CyberArk Credential Provider Local Cache Can Be Decrypted

Vulnerability Details Affected Vendor: CyberArk Affected Product: Application Access Manager/Credential Provider Affected Version: Prior to 12.1 Platform: Linux/Windows/zOS CWE Classification: CWE-326: Inadequate Encryption Strength CVE ID: CVE-2021-31798 2. Vulnerability Description CyberArk...

Amazon Kindle e-reader 安全漏洞

The Amazon Kindle e-reader is an e-reader from Amazon.com, Inc. A security vulnerability exists in Amazon Kindle e-reader version 5.13.4 and earlier, which stems from improper administrative privileges and can be exploited by an attacker to elevate privileges to the root user...

sssd: shell command injection in sssctl

A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a specially crafted sssctl command, such as via sudo, to gain root access. The highest...

sssd: shell command injection in sssctl

A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a specially crafted sssctl command, such as via sudo, to gain root access. The highest...

SUSE SLED12: libipa_hbac-devel / libipa_hbac0 / libsss_certmap0 / etc (SUSE-SU-2021:2873-1)

The remote SUSE Linux SLED12 / SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:2873-1 advisory. - CVE-2021-3621: Fixed shell command injection in sssctl via the logs-fetch and cache-expire subcommands bsc1189492. Tenable has...

PT-2021-20710 · NetGear · Netgear Routers

Name of the Vulnerable Software and Affected Versions: NETGEAR Multiple Routers affected versions not specified Description: This issue allows network-adjacent attackers to bypass authentication on affected installations of multiple NETGEAR routers. No authentication is required to exploit this...

Cisco Nexus 9000 Series Fabric Switches ACI Mode Elevation of Privilege Vulnerability

The Cisco Nexus 9000 Series Switches are modular and fixed port network switches designed for the data center.An elevation of privilege vulnerability exists in Cisco Nexus 9000 Series Fabric Switches ACI Mode, which can be exploited by an attacker to gain access to the underlying operating system...

CVE-2021-1584

A vulnerability in Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure ACI mode could allow an authenticated, local attacker to elevate privileges on an affected device. This vulnerability is due to insufficient restrictions during the execution of a specific CLI command...

CVE-2021-1584

Cisco Nexus 9000 Series Fabric Switches operating in Application Centric Infrastructure (ACI) mode are affected by CVE-2021-1584. The flaw arises from insufficient restrictions during the execution of a specific CLI command, enabling an authenticated, local attacker with administrative privileges...

CVE-2021-1584 Cisco Nexus 9000 Series Fabric Switches ACI Mode Privilege Escalation Vulnerability

A vulnerability in Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure ACI mode could allow an authenticated, local attacker to elevate privileges on an affected device. This vulnerability is due to insufficient restrictions during the execution of a specific CLI command...

CVE-2021-1584

A vulnerability in Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure ACI mode could allow an authenticated, local attacker to elevate privileges on an affected device. This vulnerability is due to insufficient restrictions during the execution of a specific CLI command...

Cisco Nexus 9000 Series Fabric Switches 操作系统命令注入漏洞

The Cisco Nexus 9000 Series Switches are modular and fixed port network switches designed for the data center.An elevation of privilege vulnerability exists in Cisco Nexus 9000 Series Fabric Switches ACI Mode, which can be exploited by an attacker to gain access to the underlying operating system...

CVE-2021-38306

Network Attached Storage on LG N1T1 10124 devices allows an unauthenticated attacker to gain root access via OS command injection in the en/ajp/plugins/access.ssh/checkInstall.php destServer parameter...

CVE-2021-38306

The CVE-2021-38306 entry concerns LG N1T1*** Network Attached Storage. Affected component: the en/ajp/plugins/access.ssh/checkInstall.php endpoint (destServer parameter). Root cause: OS command injection leading to unauthenticated remote code execution. Impact: attacker could gain root access on ...

CVE-2021-38557

raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions. The www-data account can execute /etc/raspap/hostapd/enablelog.sh as root with no password; however, the www-data account can also overwrite /etc/raspap/hostapd/enablelog.sh wit...

CVE-2021-38611

A command-injection vulnerability in the Image Upload function of the NASCENT RemKon Device Manager 4.0.0.0 allows attackers to execute arbitrary commands, as root, via shell metacharacters in the filename parameter to assets/index.php...

CVE-2021-38611

A command-injection vulnerability in the Image Upload function of the NASCENT RemKon Device Manager 4.0.0.0 allows attackers to execute arbitrary commands, as root, via shell metacharacters in the filename parameter to assets/index.php...

CVE-2021-38611

A command-injection vulnerability in the Image Upload function of the NASCENT RemKon Device Manager 4.0.0.0 allows attackers to execute arbitrary commands, as root, via shell metacharacters in the filename parameter to assets/index.php...

PT-2021-22027 · Lg · Lg N1T1 Network Attached Storage

Name of the Vulnerable Software and Affected Versions: LG N1T1 Network Attached Storage affected versions not specified Description: The issue allows an unauthenticated attacker to gain root access via OS command injection in the destServer parameter of the...

NASCENT RemKon Device Manager 命令注入漏洞

NASCENT RemKon Device Manager is a NASCENT web application that is deployed in logistics centers as a single management platform for managing various settings and configurations for Automatic Gate Systems AGS and other Nascent products. A security vulnerability in NASCENT RemKon Device Manager...