2024-11666 Unauthenticated Remote Command Injection in eCharge Salia PLCC

Affected devices beacon to eCharge cloud infrastructure asking if there are any command they should run. This communication is established over an insecure channel since peer verification is disabled everywhere. Therefore, remote unauthenticated users suitably positioned on the network between an...