Asterisk 路径遍历漏洞

Asterisk is a software for PBX systems that runs on Linux and supports IP calls using SIP, IAX, and H323 protocols. Asterisk suffers from a security vulnerability that stems from the vulnerability of remote authentication sessions, where GetConfig AMI Action can read files outside of a directory,...

CVE-2022-44533

A vulnerability in the Aruba EdgeConnect Enterprise web management interface allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complet...

The vulnerability of the iControl SOAP interface for access control and remote authentication in BIG-IP and server software, BIG-IQ Centralized Management, allows a perpetrator to execute arbitrary commands with elevated privileges.

The vulnerability of the iControl SOAP interface for access control and remote authentication in BIG-IP and server software, BIG-IQ Centralized Management, is related to the manipulation of inter-site requests. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands...

ProFTPd 安全漏洞

ProFTPd is a highly configurable open source FTP server software. A security vulnerability exists in ProFTPd versions prior to 1.3.7c, which stems from modradius copying a 16-character block that allows memory leaks to a RADIUS server...

MariaDB 5.3.0 < 5.3.8

The version of MariaDB installed on the remote host is prior to 5.3.8. It is, therefore, affected by a vulnerability as referenced in the 5.3.8 advisory. - Multiple SQL injection vulnerabilities in the replication code in Oracle MySQL possibly before 5.5.29, and MariaDB 5.1.x through 5.1.62, 5.2....

MariaDB 10.0.0 < 10.0.12 Multiple Vulnerabilities

The version of MariaDB installed on the remote host is prior to 10.0.12. It is, therefore, affected by multiple vulnerabilities as referenced in the 10.0.12 advisory. - Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.37 and earlier and 5.6.17 and earlier allows remote...

HPESBNW04383 rev.1 - Hewlett Packard Enterprise OfficeConnect 1820, 1850, and 1920S Network switches, Remote Authentication Bypass Vulnerability

Potential Security Impact: Remote: Authentication Bypass SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE OfficeConnect 1820 8G Switch J9979A - Prior to PT.02.14 HPE OfficeConnect 1820 8G PoE+ 65W Switch J9982A - Prior to PT.02.14 HPE OfficeConnect 1820 24G Switch J9980A - Prio...

CVE-2022-27510: Critical Citrix ADC and Gateway Remote Authentication Bypass Vulnerabilities

On November 8, 2022, Citrix published Citrix Gateway and Citrix ADC Security Bulletin for CVE-2022-27510 CVE-2022-27513 and CVE-2022-27516 announcing fixes for three vulnerabilities: CVE-2022-27510 “Unauthorized access to Gateway user capabilities” CVE-2022-27513 “Remote desktop takeover via...

CVE-2022-42126

The CVE-2022-42126 entry affects the Asset Libraries module in Liferay Portal 7.3.5–7.4.3.28 and Liferay DXP 7.3 before update 8, and DXP 7.4 before update 29. Root cause: improper permission checks allow remote authenticated users to view asset libraries via the UI. Practical impact is exposure ...

VMware Hyperic 代码问题漏洞

VMWare Hyperic is an application monitoring component of the Cloud Application Platform from VMWare, Inc. It enables IT professionals to manage the performance and availability of customized web applications in physical, virtual and cloud environments. A code issue vulnerability exists in VMware...

VMWare Hyperic 代码问题漏洞

VMWare Hyperic is an application monitoring component of the Cloud Application Platform from VMWare, Inc. It enables IT professionals to manage the performance and availability of customized web applications in physical, virtual, and cloud environments. A code issue vulnerability exists in VMWare...

CVE-2022-26088

An issue was discovered in BMC Remedy before 22.1. Email-based Incident Forwarding allows remote authenticated users to inject HTML such as an SSRF payload into the Activity Log by placing it in the To: field. This affects rendering that occurs upon a click in the "number of recipients" field...

HPESBST04384 rev.2 - HPE B-series SAN Switches with Brocade Fabric OS (FOS), Remote Authentication Bypass

Potential Security Impact: Remote: Authentication Bypass, Unqualified Configuration Change SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE SN8000B 4-slot SAN Director Switch - v8.x prior to v8.2.3c1 HPE SN8000B 8-slot SAN Director Switch - v8.x prior to v8.2.3c1 HPE SN8600B...

CVE-2022-26088

CVE-2022-26088 affects BMC Remedy ITSM Suite prior to 22.1. Email-based Incident Forwarding can let remote authenticated users inject HTML (including SSRF payloads) into the Activity Log by placing content in the To: field, influencing rendering when the number of recipients is clicked. The vulne...

Vulnerabilities fixed in Citrix Gateway and Citrix ADC

Citrix has fixed vulnerabilities in Citrix Gateway and Citrix ADC. A malicious party could exploit the vulnerabilities to circumvent security measures via bypassing authentication, security measures, or through brute-force methods, gain access to user environments. The vulnerability with referenc...

CVE-2022-20937

A vulnerability in a feature that monitors RADIUS requests on Cisco Identity Services Engine ISE Software could allow an unauthenticated, remote attacker to negatively affect the performance of an affected device. This vulnerability is due to insufficient management of system resources. An attack...

Cisco Identity Services Engine 资源管理错误漏洞

Cisco Identity Services Engine ISE is an environment-aware platform ISE Identity Services Engine from Cisco. The ISE collects real-time information about the network, users, and devices to develop and implement policies to monitor the network. A resource management error vulnerability exists in...

CVE-2022-35132

The CVE-2022-35132 vulnerability affects Webmin/Usermin (up to version 1.850). It allows a remote authenticated user to execute OS commands via command injection in a filename used by the GPG module. Root cause: improper handling of the GPG module filename enables command execution. Impact is hig...

Vulnerability fixed in Palo Alto PAN-OS

Palo Alto has fixed a vulnerability in PAN-OS. The vulnerability allows a malicious person to remotely bypass authentication and impersonate an existing PAN-OS Administrator. This allows the malicious party with administrator privileges to perform actions and execute arbitrary code. Palo Alto...

Security Bulletin: XML External Entity (XXE) security vulnerability in InfoSphere Guardium (CVE-2012-3339)

Abstract XML External Entity XXE security vulnerability in InfoSphere Guardium allows remote authenticated users to obtain sensitive information via unspecified vectors. Content VULNERABILITY DETAILS: CVE ID: CVE-2012-3339 DESCRIPTION: User can get to an error report containing content of a file ...