Cisco IOS XR Access Control Error Vulnerability (CNVD-2020-34297)

Cisco IOS XR is a set of operating systems developed by the American company Cisco Cisco for its network equipment. An access control error vulnerability exists in the ACL function of the alternate route processor management interface in Cisco IOS XR Software. A remote attacker could exploit this...

CVE-2020-14408

An issue was discovered in Agentejo Cockpit 0.10.2. Insufficient sanitization of the to parameter in the /auth/login route allows for injection of arbitrary JavaScript code into a web page's content, creating a Reflected XSS attack vector...

Cisco IOS XR Software Standby Route Processor Gigabit Ethernet Management Interface Access Control List Bypass Vulnerability

A vulnerability in the access control list ACL functionality of the standby route processor management interface of Cisco IOS XR Software could allow an unauthenticated, remote attacker to reach the configured IP addresses on the standby route processor management Gigabit Ethernet Management...

PlayStation: Reflected XSS on transact.playstation.com using postMessage from the opening window

Report Summary: When transact.playstation.com loads it handles messages received from postMessage in the receiveMessageFromTransactClientService method. The only validation that is performed is to ensure that the referrer and origin match: javascript receiveMessageFromTransactClientService:...

Weak Password Vulnerability in CMCC Tietong Yu Routing

CMCC Intelligent Products Branch is a branch of CMCC specializing in intelligent manufacturing, intelligent integration and intelligent operation. A weak password vulnerability exists in CMCC Tietong Yu Route, which can be exploited by attackers to log into the system backend...

CVE-2020-13597

Clusters using Calico version 3.14.0 and below, Calico Enterprise version 2.8.2 and below, may be vulnerable to information disclosure if IPv6 is enabled but unused. A compromised pod with sufficient privilege is able to reconfigure the node’s IPv6 interface due to the node accepting route...

Information disclosure

Clusters using Calico version 3.14.0 and below, Calico Enterprise version 2.8.2 and below, may be vulnerable to information disclosure if IPv6 is enabled but unused. A compromised pod with sufficient privilege is able to reconfigure the node’s IPv6 interface due to the node accepting route...

CVE-2020-13597 Calico nodes IPv6 traffic redirection from route advertisment

Clusters using Calico version 3.14.0 and below, Calico Enterprise version 2.8.2 and below, may be vulnerable to information disclosure if IPv6 is enabled but unused. A compromised pod with sufficient privilege is able to reconfigure the node’s IPv6 interface due to the node accepting route...

CVE-2019-2388

In affected Ops Manager versions there is an exposed http route was that may allow attackers to view a specific access log of a publicly exposed Ops Manager instance. This issue affects: MongoDB Inc. MongoDB Ops Manager 4.0 versions 4.0.9, 4.0.10 and MongoDB Ops Manager 4.1 version 4.1.5...

Design/Logic Flaw

In affected Ops Manager versions there is an exposed http route was that may allow attackers to view a specific access log of a publicly exposed Ops Manager instance. This issue affects: MongoDB Inc. MongoDB Ops Manager 4.0 versions 4.0.9, 4.0.10 and MongoDB Ops Manager 4.1 version 4.1.5...

CVE-2019-2388 Potential exposure of log information in Ops Manager

In affected Ops Manager versions there is an exposed http route was that may allow attackers to view a specific access log of a publicly exposed Ops Manager instance. This issue affects: MongoDB Inc. MongoDB Ops Manager 4.0 versions 4.0.9, 4.0.10 and MongoDB Ops Manager 4.1 version 4.1.5...

PT-2020-10890 · Mongodb · Mongodb Ops Manager

Name of the Vulnerable Software and Affected Versions: MongoDB Ops Manager versions 4.0.9 through 4.0.10 MongoDB Ops Manager version 4.1.5 Description: The issue affects MongoDB Ops Manager, where an exposed http route may allow attackers to view a specific access log of a publicly exposed Ops...

CVE-2020-10641

An unprotected logging route may allow an attacker to write endless log statements into the database without space limits or authentication. This results in consuming the entire available hard-disk space on the Ignition 8 Gateway versions prior to 8.0.10, causing a denial-of-service condition...

Race condition

An unprotected logging route may allow an attacker to write endless log statements into the database without space limits or authentication. This results in consuming the entire available hard-disk space on the Ignition 8 Gateway versions prior to 8.0.10, causing a denial-of-service condition...

CVE-2020-10641

The CVE-2020-10641 issue affects Ignition 8 Gateway (Perspective Module) prior to 8.0.10, where an unprotected logging route can write unlimited log statements to the database, consuming disk space and causing a denial-of-service. Root cause: improper access controls allowing unauthenticated, net...

Lock and Code S1Ep4: coronavirus and responding to computer viruses with Akshay Bhargava

This week on Lock and Code, we discuss the top security headlines generated right here on Labs and around the Internet. In addition, we talk to Akshay Bhargava, Chief Product Officer of Malwarebytes, about the similarities between coronavirus and computer viruses. We discuss computer virus...

Cisco IOS XR Software BGP EVPN Operational Routes DoS (cisco-sa-20200122-ios-xr-routes)

According to its self-reported version, Cisco IOS XR Software is affected by a denial of service DoS vulnerability in its Border Gateway Protocol BGP Ethernet VPN EVPN component due to insufficient validation of BGP updates messages which contain crafted EVPN attributes. An unauthenticated, remot...

Denial Of Service (DoS)

Quagga is a vulnerable to Denial Of Service DoS. A stack-based buffer overflow flaw was found in the way the Quagga bgpd daemon processed certain BGP Route Refresh RR messages. A configured BGP peer could send a specially-crafted BGP message, causing bgpd on a target system to crash or, possibly,...

CVE-2019-18802

A flaw was found in envoy. A malformed request header may cause route matchers or access controls to be bypassed, resulting in escalation of privileges or information disclosure. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

Open Redirect

getgrav/grav is vulnerable to open redirect. The vulnerability exists because the function redirect in Common/Grav.php does not validate the internal route parameter route and redirect to another location, allowing attackers to provide a malicious route to a location or file...