Exploit for Path Traversal in Vmware Cloud_Foundation

CVE-2021-22005 VMware vCenter Server arbitrary file upload...

Leverage Virtual Patching to Prevent Network Threats

Implementing an intrusion prevention system is only one step in your cybersecurity efforts. Learn how virtual patching helps keep your IPS up to date and protect against zero-day threats, keeping your systems safe from attack...

The vulnerability of the NSS network security application library package, related to the allocation of unlimited memory, allows a attacker to cause a service failure.

The vulnerability of the NSS application security library package is related to the allocation of unlimited memory during the processing of ChangeCipherSpec messages. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

CVE-2021-41158

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.10.7, an attacker can perform a SIP digest leak attack against FreeSWITCH and receive the...

CVE-2021-41158

CVE-2021-41158 affects FreeSWITCH prior to 1.10.7. An attacker can trigger a SIP digest leak by provoking challenges with the realm of a configured gateway, causing FreeSWITCH to reveal the gateway’s challenge response (password-derived) without special network privileges. Root cause: flawed chal...

CVE-2021-34863

CVE-2021-34863 affects D-Link DAP-2020 1.01rc001 routers. A stack-based buffer overflow occurs in the webproc endpoint when processing the var:page parameter due to insufficient validation of input length, enabling network-adjacent attackers to execute code with root privileges. Documented by ZDI...

Exploit for Expression Language Injection in Atlassian Confluence_Data_Center

CVE-2021-26084 Confluence remote code execution RCE...

Nation-State Attacker of Telecommunications Networks

Someone has been hacking telecommunications networks around the world: LightBasin aka UNC1945 is an activity cluster that has been consistently targeting the telecommunications sector at a global scale since at least 2016, leveraging custom tools and an in-depth knowledge of telecommunications...

CVE-2021-35550

CVE-2021-35550 is a network-authenticated TLS vulnerability in the JSSE component of Oracle Java SE and Oracle GraalVM Enterprise Edition, affecting Java SE 7u311, 8u301, 11.0.12 and GraalVM EE 20.3.3/21.2.0. Exploitation is possible over TLS with unauthenticated access and can lead to confidenti...

Aruba ClearPass Policy Manager Command Injection Vulnerability (CNVD-2022-10721)

Aruba ClearPass Policy Manager is an application of Aruba, Inc. that provides wireless network security access management system Aruba ClearPass Policy Manager has a security vulnerability that stems from a remote arbitrary command execution vulnerability in Aruba ClearPass Policy Manager version...

Netnifty Internet Behavior Management System Has Arbitrary File Download Vulnerability

Beijing Nethub Information Technology Co., Ltd. was renamed from Lenovo Nethub Technology Beijing Co., Ltd. and its business covers network border security protection, application and data security protection, network-wide security risk management, professional security solutions and professional...

Aruba ClearPass Policy Manager 命令注入漏洞

HPE Aruba ClearPass Policy Manager is a Network Access Control NAC solution.A remote command injection vulnerability exists in HPE Aruba ClearPass Policy Manager. An attacker can exploit this vulnerability to execute arbitrary commands...

Oracle Cloud Infrastructure Instance Metadata Enumeration (Linux / Unix)

The remote host is an OCI Oracle Cloud Infrastructure instance for which metadata could be retrieved. TRUSTED...

CVE-2021-20128

The CVE-2021-20128 vulnerability affects DrayTek VigorConnect 1.6.0-B3, specifically the Profile Name field in the floor plan (Network Menu) page. It is a stored XSS flaw caused by improper sanitization of user input in that field. The exploit would rely on injecting malicious script via the Prof...

Weak Password Vulnerability in Infinova HD Network Mini Dome

Infinova, founded in 1993, is a smart city and smart home solution provider and operation service provider with smart security as its core, providing smart security, smart city, smart home, big data and internet operation services for the world. A weak password vulnerability exists in Infinova HD...

Azure network security helps reduce cost and risk according to Forrester TEI study

As organizations move their computing from on-premises to the cloud, they realize that leveraging cloud-native security tools can provide additional cost savings and business benefits to their security infrastructure. Microsoft Azure network security offers a suite of cloud-native security tools ...

Azure network security helps reduce cost and risk according to Forrester TEI study

As organizations move their computing from on-premises to the cloud, they realize that leveraging cloud-native security tools can provide additional cost savings and business benefits to their security infrastructure. Microsoft Azure network security offers a suite of cloud-native security tools ...

CVE-2021-21940

Summary (CVE-2021-21940) : The TALOS advisory documents a heap-based buffer overflow in the Anker Eufy Homebase 2 pushMuxer when processing RTSP info. A crafted RTSP packet (without a proper CRLFCRLF termination) can cause the server to overflow the 0x800-byte receive buffer across adjacent RtspS...

Advantech WebAccess SCADA

1. EXECUTIVE SUMMARY CVSS v3 4.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Advantech Equipment: WebAccess SCADA Vulnerability: Missing Authorization 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to access project names and paths. 3...

Mitsubishi Electric MELSEC iQ-R Series C Controller Module (Update B)

1. EXECUTIVE SUMMARY CVSS v3 6.8 ATTENTION: Exploitable remotely Vendor: Mitsubishi Electric Equipment: MELSEC iQ-R Series C Controller Module R12CCPU-V Vulnerability: Uncontrolled Resource Consumption 2. UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled...