PT-2020-16234 · Micro Focus · Micro Focus Arcsight Logger

Name of the Vulnerable Software and Affected Versions: Micro Focus ArcSight Logger version 7.1 Description: The issue is a Cross-Site Scripting vulnerability that could be remotely exploited, resulting in Cross-Site Scripting XSS. Recommendations: For Micro Focus ArcSight Logger version 7.1, upda...

Vulnerabilities fixed in Micro Focus ArcSight Logger

Vulnerabilities have been fixed in Micro Focus ArcSight Logger. The vulnerabilities allow a remote malicious person to execute arbitrary code under the user's privileges. Micro Focus has released updates to address the vulnerabilities. fixes. More information can be found on the page below:...

Micro Focus ArcSight Logger Cross-Site Scripting Vulnerability (CNVD-2020-65165)

ArcSight Logger is a log management solution optimized for extremely high event throughput, efficient long-term storage and fast data analysis. A cross-site scripting vulnerability exists in Micro Focus ArcSight Logger versions prior to 7.1.1. Detailed vulnerability details are not available at...

Micro Focus ArcSight Logger Arbitrary Code Execution Vulnerability

ArcSight Logger is a log management solution optimized for extremely high event throughput, efficient long-term storage and fast data analysis. An arbitrary code execution vulnerability exists in Micro Focus ArcSight Logger versions prior to 7.1.1. An attacker could exploit this vulnerability to...

Micro Focus ArcSight Logger Cross-Site Scripting Vulnerability (CNVD-2020-66857)

Micro Focus ArcSight Logger is a suite of log management software from Micro Focus UK. The software collects and integrates data from any log generation source for log management, searching, indexing, reporting, analysis and retention. A cross-site scripting vulnerability exists in Micro Focus...

Micro Focus ArcSight Logger 跨站脚本漏洞

Micro Focus ArcSight Logger is a suite of log management software from Micro Focus UK. The software collects and integrates data from any log generation source for log management, searching, indexing, reporting, analysis and retention. A cross-site scripting vulnerability exists in Micro Focus...

Micro Focus ArcSight Logger 跨站脚本漏洞

ArcSight Logger is a log management solution optimized for extremely high event throughput, efficient long-term storage and fast data analysis. A cross-site scripting vulnerability exists in Micro Focus ArcSight Logger versions prior to 7.1.1. Detailed vulnerability details are not available at...

Micro Focus ArcSight Logger 代码注入漏洞

ArcSight Logger is a log management solution optimized for extremely high event throughput, efficient long-term storage and fast data analysis. An arbitrary code execution vulnerability exists in Micro Focus ArcSight Logger versions prior to 7.1.1. An attacker could exploit this vulnerability to...

Microsoft Teams Users Under Attack in 'FakeUpdates' Malware Campaign

Attackers are using ads for fake Microsoft Teams updates to deploy backdoors, which use Cobalt Strike to infect companies’ networks with malware. Microsoft is warning its customers about the so-called “FakeUpdates” campaigns in a non-public security advisory, according to a report in Bleeping...

CVE-2020-28328

SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account takeover, loggerfilename can refer to an attacker-controlled .php file under the web root...

freerdp: Out of bound read in update_recv could result in a crash

In FreeRDP less than or equal to 2.0.0, when running with logger set to "WLOGTRACE", a possible crash of application could occur due to a read of an invalid array index. Data could be printed as string to local terminal. This has been fixed in 2.1.0...

CVE-2020-5657

Improper neutralization of argument delimiters in a command 'Argument Injection' vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series RJ71EIP91 EtherNet/IP Network Interface Module First 2 digits of serial number are '02' or before, RJ71PN92 PROFINET IO Controller Modul...

CVE-2020-5655

NULL pointer dereferences vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series RJ71EIP91 EtherNet/IP Network Interface Module First 2 digits of serial number are '02' or before, RJ71PN92 PROFINET IO Controller Module First 2 digits of serial number are '01' or before,...

Design/Logic Flaw

Improper neutralization of argument delimiters in a command 'Argument Injection' vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series RJ71EIP91 EtherNet/IP Network Interface Module First 2 digits of serial number are '02' or before, RJ71PN92 PROFINET IO Controller Modul...

CVE-2020-5657

Improper neutralization of argument delimiters in a command 'Argument Injection' vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series RJ71EIP91 EtherNet/IP Network Interface Module First 2 digits of serial number are '02' or before, RJ71PN92 PROFINET IO Controller Modul...

Mitsubishi Electric MELSEC iQ-R

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Mitsubishi Electric Equipment: MELSEC iQ-R Vulnerabilities: Improper Restriction of Operations within the Bounds of a Memory Buffer, Session Fixation, NULL Pointer Dereference, Improper Access...

Tailor MS 1.0 - Reflected Cross-Site Scripting

Exploit Title: Tailor MS 1.0 - Reflected Cross-Site Scripting Exploit Author: Bobby Cooke boku & Adeeb Shah @hyd3sec Date: 2020-09-14 CVE ID: CVE-2020-23835 Vendor Homepage: https://www.sourcecodester.com Software Link:...

GHSA-33C7-2MPW-HG34 Log injection in uvicorn

This affects all versions of package uvicorn. The request logger provided by the package is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attackers request craft...

Design/Logic Flaw

This affects all versions of package uvicorn. The request logger provided by the package is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attackers request craft...

UBUNTU-CVE-2020-7694

This affects all versions of package uvicorn. The request logger provided by the package is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attackers request craft...