Code injection

IBM Cognos Analytics 11.0 and 11.1 DQM API allows submitting of all control requests in unauthenticated sessions. This allows a remote attacker who can access a valid CA endpoint to read and write files to the Cognos Analytics system. IBM X-Force ID: 183903...

Free "vCISO Clinic" offers Resource-Constrained InfoSec Leaders a Helping Hand

Leaders in the InfoSec field face a strange dilemma. On the one hand, there are hundreds of thousands of resources available to find online to read or watch if they have questions – that's a benefit of a digital-first field. On the other hand, most leaders face challenges that – while not entirel...

Design/Logic Flaw

In Kibana versions before 7.12.0 and 6.8.15 a flaw in the session timeout was discovered where the xpack.security.session.idleTimeout setting is not being respected. This was caused by background polling activities unintentionally extending authenticated users sessions, preventing a user session...

CVE-2021-22136

In Kibana versions before 7.12.0 and 6.8.15 a flaw in the session timeout was discovered where the xpack.security.session.idleTimeout setting is not being respected. This was caused by background polling activities unintentionally extending authenticated users sessions, preventing a user session...

Strapi 授权问题漏洞

Strapi is an open source headless content management system CMS. A security vulnerability exists in Strapi version 3.6.0 and prior versions that allows an attacker who gains valid session access to take over an account by changing the password...

CVE-2020-23128

CVE-2020-23128 affects Chamilo LMS 1.11.10. The issue is improper privilege management: a user with Sessions administrator privileges can create a new user and then use the Edit User function to grant that user administrator privileges. The connected sources consistently describe this as a privil...

CVE-2020-7038

A vulnerability was discovered in Management component of Avaya Equinox Conferencing that could potentially allow an unauthenticated, remote attacker to gain access to screen sharing and whiteboard sessions. The affected versions of Management component of Avaya Equinox Conferencing include all 3...

Design/Logic Flaw

A vulnerability was discovered in Management component of Avaya Equinox Conferencing that could potentially allow an unauthenticated, remote attacker to gain access to screen sharing and whiteboard sessions. The affected versions of Management component of Avaya Equinox Conferencing include all 3...

CVE-2020-7038

Affected software: Avaya Equinox Conferencing, specifically the Management component of the 3.x series prior to 3.17. Vulnerability: Unauthenticated, remote access could allow an attacker to gain access to screen sharing and whiteboard sessions. This is described across multiple sources as a vuln...

CVE-2020-7038 Avaya Meetings Server Information Disclosure vulnerability

A vulnerability was discovered in Management component of Avaya Equinox Conferencing that could potentially allow an unauthenticated, remote attacker to gain access to screen sharing and whiteboard sessions. The affected versions of Management component of Avaya Equinox Conferencing include all 3...

IBM Content Navigator 跨站脚本漏洞

IBM Content Navigator is a Web client from IBM USA. The product supports searching and processing documents stored in content servers from a Web browser. A cross-site scripting vulnerability exists in IBM Content Navigator version 3.0.CD. An attacker can exploit the vulnerability to embed arbitra...

Metasploit Wrap-Up

Nagios modules Community member Erik Wynter has contributed two more Nagios XI modules this week, on top of the previous week’s contributions! If you’ve noticed Nagios XI 5.6.0 to 5.7.5 running within your target’s infrastructure during a pen test, be sure to check both these new modules out as...

CVE-2021-0216

A vulnerability in Juniper Networks Junos OS running on the ACX5448 and ACX710 platforms may cause BFD sessions to flap when a high rate of transit ARP packets are received. This, in turn, may impact routing protocols and network stability, leading to a Denial of Service DoS condition. When a hig...

Design/Logic Flaw

A vulnerability in Juniper Networks Junos OS running on the ACX5448 and ACX710 platforms may cause BFD sessions to flap when a high rate of transit ARP packets are received. This, in turn, may impact routing protocols and network stability, leading to a Denial of Service DoS condition. When a hig...

Input validation

An Improper Input Validation vulnerability in the active-lease query portion in JDHCPD's DHCP Relay Agent of Juniper Networks Junos OS allows an attacker to cause a Denial of Service DoS by sending a crafted DHCP packet to the device thereby crashing the jdhcpd DHCP service. This is typically...

CVE-2021-0216

CVE-2021-0216 affects Juniper Networks Junos OS on ACX5448 and ACX710. The issue is that a high rate of transit ARP packets can cause BFD sessions to flap, leading to potential routing instability and a DoS condition. Affected versions include Junos OS on ACX5448/ACX710 prior to specific fixed re...

CVE-2021-0216 Junos OS: ACX5448, ACX710: BFD sessions might flap due to high rate of transit ARP packets

A vulnerability in Juniper Networks Junos OS running on the ACX5448 and ACX710 platforms may cause BFD sessions to flap when a high rate of transit ARP packets are received. This, in turn, may impact routing protocols and network stability, leading to a Denial of Service DoS condition. When a hig...

RHEL 8 : kernel-rt (RHSA-2021:1279)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1279 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirement...

kernel: iscsi: unrestricted access to sessions and handles

A flaw was found in the way access to sessions and handles was handled in the iSCSI driver in the Linux kernel. A local user could use this flaw to leak iSCSI transport handle kernel address or end arbitrary iSCSI connections on the system...

kernel: iscsi: unrestricted access to sessions and handles

A flaw was found in the way access to sessions and handles was handled in the iSCSI driver in the Linux kernel. A local user could use this flaw to leak iSCSI transport handle kernel address or end arbitrary iSCSI connections on the system...