CVE-2021-28193 ASUS BMC's firmware: buffer overflow - SMTP configuration function

The SMTP configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service...

CVE-2021-28189 ASUS BMC's firmware: buffer overflow - SMTP configuration function

The SMTP configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service...

CVE-2021-28189

The CVE-2021-28189 entry describes a buffer overflow in the SMTP configuration function of ASUS BMC’s firmware Web management page caused by unvalidated string length. This is a Web service impact vulnerability leading to abnormal termination via remote access. Connected sources (CNVD/CNNVD/NVD) ...

CVE-2021-28189

The SMTP configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service...

CVE-2021-28193

The SMTP configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service...

PT-2021-17805

Name of the Vulnerable Software and Affected Versions: ASUS BMC firmware affected versions not specified Description: The issue arises from the SMTP configuration function in the firmware's Web management page, which fails to verify the string length entered by users. This oversight results in a...

PT-2021-17809

Name of the Vulnerable Software and Affected Versions: ASUS BMC affected versions not specified Description: The issue arises from the SMTP configuration function in the firmware's Web management page, which fails to verify the string length entered by users. This oversight leads to a buffer...

ASUS BMC Firmware 安全特征问题漏洞

ASUS BMC Firmware is a firmware from Asus China. A security signature issue vulnerability exists in the ASUS BMC firmware Web management page, which originates from a buffer overflow vulnerability due to the SMTP configuration function not validating the length of a string entered by the user. A...

CVE-2021-28193: Buffer Copy without Checking Size of Input

The SMTP configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service...

CVE-2021-28189: Buffer Copy without Checking Size of Input

The SMTP configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service...

CVE-2020-27986

SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the api/settings/values URI. NOTE: reportedly, the vendor's position for SMTP and SVN is "it is the administrator's responsibility to configure it...

Rockwell Automation CompactLogix 5370 Buffer Overflow Denial of Service (CVE-2019-10954)

A denial of service vulnerability exists in Rockwell Automation CompactLogix 5370 PLCs. A remote, unauthenticated attacker could send crafted SMTP configuration packets to cause denial of service conditions...

Design/Logic Flaw

The administration SMTP configuration resource in Atlassian Crowd before version 2.10.2 allows remote attackers with administration rights to execute arbitrary code via a JNDI injection...

CVE-2017-18108

The administration SMTP configuration resource in Atlassian Crowd before version 2.10.2 allows remote attackers with administration rights to execute arbitrary code via a JNDI injection...

PT-2019-8257

Name of the Vulnerable Software and Affected Versions Atlassian Crowd versions prior to 2.10.2 Description The issue allows remote attackers with administration rights to execute arbitrary code via a JNDI injection in the administration SMTP configuration resource. Recommendations For versions...

CVE-2017-18108: Improper Control of Generation of Code

The administration SMTP configuration resource in Atlassian Crowd before version 2.10.2 allows remote attackers with administration rights to execute arbitrary code via a JNDI injection...

CVE-2019-6242: Insufficiently Protected Credentials

Kentico v10.0.42 allows Global Administrators to read the cleartext SMTP Password by navigating to the SMTP configuration page. NOTE: the vendor considers this a best-practice violation but not a vulnerability. The vendor plans to fix it at a future time...

PT-2019-18047 · Kentico · Kentico

Name of the Vulnerable Software and Affected Versions: Kentico version 10.0.42 Description: The issue allows Global Administrators to read the cleartext SMTP Password by navigating to the SMTP configuration page. The vendor considers this a best-practice violation but not a vulnerability. The...

DejaVU - Open Source Deception Framework

Deception techniques if deployed well can be very effective for organizations to improve network defense and can be a useful arsenal for blue teams to detect attacks at very early stage of cyber kill chain. But the challenge we have seen is deploying, managing and administering decoys across larg...

Foscam C1 Indoor HD Camera cgiproxy.fcgi SMTP Parameter Configuration Command Injection Vulnerability

Foscam C1 Indoor HD Camera is a wireless HD IP camera from Foscam China. A security vulnerability exists in the Foscam C1 Indoor HD Camera using application firmware version 2.52.2.37. An attacker can exploit the vulnerability by sending a specially crafted HTTP request to inject arbitrary data...