1026 matches found
A week in security (May 3 – 9)
Last week on Malwarebytes Labs, we discussed how Spectre attacks have come back from the dead; why Facebook banned Instragram ads by Signal; we highlighted the differences between the most popular VPN protocols; pointed out that Google is about to start automatically enrolling users in two-step...
CVE-2021-32092
A Cross-site scripting XSS vulnerability in the DocumentAction component of U.S. National Security Agency NSA Emissary 5.9.0 allows remote attackers to inject arbitrary web script or HTML via the uuid parameter...
CVE-2021-32093
The ConfigFileAction component of U.S. National Security Agency NSA Emissary 5.9.0 allows an authenticated user to read arbitrary files via the ConfigName parameter...
Design/Logic Flaw
The ConfigFileAction component of U.S. National Security Agency NSA Emissary 5.9.0 allows an authenticated user to read arbitrary files via the ConfigName parameter...
Cross site scripting
A Cross-site scripting XSS vulnerability in the DocumentAction component of U.S. National Security Agency NSA Emissary 5.9.0 allows remote attackers to inject arbitrary web script or HTML via the uuid parameter...
CVE-2021-32093
The ConfigFileAction component of U.S. National Security Agency NSA Emissary 5.9.0 allows an authenticated user to read arbitrary files via the ConfigName parameter...
CVE-2021-32096
The ConsoleAction component of U.S. National Security Agency NSA Emissary 5.9.0 allows a CSRF attack that results in injecting arbitrary Ruby code for an eval call via the CONSOLECOMMANDSTRING parameter...
CVE-2021-32095
U.S. National Security Agency NSA Emissary 5.9.0 allows an authenticated user to delete arbitrary files...
CVE-2021-32094
U.S. National Security Agency NSA Emissary 5.9.0 allows an authenticated user to upload arbitrary files...
CVE-2021-32095
U.S. National Security Agency NSA Emissary 5.9.0 allows an authenticated user to delete arbitrary files...
CVE-2021-32096
The ConsoleAction component of U.S. National Security Agency NSA Emissary 5.9.0 allows a CSRF attack that results in injecting arbitrary Ruby code for an eval call via the CONSOLECOMMANDSTRING parameter...
CVE-2021-32094
U.S. National Security Agency NSA Emissary 5.9.0 allows an authenticated user to upload arbitrary files...
Cross site request forgery (csrf)
The ConsoleAction component of U.S. National Security Agency NSA Emissary 5.9.0 allows a CSRF attack that results in injecting arbitrary Ruby code for an eval call via the CONSOLECOMMANDSTRING parameter...
Code injection
U.S. National Security Agency NSA Emissary 5.9.0 allows an authenticated user to delete arbitrary files...
CVE-2021-32092
The CVE-2021-32092 issue affects NSA Emissary 5.9.0, specifically the DocumentAction component. A Cross-site Scripting (XSS) flaw allows remote attackers to inject arbitrary web script or HTML via the uuid parameter. The available connected documents confirm the vulnerable version and parameter, ...
CVE-2021-32093
The ConfigFileAction component of U.S. National Security Agency NSA Emissary 5.9.0 allows an authenticated user to read arbitrary files via the ConfigName parameter...
CVE-2021-32093
CVE-2021-32093 affects NSA Emissary 5.9.0. The issue resides in the ConfigFileAction component, where an authenticated user can read arbitrary files via the ConfigName parameter, resulting in information disclosure. The connected documents corroborate the vulnerability description across multiple...
CVE-2021-32094
U.S. National Security Agency NSA Emissary 5.9.0 allows an authenticated user to upload arbitrary files...
CVE-2021-32094
The connected sources confirm CVE-2021-32094 affects the NSA Emissary product (version 5.9.0). An authenticated user can upload arbitrary files, indicating a file upload vulnerability likely related to access control or input handling in the Emissary workflow engine. The documents do not specify ...