Silver Peak Unity Orchestrator Path Traversal Vulnerability

Silver Peak Systems Silver Peak Unity Orchestrator is Silver Peak Systems' software for network management across WAN environments. The software provides a centralized way to orchestrate the network and visualize and manage network status. An authorization issue vulnerability exists in Silver Pea...

Security Bulletin: Vulnerability in WebSphere Application Server affects IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise (CVE-2020-4782)

Summary WebSphere Application Server is shipped with IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise. A vulnerability has been identified in WebSphere Application Server and the information about their fixes are published in security bulletins. Vulnerability Details Refer to the...

CVE-2020-12146

In Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+, an authenticated user can access, modify, and delete restricted files on the Orchestrator server using the/debugFiles REST API...

CVE-2020-12147

In Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+, an authenticated user can make unauthorized MySQL queries against the Orchestrator database using the /sqlExecution REST API, which had been used for internal testing...

CVE-2020-12147

In Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+, an authenticated user can make unauthorized MySQL queries against the Orchestrator database using the /sqlExecution REST API, which had been used for internal testing...

CVE-2020-12145

Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+ uses HTTP headers to authenticate REST API calls from localhost. This makes it possible to log in to Orchestrator by introducing an HTTP HOST header set to 127.0.0.1 or localhost. Orchestrator instances that are hosted ...

CVE-2020-12146

In Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+, an authenticated user can access, modify, and delete restricted files on the Orchestrator server using the/debugFiles REST API...

Design/Logic Flaw

Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+ uses HTTP headers to authenticate REST API calls from localhost. This makes it possible to log in to Orchestrator by introducing an HTTP HOST header set to 127.0.0.1 or localhost. Orchestrator instances that are hosted ...

Code injection

In Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+, an authenticated user can make unauthorized MySQL queries against the Orchestrator database using the /sqlExecution REST API, which had been used for internal testing...

CVE-2020-12146 Silver Peak Unity OrchestratorTM subject to path traversal.

In Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+, an authenticated user can access, modify, and delete restricted files on the Orchestrator server using the/debugFiles REST API...

CVE-2020-12146

CVE-2020-12146 concerns Silver Peak Unity Orchestrator path traversal via the /debugFiles REST API. An authenticated user can access, modify, and delete restricted files on the Orchestrator server. Affected versions are pre-8.9.11+, 8.10.11+, and 9.0.1+. ThreatPost notes that patches exist, and S...

CVE-2020-12147 Unauthorized queries against the Silver Peak Unity OrchestratorTM MySQL database.

In Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+, an authenticated user can make unauthorized MySQL queries against the Orchestrator database using the /sqlExecution REST API, which had been used for internal testing...

CVE-2020-12147

CVE-2020-12147 affects Silver Peak Unity Orchestrator. An authenticated user can issue unauthorized MySQL queries against the Orchestrator database through the /sqlExecution REST API. Affected versions: prior to 8.9.11+, 8.10.11+, or 9.0.1+. Documentation notes that patches are available to remed...

CVE-2020-12145 Silver Peak Unity OrchestratorTM authentication can be subverted through manipulation of HTTP headers.

Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+ uses HTTP headers to authenticate REST API calls from localhost. This makes it possible to log in to Orchestrator by introducing an HTTP HOST header set to 127.0.0.1 or localhost. Orchestrator instances that are hosted ...

CVE-2020-12145

Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+ are affected by CVE-2020-12145, which allows login via HTTP Host header spoofing to localhost. The vulnerability stems from authenticating REST API calls from localhost using the host header, enabling an attacker to byp...

Security Bulletin: Vulnerability in WebSphere Application Server affects IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise (CVE-2020-4464, CVE-2020-4163)

Summary WebSphere Application Server is shipped with IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise. A vulnerability has been identified in WebSphere Application Server and the information about their fixes are published in security bulletins. Vulnerability Details Refer to the...

McAfee ePolicy Orchestrator (SB10332)

The instance of McAfee ePolicy Orchestrator installed on the remote host is affected by multiple vulnerabilities including the following: - Multiple denial of service DoS vulnerabilities exist in McAfee ePolicy Orchestrator's bundled component Apache Tomcat due to insufficient validation of user...

McAfee ePolicy chistrator (ePO) cross-site scripting vulnerability

McAfee ePolicy Orchistrator ePO is a suite of scalable security management software from McAfee. The software enables centralized, streamlined management of endpoint, network, content security and compliance solutions. A cross-site scripting vulnerability exists in McAfee ePolicy chistrator ePO...

Security Bulletin: Vulnerability in WebSphere Application Server affects IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise (CVE-2020-4576)

Summary WebSphere Application Server is shipped with IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise. A vulnerability has been identified in WebSphere Application Server and the information about their fixes are published in a security bulletin. Vulnerability Details Refer to the...

Security Bulletin: Vulnerability in WebSphere Application Server affects IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise (CVE-2020-4629)

Summary WebSphere Application Server is shipped with IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise. Vulnerability has been identified in WebSphere Application Server and the information about the fix is published in a security bulletin. Vulnerability Details Refer to the security...