PT-2022-14891 · Unknown +1 · Libiec61850 +1

Name of the Vulnerable Software and Affected Versions: libiec61850 version 1.5.0 Description: A denial of service issue exists in the parseNormalModeParameters functionality. It can be triggered by a specially-crafted series of network requests, allowing an attacker to send a sequence of malforme...

Instance config inline secret exposure in Grafana

Impact Some inline secrets are exposed in plaintext over the Grafana Agent HTTP server: Inline secrets for metrics instance configs in the base YAML file are exposed at /-/config Inline secrets for integrations are exposed at /-/config Inline secrets for Consul ACL tokens and ETCD basic auth when...

CVE-2021-41090

Grafana Agent is a telemetry collector for sending metrics, logs, and trace data to the opinionated Grafana observability stack. Prior to versions 0.20.1 and 0.21.2, inline secrets defined within a metrics instance config are exposed in plaintext over two endpoints: metrics instance configs defin...

Authentication Bypass in ASG and ProxySG

Summary The Symantec Advanced Secure Gateway ASG and ProxySG web management consoles are susceptible to an authentication bypass vulnerability. An unauthenticated attacker can execute arbitrary CLI commands, view/modify the appliance configuration and policy, and shutdown/restart the appliance...

PT-2021-2895 · Oracle +8 · Mysql Server +7

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.23 and prior Description: The issue is related to insufficient input validation in the MySQL Server product, specifically in the Server: DML component. This allows a high-privileged attacker with network access via...

WAGO Series 750-88x and 750-352 (Update A)

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: WAGO Equipment: 750-88x and 750-352 Vulnerability: Uncontrolled Resource Consumption 2. UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled ICSA-20-308-01 WAGO...

PT-2020-2613 · Mysql Server +9 · Mysql Server +9

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 5.6.47 and prior MySQL Server versions 5.7.28 and prior MySQL Server versions 8.0.18 and prior Description: The vulnerability in the MySQL Server product is related to insufficient access control in the InnoDB component...

Samsung J7 Neo Access Control Error Vulnerability (CNVD-2020-14679)

Samsung J7 Neo is a smartphone from Samsung South Korea. The Samsung J7 Neo build fingerprint: samsung/j7veltedx/j7velte:8.1.0/M1AJQ/J701FXVS6BSC1:user/release-keys in the com.samsung.android. An access control error vulnerability exists in the themecenter app. The vulnerability stems from the...

PT-2019-3725 · Mysql Server +1 · Mysql Server +1

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 5.6.45 and prior MySQL Server versions 5.7.27 and prior Description: The issue is related to a lack of protection for service data in the MySQL Server product, specifically in the Server: Security: Encryption component...

PT-2019-11541 · Univention · Univention Corporate Server

Name of the Vulnerable Software and Affected Versions: Univention Corporate Server univention-directory-notifier versions 12.0.1-3 and earlier Description: The issue affects the function data on connection in src/callback.c, allowing intentional information exposure through network connectivity,...

The vulnerability of the software for Cisco TelePresence Video Communication Server and Cisco Expressway Series devices is related to errors in network service restrictions, allowing attackers to compromise the integrity of protected information.

The vulnerability of the software on Cisco TelePresence Video Communication Server and Cisco Expressway Series conference communication devices is related to errors in network service restrictions. Exploiting this vulnerability allows a malicious actor to compromise the integrity of protected...

WAGO e!DISPLAY Web-Based-Management

1. EXECUTIVE SUMMARY CVSS v3 8.0 ATTENTION: Exploitable remotely/Low skill level to exploit/Public exploits are available Vendor: WAGO Equipment: e!DISPLAY Web-Based-Management WBM Vulnerabilities: Cross-site Scripting, Unrestricted Upload of File with Dangerous Type, and Incorrect Permissions fo...

Security Bulletin: IBM TRIRIGA Application Platform Privilege Escalation (CVE-2016-0342)

Summary The IBM TRIRIGA Application platform grants the ability to access to read or modify a report that the user does not have privileges for. Vulnerability Details CVEID: CVE-2016-0342 DESCRIPTION: CVSS Base Score: 5.4 CVSS Temporal Score: See for the current score CVSS Environmental Score:...

Potential Security Vulnerabilities With JavaTM SDKs

Abstract Security Bulletin: Asset and Service Mgmt Products - Potential security exposure when using JavaTM based applications due to vulnerabilities in Java Software Developer Kits. See Vulnerability Details for CVE IDs. Content VULNERABILITY DETAILS: CVE ID:...

MEDHOST Document Management System Hardcoded Credentials

MEDHOST Document Management System contains multiple hard-coded credentials CVE-2017-11693 & CVE-2017-11694 Overview ------------ Medhost Document Management system for all versions contains hard-coded credentials used for customer database and Apache Solr access. This is a new vulnerability not...

MEDHOST Connex Hard-Coded Credentials

Overview ------------ MEDHOST Connex for all versions contains hard-coded credentials that are used for customer database access. This is a new vulnerability not related to CVE-2016-4328. Description ------------ MEDHOST Connex contains hard-coded credentials that are used for customer database...

Cross-Site Scripting in the Management Web Interface

A reflected cross-site scripting XSS vulnerability exists in the management web interface. PAN-OS contains an unauthenticated vulnerability that may allow for a reflected cross-site scripting XSS attack of the management web interface. ref PAN-76455 / CVE-2017-9459. Successful exploitation of thi...

WiMAX CPE Authentication Bypass

We have published an accompanying blog post to this technical advisory with further information: http://blog.sec-consult.com/2017/06/ghosts-from-past-authentication-bypass.html SEC Consult Vulnerability Lab Security Advisory =======================================================================...

Design/Logic Flaw

The mDNS module in Huawei WLAN AC6005, AC6605, and ACU2 devices with software before V200R006C00SPC100 allows remote attackers to obtain sensitive information by leveraging failure to restrict processing of mDNS unicast queries to the link local network...

Cross-Site Scripting in the Management Web Interface

A persistent cross-site scripting XSS vulnerability exists in the management web interface ref PAN-66838 / CVE-2017-5584. PAN-OS contains a post-authentication vulnerability that may allow for a persistent cross-site scripting XSS attack of the management web interface. Successful exploitation of...