Cisco 809 Industrial ISRs, 829 Industrial ISRs, and Cisco 1000 Series Connected Grid Routers IOS Software Command Injection Vulnerability

Cisco IOS is the United States Cisco Cisco company's set of operating system developed for its network equipment. A command injection vulnerability exists in IOS Software in Cisco 809 Industrial ISRs, 829 Industrial ISRs, and Cisco 1000 Series Connected Grid Routers CGR1000, which stems from the...

NetworkManager Access Control Error Vulnerability

NetworkManager is a network management daemon. A security vulnerability exists in NetworkManager that stems from the fact that nmcli command line interface does not enforce the 802-1x.ca-path and 802-1x.phase2-ca-path settings. No details of the vulnerability are available at this time...

Lexiglot Information Disclosure Vulnerability (CNVD-2020-36284)

Lexiglot is a translation platform written in PHP by the French software developer Damien Sorel. An information disclosure vulnerability exists in Lexiglot 2014-11-20 and earlier versions, which stems from the presence of usernames and passwords on the command line and can be exploited by a local...

CVE-2014-8938

Lexiglot through 2014-11-20 allows local users to obtain sensitive information by listing a process because the username and password are on the command line...

Default credentials

Lexiglot through 2014-11-20 allows local users to obtain sensitive information by listing a process because the username and password are on the command line...

[SECURITY] Fedora 31 Update: marked-1.1.0-3.fc31

Install this for command line tool and man page. marked is a full-featured markdown compiler that can parse huge chunks of markdown without having to worry about caching the compiled output or blocking for an unnecessarily long time. marked is extremely fast and frequently outperforms similar...

[SECURITY] Fedora 32 Update: marked-1.1.0-3.fc32

Install this for command line tool and man page. marked is a full-featured markdown compiler that can parse huge chunks of markdown without having to worry about caching the compiled output or blocking for an unnecessarily long time. marked is extremely fast and frequently outperforms similar...

netty: HTTP request smuggling

A HTTP smuggling flaw was found in HttpObjectDecoder.java in Netty in versions prior to version 4.1.44. HTTP headers with an invalid fold, in this case CRLF carriage return, line feed without being followed by SP space or HTAB horizontal tab, result in situations where headers can be misread. Dat...

haproxy: HTTP/2 implementation vulnerable to intermediary encapsulation attacks

The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return CR, ASCII 0xd, line feed LF, ASCII 0xa, and the zero character NUL, ASCII 0x0, aka Intermediary Encapsulation Attacks...

PT-2020-6928

Name of the Vulnerable Software and Affected Versions httplib2 versions prior to 0.18.0 Description The issue is related to the httplib2 library's failure to neutralize CRLF sequences, allowing a remote attacker to impact data integrity. In httplib2 before version 0.18.0, an attacker controlling ...

Fedora: Security Advisory for sleuthkit (FEDORA-2020-6e3e0c6386)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2020-12651

SecureCRT before 8.7.2 allows remote attackers to execute arbitrary code via an Integer Overflow and a Buffer Overflow because a banner can trigger a line number to CSI functions that exceeds INTMAX...

Design/Logic Flaw

A flaw was found in OpenShift Container Platform where OAuth tokens are not encrypted when the encryption of data at rest is enabled. This flaw allows an attacker with access to a backup to obtain OAuth tokens and then use them to log into the cluster as any user who logged into the cluster via t...

CVE-2020-10706

A flaw was found in OpenShift Container Platform where OAuth tokens are not encrypted when the encryption of data at rest is enabled. This flaw allows an attacker with access to a backup to obtain OAuth tokens and then use them to log into the cluster as any user who logged into the cluster via t...

How to configure antivirus configuration XML file for secure restore

Challenge The article provides information on adding additional antivirus options to Veeam Backup & Replication Secure Restore. NOTE : When adding an antivirus that is not already predefined, you may need to contact the antivirus vendor for assistance to gather the required attributes and exit...

PayloadsAllTheThings

This repository is an offensive tool for Web Application Security and Pentest/CTF. It contains a list of useful payloads and bypass for various web application security testing and penetration testing purposes. The primary vulnerability class targeted by this repository is CRLF Carriage Return an...

Debian DLA-2202-1 : ansible security update

Several vulnerabilities were discovered in Ansible, a configuration management, deployment, and task execution system. CVE-2019-14846 Ansible was logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. This flaw...

The vulnerability of the Apache SpamAssassin spam filtering software lies in the lack of measures to neutralize special elements. This allows attackers to gain unauthorized access to confidential data, cause service failures, and compromise data integrity.

The vulnerability of the Apache SpamAssassin spam filtering software lies in the lack of measures to neutralize special elements used in the operating system command line. Exploiting this vulnerability can allow a hacker to gain unauthorized access to confidential data, cause service failures, an...

Veeam Recovery Media Shows Command Line Only

Challenge When booting from the Veeam Recovery Media, the Veeam Agent machine displays the command line interface instead of the Veeam Recovery Media screen. Cause Comodo Firewall , Comodo Antivirus Software, or Central Management Software for Comodo may block some of the Veeam Agent processes,...

CVE-2020-12142

IPSec UDP key material can be retrieved from machine-to-machine interfaces and human-accessible interfaces by a user with admin credentials. Such a user, with the required system knowledge, could use this material to decrypt in-flight communication. 2. The vulnerability requires administrative...