Moderate: Red Hat Bug Fix Advisory: net-snmp bug fix and enhancement update

An update for net-snmp is now available for Red Hat Enterprise Linux 8. The net-snmp packages provide various libraries and tools for the Simple Network Management Protocol SNMP, including an SNMP library, an extensible agent, tools for requesting or setting information from SNMP agents, tools fo...

Nsauditor 3.2.0.0 - (Name) Denial of Service Exploit

Exploit Title: Nsauditor 3.2.0.0 - 'Name' Denial of Service PoC Discovery by: 0xMoHassan Date: 2020-04-04 Vendor Homepage: http://www.nsauditor.com Software Link: http://www.nsauditor.com/downloads/nsauditorsetup.exe Tested Version: 3.2.0.0 Vulnerability Type: Denial of Service DoS Local Tested o...

net-snmp: NULL pointer exception in snmp_oid_compare in snmplib/snmp_api.c resulting in a denial of service

snmpoidcompare in snmplib/snmpapi.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug that can be used by an unauthenticated attacker to remotely cause the instance to crash via a crafted UDP packet, resulting in Denial of Service...

NETSAS Enigma NMS Directory Traversal Vulnerability

NETSAS Enigma NMS is a suite of network management and monitoring tools from NETSAS Australia. A path traversal vulnerability exists in NETSAS Enigma NMS version 65.0.0 and earlier. The vulnerability stems from the failure of a network system or product to properly filter special elements in the...

CVE-2019-16069

A number of stored Cross-site Scripting XSS vulnerabilities were identified in NETSAS Enigma NMS 65.0.0 and prior that could allow a threat actor to inject malicious code directly into the application through the SNMP protocol...

CVE-2019-16061

A number of files on the NETSAS Enigma NMS server 65.0.0 and prior are granted weak world-readable and world-writable permissions, allowing any low privileged user with access to the system to read sensitive data e.g., .htpasswd and create/modify/delete content e.g., under /var/www/html/docs with...

Cisco Warns of High-Severity SD-WAN Flaws

Cisco Systems has fixed three high-severity vulnerabilities in its software-defined networking for wide-area network SD-WAN solutions for business users. If exploited, the flaws could enable bad actors to execute commands with root privileges on affected systems. To exploit the vulnerabilities...

CVE-2020-7256

Cross site scripting vulnerability in McAfee Network Security Management NSM Prior to 9.1 update 6 Mar 2020 Update allows attackers to unspecified impact via unspecified vectors...

Zyxel CNM SecuManager 3.1.0 / 3.1.1 Hardcoded Keys / XSS / Code Execution

Hello, Please find a text-only version below sent to security mailing lists. The HTML version on "Multiple vulnerabilities found in Zyxel CNM SecuManager" is posted here: https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html === text-version of the advisory ===...

Moxa AWK-3131A Authentication Bypass Vulnerability

Moxa AWK-3131A is a wireless access device from Moxa. A security vulnerability exists in the handling of host names in the Moxa AWK-3131A using firmware version 1.13. An attacker can exploit this vulnerability to bypass authentication by sending an authenticated SNMP request...

Cisco Prime Infrastructure runrshell Local Privilege Escalation Vulnerability

Cisco Prime Infrastructure CPI is a wired and wireless network management software suite that consists of different networking applications from Cisco Systems. The system is used across various industries, from healthcare, manufacturing, government, IT, etc. A vulnerability was found in the...

Mini-SNMPD Out-of-Bounds Read Vulnerability

Mini-SNMPD is a lightweight implementation of the Simple Network Management Protocol SNMP server. An out-of-bounds read vulnerability exists in the way Mini-SNMPD 1.4 parses incoming SNMP packets. An attacker could exploit this vulnerability by sending specially crafted packets to cause sensitive...

Mini-SNMPD socket disconnect denial-of-service vulnerability

Summary A stack buffer overflow vulnerability exists in the way MiniSNMPD version 1.4 handles multiple connections. A specially timed sequence of SNMP connections can trigger a stack overflow, resulting in a denial of service. To trigger this vulnerability, an attacker needs to simply initiate...

CVE-2019-16027

A vulnerability in the implementation of the Intermediate SystemtoIntermediate System ISIS routing protocol functionality in Cisco IOS XR Software could allow an authenticated, remote attacker to cause a denial of service DoS condition in the ISIS process. The vulnerability is due to improper...

Cisco IOS XR IS-IS Denial of Service Vulnerability

Cisco IOS XR is a fully modular and fully distributed network interconnect operating system. A denial-of-service vulnerability exists in the Intermediate System-to-Intermediate System IS-IS routing protocol function in Cisco IOS XR versions prior to 6.6.3, 7.0.2, 7.1.1, and 7.2.1. The vulnerabili...

SolarWinds Orion Platform Cross-Site Scripting Vulnerability

SolarWinds Orion Platform is a network fault and network performance management platform from SolarWinds, Inc. The platform provides real-time monitoring and analysis of network devices and supports a customizable web interface, multiple user opinions, and a mapped view of the entire network. A...

CVE-2019-12819

A use-after-free flaw was found in the Linux kernel's MDIO section of the network management subsystem. An attacker who is able to hot-plug a network device can trigger the mdiobusregister function in drivers/net/phy/mdiobus.c, which can cause a use-after-free condition causing a memory corruptio...

[SECURITY] Fedora 31 Update: ocsinventory-agent-2.6.0-3.2.fc31

Open Computer and Software Inventory Next Generation is an application designed to help a network or system administrator keep track of computer configuration and software installed on the network. It also allows deploying software, commands or files on Windows and Linux client computers...

CVE-2020-1600

In a Point-to-Multipoint P2MP Label Switched Path LSP scenario, an uncontrolled resource consumption vulnerability in the Routing Protocol Daemon RPD in Juniper Networks Junos OS allows a specific SNMP request to trigger an infinite loop causing a high CPU usage Denial of Service DoS condition...

The vulnerability of the Cisco Digital Network Architecture (DNA) Center’s network management system, related to insecure privilege management, allows attackers to elevate their privileges and execute arbitrary code.

The vulnerability of the Cisco Digital Network Architecture DNA Center’s network management system is related to insecure management of privileges. Exploiting this vulnerability could allow attackers to enhance their privileges and execute arbitrary code...