CVE-2021-27402

The SAS Admin portal of Mitel MiCollab before 9.2 FP2 could allow an unauthenticated attacker to access view and modify user data by injecting arbitrary directory paths due to improper URL validation, aka Directory Traversal...

CVE-2021-27402

The SAS Admin portal of Mitel MiCollab before 9.2 FP2 could allow an unauthenticated attacker to access view and modify user data by injecting arbitrary directory paths due to improper URL validation, aka Directory Traversal...

Directory traversal

The SAS Admin portal of Mitel MiCollab before 9.2 FP2 could allow an unauthenticated attacker to access view and modify user data by injecting arbitrary directory paths due to improper URL validation, aka Directory Traversal...

CVE-2021-27402

The SAS Admin portal of Mitel MiCollab before 9.2 FP2 could allow an unauthenticated attacker to access view and modify user data by injecting arbitrary directory paths due to improper URL validation, aka Directory Traversal...

CVE-2021-27402

Mitel MiCollab’s SAS Admin portal before 9.2 FP2 is affected by a directory traversal vulnerability allowing an unauthenticated attacker to view and modify user data through improper URL validation. Affected: MiCollab versions prior to 9.2 FP2. Root cause: improper validation enabling arbitrary d...

Weak password vulnerability in SAS security audit system

SAS Security Audit System is a fortress developed by Green Alliance Technology. SAS Security Audit System has a weak password vulnerability that can be exploited by attackers to obtain sensitive information...

SAS Environment Manager 2.5 Cross Site Scripting

Exploit Title: SAS Environment Manager 2.5 - 'name' Stored Cross-Site Scripting XSS Date: 24/06/2021 Exploit Author: Luqman Hakim Zahari @ Saitamang Vendor Homepage: https://support.sas.com/en/software/environment-manager-support.html Version: 2.5 Tested on: CentOS 7 CVE : CVE-2021-35475...

SAS Environment Manager 2.5 - 'name' Stored Cross-Site Scripting (XSS)

Exploit Title: SAS Environment Manager 2.5 - 'name' Stored Cross-Site Scripting XSS Date: 24/06/2021 Exploit Author: Luqman Hakim Zahari @ Saitamang Vendor Homepage: https://support.sas.com/en/software/environment-manager-support.html Version: 2.5 Tested on: CentOS 7 CVE : CVE-2021-35475...

SAS Environment Manager 2.5 - (name) Stored Cross-Site Scripting Vulnerability

Exploit Title: SAS Environment Manager 2.5 - 'name' Stored Cross-Site Scripting XSS Exploit Author: Luqman Hakim Zahari @ Saitamang Vendor Homepage: https://support.sas.com/en/software/environment-manager-support.html Version: 2.5 Tested on: CentOS 7 CVE : CVE-2021-35475 Description SAS®...

CVE-2021-35475

SAS Environment Manager 2.5 allows XSS through the Name field when creating/editing a server. The XSS will prompt when editing the Configuration Properties...

CVE-2021-35475

SAS Environment Manager 2.5 allows XSS through the Name field when creating/editing a server. The XSS will prompt when editing the Configuration Properties...

Cross site scripting

SAS Environment Manager 2.5 allows XSS through the Name field when creating/editing a server. The XSS will prompt when editing the Configuration Properties...

CVE-2021-35475

CVE-2021-35475 : SAS Environment Manager 2.5 is affected by a stored XSS via the Name field when creating or editing a server. The vulnerability arises from insufficient sanitization of the Name field, allowing injected scripts to execute, with the XSS trigger visible when editing Configuration P...

CVE-2021-35475

SAS Environment Manager 2.5 allows XSS through the Name field when creating/editing a server. The XSS will prompt when editing the Configuration Properties...

SAS Environment Manager 跨站脚本漏洞

SAS Environment Manager is a web-based management solution for SAS environments from SAS, Inc. A security vulnerability exists in SAS Environment Manager that stems from SAS Environment Manager 2.5 allowing XSS to pass through the Name field when creating an edit server. An attacker could exploit...

SUSE: Security Advisory (SUSE-SU-2021:1244-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

USN-4467-2 qemu vulnerabilities

USN-4467-1 fixed several vulnerabilities in QEMU. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: It was discovered that the QEMU SD memory card implementation incorrectly handled certain memory operations. An attacker inside a guest could possibly u...

kernel: race condition in smp_task_timedout() and smp_task_done() in drivers/scsi/libsas/sas_expander.c leads to use-after-free

A flaw was found in the Linux kernel’s implementation of the SAS expander subsystem, where a race condition exists in the smptasktimedout and smptaskdone in drivers/scsi/libsas/sasexpander.c. An attacker could abuse this flaw to corrupt memory and escalate privileges...

kernel: race condition in smp_task_timedout() and smp_task_done() in drivers/scsi/libsas/sas_expander.c leads to use-after-free

A flaw was found in the Linux kernel’s implementation of the SAS expander subsystem, where a race condition exists in the smptasktimedout and smptaskdone in drivers/scsi/libsas/sasexpander.c. An attacker could abuse this flaw to corrupt memory and escalate privileges...