1983 matches found
Cisco TelePresence Collaboration Endpoint and RoomOS Software Command Injection Vulnerability
A vulnerability in the software upgrade process of Cisco TelePresence Collaboration Endpoint Software and Cisco RoomOS Software could allow an authenticated, remote attacker to modify the filesystem to cause a denial of service DoS or gain privileged access to the root filesystem. The vulnerabili...
PT-2020-2735
Name of the Vulnerable Software and Affected Versions Video Insight VMS versions prior to 7.6.1 Description The issue is caused by insufficient validation of user-provided data, allowing a remote attacker to execute arbitrary code by sending a specially crafted malicious request. This can lead to...
CVE-2020-11972
Apache Camel RabbitMQ enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0...
PT-2020-4637 · Apache · Apache Camel
Name of the Vulnerable Software and Affected Versions: Apache Camel versions 2.22.x through 2.25.0 Apache Camel versions 3.0.0 through 3.1.0 Description: The issue is related to Java deserialization being enabled by default in Apache Camel Netty. This can allow a remote attacker to gain...
PAN-OS: Nginx software upgraded to resolve multiple vulnerabilities
Nginx software included with PAN-OS has been upgraded to resolve multiple vulnerabilities. This issue affects: All PAN-OS 7.1 and 8.0 versions; PAN-OS 8.1 versions earlier than 8.1.14; PAN-OS 9.0 versions earlier than 9.0.7. The resolved vulnerabilities include: Work around: Issues that affect th...
Authentication flaw
On Juniper Networks EX and QFX Series, an authentication bypass vulnerability may allow a user connected to the console port to login as root without any password. This issue might only occur in certain scenarios: • At the first reboot after performing device factory reset using the command...
Prototype Pollution
Overview Versions of @hapi/subtext prior to 6.1.3 or 7.0.3 are vulnerable to Prototype Pollution. A multipart payload can be constructed in a way that one of the parts’ content can be set as the entire payload object’s prototype. If this prototype contains data, it may bypass other validation rul...
CVE-2020-1931
A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious Configuration .cf files can be configured to run system commands similar to CVE-2018-11805. This issue is less stealthy and attempts to exploit the issue will throw warnings. Thanks to Damian...
UBUNTU-CVE-2018-11805
In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA 3.4.3, we recommend that users should only use update channels or 3rd party ....
Movable Type vulnerable to open redirect
Overview Movable Type provided by Six Apart Ltd. contains an open redirect vulnerability CWE-601. Hidetomo Hosono of EG Secure Solutions Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact When accessing a...
PT-2021-5416
Name of the Vulnerable Software and Affected Versions roundcube versions prior to 1.3.17 roundcube versions 1.4.x prior to 1.4.12 Description The issue is related to roundcube, a skinnable AJAX based webmail solution for IMAP servers, which did not properly sanitize requests and mail messages. Th...
systemd CVE-2018-21029 Certificate Validation Security Bypass Vulnerability
Description systemd is prone to a security-bypass vulnerability. An attacker can exploit this issue to perform man-in-the-middle attacks and perform certain unauthorized actions, which will aid in further attacks. systemd versions 239 through 243 are vulnerable. Technologies Affected systemd...
Notice of Status Change Announcement for Version 12.1 of the Citrix ADM
Citrix Systems, Inc. announces an update to End of Maintenance and End of Life dates for version 12.1 of the Citrix Application Delivery Management formerly referred to as NetScaler Management & Analytics System Citrix Application Delivery Management ADM product lifecycle model will change from 3...
Authentication Bypass
Overview Versions of saml2-js prior to 2.0.5 are vulnerable to an Authentication Bypass. The package fails to enforce the assertion conditions for encrypted assertions, which may allow an attacker to reuse encrypted assertion tokens indefinitely. Recommendation Upgrade to version 2.0.5 or later...
vBulletin remote command execution via the widgetConfig[code] parameter
Added: 09/27/2019 Background vBulletin is a commercial web bulletin board application written in PHP using MySQL. Problem vBulletin allows remote command execution via the widgetConfigcode parameter in an ajax/render/widgetphp routestring request. Resolution Upgrade vBulletin to version higher th...
Path Traversal in algo-httpserv
Versions of algo-httpserv prior to 1.1.2 are vulnerable to Path Traversal. Due to insufficient input sanitization, attackers can access server files by using relative paths. Recommendation Upgrade to version 1.1.2 or later...
GHSA-JP6R-XCJJ-5H7R Cross-Site Scripting in cyberchef
Versions of cyberchef prior to 8.31.3 are vulnerable to Cross-Site Scripting. In Text Encoding Brute Force the table rows are created by concatenating the value variable unsanitized in the HTML code. If this variable is controlled by user input it allows attackers to execute arbitrary JavaScript ...
PT-2019-12022 · Npm +4 · Mixin-Deep +4
Name of the Vulnerable Software and Affected Versions: mixin-deep versions prior to 1.3.2 mixin-deep versions prior to 2.0.1 Description: The issue concerns Prototype Pollution, where the mixin-deep function can be tricked into adding or modifying properties of Object.prototype using a constructo...
Error Code 42B when using Citrix Gateway Native OTP authentication in Citrix Workspace app for Android upgrade
This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company's Help Desk/IT support team and can refer to CTX297149 for more information. The following error message appears even after upgrading to the latest version of Citrix Workspace...