Exploit for Deserialization of Untrusted Data in Apache Dubbo

CVE-2021-43297 Vulnerability Description There is a poten...

Arbitrary File Read Vulnerability in the Flash Flood Monitoring and Early Warning Platform of Siltronic Technology Limited (CNVD-2022-10308)

Siltronic Ltd. is an information service provider for disaster reduction and profitability in China. An arbitrary file read vulnerability exists in the flash flood monitoring and early warning platform of Sicron Technology Limited, which can be exploited by attackers to obtain sensitive informati...

File Upload Vulnerability in the Flash Flood Monitoring and Early Warning Platform of Siltronic Ltd (CNVD-2022-10318)

Siltronic Ltd. is an information service provider for disaster reduction and profitability in China. A file upload vulnerability exists in the flash flood monitoring and early warning platform of Sicron Technology Co. Ltd, which can be exploited by an attacker to gain control of the server...

CVE-2021-34994

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the DataProvider...

Information Disclosure

is vulnerable to information disclosure. The vulnerability exists because response received from a identity provider is not properly validated which allows an attacker to gain access to the identity of another user...

The vulnerability of the onCreatePermissionRequest function in SettingsSliceProvider.java in the Android operating system, which allows a hacker to escalate their privileges.

The vulnerability of the onCreatePermissionRequest function in SettingsSliceProvider.java in the Android operating system is related to insecure management of permissions. Exploiting this vulnerability could allow a malicious actor to enhance their privileges...

CVE-2021-43999

Apache Guacamole 1.2.0 and 1.3.0 do not properly validate responses received from a SAML identity provider. If SAML support is enabled, this may allow a malicious user to assume the identity of another Guacamole user...

CVE-2021-43999

Apache Guacamole 1.2.0 and 1.3.0 do not properly validate responses received from a SAML identity provider. If SAML support is enabled, this may allow a malicious user to assume the identity of another Guacamole user...

Code injection

Apache Guacamole 1.2.0 and 1.3.0 do not properly validate responses received from a SAML identity provider. If SAML support is enabled, this may allow a malicious user to assume the identity of another Guacamole user...

UBUNTU-CVE-2021-43999

Apache Guacamole 1.2.0 and 1.3.0 do not properly validate responses received from a SAML identity provider. If SAML support is enabled, this may allow a malicious user to assume the identity of another Guacamole user...

CVE-2021-43999

CVE-2021-43999 affects Apache Guacamole 1.2.0 and 1.3.0 when SAML authentication is enabled. The issue arises from improper validation of responses from the SAML identity provider, which could allow a malicious user to impersonate another Guacamole user. Multiple connected sources (NVD, OSV, CNVD...

Apache Guacamole 授权问题漏洞

Apache Guacamole is a clientless remote desktop gateway from the Apache Foundation in the United States. The product supports protocols such as VNC, RDP, and SSH. A security vulnerability exists in Apache Guacamole 1.2.0 and 1.3.0, which stems from the failure of Apache Guacamole 1.2.0 and 1.3.0 ...

PT-2022-11969 · Apache +1 · Apache Guacamole +1

Name of the Vulnerable Software and Affected Versions: Apache Guacamole versions 1.2.0 through 1.3.0 Description: The issue concerns the improper validation of responses from a SAML identity provider. If SAML support is enabled, a malicious user may assume the identity of another Guacamole user...

CVE-2022-22269

Keeping sensitive data in unprotected BluetoothSettingsProvider prior to SMR Jan-2022 Release 1 allows untrusted applications to get a local Bluetooth MAC address...

CVE-2022-22269

Keeping sensitive data in unprotected BluetoothSettingsProvider prior to SMR Jan-2022 Release 1 allows untrusted applications to get a local Bluetooth MAC address...

CVE-2021-44878

Summary: CVE-2021-44878 affects pac4j (v5.3.0 and earlier) where an OpenID Connect provider that supports the “none” algorithm can bypass token validation by injecting an ID token with alg: none and empty signature, violating OpenID Core specifications. The vulnerability enables bypassing token v...

Broward Breach Highlights Healthcare Supply-Chain Problems

This week’s announcement by Florida’s Broward Health System that the most intimate medical data of 1,357,879 of its patients was breached in the fall should serve as a warning that the healthcare software supply chain will be a juicy target for cybercriminals as we head into 2022, researchers war...

Service Provider Console displays duplicate entries for machines when Veeam Agent is installed on Citrix VM.

Article Applicability This article documents an issue resolved in Veeam Service Provider Console 7. Challenge When VMs on Citrix Hypervisor formerly known as XenServer that is orchestrated by Cloudstack Apache or Azure Stack Hub and using Veeam Agent for Microsoft Windows or for Linux are managed...

AZL-33604 CVE-2021-44716 affecting package kube-vip-cloud-provider for versions less than 0.0.2-16

net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests...

The vulnerability of the Credential Security Support Provider Protocol (CredSSP) implementation in the Windows operating system allows a perpetrator to enhance their privileges.

The vulnerability of the Credential Security Support Provider Protocol CredSSP implementation in the Windows operating system is related to insecure management of privileges. Exploiting this vulnerability can allow attackers to enhance their privileges...