4042 matches found
Cross-Site Request Forgery (CSRF) in patrowl/patrowlmanager
Description Hi there, there is a CSRF in duplicating rule due to the usage of GET method. Proof of Concept 1. Install a local instance of PatrowlManager 2. Go to list rule and create a new rule 3. Access this link http://localhost:8083/rules/api/v1/alerting/duplicate/1 and see that the rule is...
CVE-2021-20042
An unauthenticated remote attacker can use SMA 100 as an unintended proxy or intermediary undetectable proxy to bypass firewall rules. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances...
CVE-2021-43043
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The apache user could read arbitrary files such as /etc/shadow by abusing an insecure Sudo rule...
CVE-2021-43043
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The apache user could read arbitrary files such as /etc/shadow by abusing an insecure Sudo rule...
CVE-2021-43043
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The apache user could read arbitrary files such as /etc/shadow by abusing an insecure Sudo rule...
Design/Logic Flaw
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The apache user could read arbitrary files such as /etc/shadow by abusing an insecure Sudo rule...
CVE-2021-43043: Undefined Security Weakness
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The apache user could read arbitrary files such as /etc/shadow by abusing an insecure Sudo rule...
CVE-2021-43043
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The apache user could read arbitrary files such as /etc/shadow by abusing an insecure Sudo rule...
PT-2021-23732 · Kaseya +1 · Kaseya Unitrends Backup Appliance +1
Name of the Vulnerable Software and Affected Versions: Kaseya Unitrends Backup Appliance versions prior to 10.5.5 Description: An issue was discovered in the software where the apache user could read arbitrary files, such as /etc/shadow, by abusing an insecure Sudo rule. Recommendations: For...
Cisco Adaptive Security Appliance IDFW Rule Processing Buffer Overflow
The vulnerability of the IDFW rule processing function in Cisco Adaptive Security Appliance ASA and Cisco Firepower Threat Defense FTD software relates to deficiencies in access control lists ACLs. Exploiting this vulnerability allows a malicious actor to circumvent security restrictions by sendi...
Oracle Linux 8 : spamassassin (ELSA-2021-4315)
The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2021-4315 advisory. 3.4.4-4.el4 - Fix header parsing Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has no...
PT-2021-10647
Name of the Vulnerable Software and Affected Versions: Ruijie RG-UAC 6000-E50 version 9071227 Description: The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload, exploiting a cross-site scripting XSS vulnerability. This is achieved through the rule name...
Clash - A Rule-Based Tunnel In Go
A rule-based tunnel in Go. Features Local HTTP/HTTPS/SOCKS server with authentication support VMess, Shadowsocks, Trojan, Snell protocol support for remote connections Built-in DNS server that aims to minimize DNS pollution attack impact, supports DoH/DoT upstream and fake IP. Rules based off...
Top 10 Cybersecurity Best Practices to Combat Ransomware
If you’re like most IT professionals, the threat of a ransomware attack might keep you up at night. And you have a valid reason to worry — ransomware doesn’t discriminate. Organizations across every industry, public or private, are potential victims, if they haven’t been victims already. In fact,...
Over 1 Million Sites Impacted by Vulnerability in Starter Templates Plugin
On October 4, 2021, the Wordfence Threat Intelligence team initiated the responsible disclosure process for the Starter Templates plugin, which is installed on over 1 Million WordPress websites. The full name of the WordPress plugin is “Starter Templates — Elementor, Gutenberg & Beaver Builder...
RHEL 8 : spamassassin (RHSA-2021:4315)
The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2021:4315 advisory. The SpamAssassin tool provides a way to reduce unsolicited commercial email spam from incoming email. Security Fixes: spamassassin: Malicious rule...
Update to GLBA Security Requirements for Financial Institutions
Heads up financial institutions: the Federal Trade Commission FTC announced the first cybersecurity updates to the Gramm Leach-Bliley Act GLBA Safeguards Rule since 2003. The new rule strengthens the required security safeguards for customer information. This includes formal risk assessments,...
spamassassin: Malicious rule configuration files can be configured to run system commands
A flaw was found in spamassassin. Malicious rule configuration .cf files can be configured to run system commands without any output or errors allowing exploits to be injected in a number of scenarios. The highest threat from this vulnerability is to data confidentiality and integrity as well as...
ALSA-2021:4315 Moderate: spamassassin security update
The SpamAssassin tool provides a way to reduce unsolicited commercial email spam from incoming email. Security Fixes: spamassassin: Malicious rule configuration files can be configured to run system commands CVE-2020-1946 For more details about the security issues, including the impact, a CVSS...