Panasonic Video Insight VMS vulnerable to arbitrary code execution

Overview Video Insight VMS provided by Panasonic Corporation contains an arbitrary code execution vulnerability CWE-94 because unencrypted communication exists in the communication using non-well known ports. Panasonic Corporation reported this vulnerability to JPCERT/CC to notify users of its...

JVN#42252698: Panasonic Video Insight VMS vulnerable to arbitrary code execution

Video Insight VMS provided by Panasonic Corporation contains an arbitrary code execution vulnerability CWE-94 because unencrypted communication exists in the communication using non-well known ports. Impact By sending a specially crafted request to the vulnerable product, a remoto attacker may...

SUSE-SU-2021:0297-1 Security update for openvswitch

This update for openvswitch fixes the following issues: - openvswitch was updated to 2.8.10 - CVE-2020-27827: Fixed a memory leak when parsing lldp packets bsc1181345 A lot more minor bugs have been fixed with this openvswitch version. Please refer to the changelog of the openvswitch.rpm file in...

Cisco IOS XR Software for Cisco 8000 Series Routers and Network Convergence System 540 Series Routers Privilege Escalation Vulnerability

A vulnerability in a CLI command of Cisco IOS XR Software for the Cisco 8000 Series Routers and Network Convergence System 540 Series Routers running NCS540L software images could allow an authenticated, local attacker to elevate their privilege to root. To exploit this vulnerability, an attacker...

Cisco Webex Meetings and Cisco Webex Meetings Server Software Hyperlink Injection Vulnerability

A vulnerability in the user interface of Cisco Webex Meetings and Cisco Webex Meetings Server Software could allow an authenticated, remote attacker to inject a hyperlink into a meeting invitation email. The vulnerability is due to insufficient input validation. An attacker could exploit this...

Cisco IOS XR Software IPv6 Flood Denial of Service Vulnerability

A vulnerability in the IPv6 protocol handling of the management interfaces of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause an IPv6 flood on the management interface network of an affected device. The vulnerability exists because the software incorrectly forward...

Cisco Unified Computing System Central Software Improper Certificate Validation Vulnerability

A vulnerability in the certificate registration process of Cisco Unified Computing System UCS Central Software could allow an authenticated, adjacent attacker to register a rogue Cisco Unified Computing System Manager UCSM. This vulnerability is due to improper certificate validation. An attacker...

PT-2021-11105 · Qnap Systems · Qnap Helpdesk

Name of the Vulnerable Software and Affected Versions: QNAP Systems Inc. Helpdesk versions prior to 3.0.3 Description: The issue is related to improper access control, which could allow attackers to compromise the security of the software by gaining privileges or reading sensitive information. If...

PT-2021-1915 · Cisco · Cisco Nx-Os +2

Name of the Vulnerable Software and Affected Versions: Cisco IOS XR Software affected versions not specified Cisco NX-OS Software affected versions not specified Description: A vulnerability in the IPv6 traffic processing of Cisco IOS XR Software and Cisco NX-OS Software for certain Cisco devices...

SUSE-SU-2021:0277-1 Security update for openvswitch

This update for openvswitch fixes the following issues: - openvswitch was updated to 2.11.5 - CVE-2020-27827: Fixed a memory leak when parsing lldp packets bsc1181345...

DLA-2542-1 tzdata - new upstream version

Bulletin has no description...

KLA12104 Multiple vulnerabilities in Apache Tomcat

Multiple vulnerabilities were found in Apache Tomcat. Malicious users can exploit these vulnerabilities to execute arbitrary code, obtain sensitive information. Below is a complete list of vulnerabilities: 1. A security vulnerability can be exploited remotely via special crafted file to execute...

OPENSUSE-SU-2021:0192-1 Security update for go1.15

This update for go1.15 fixes the following issues: Go was updated to version 1.15.7 bsc1175132. Security issues fixed: - CVE-2021-3114: Fixed incorrect operations on the P-224 curve in crypto/elliptic bsc1181145. - CVE-2021-3115: Fixed a potential arbitrary code execution in the build process...

PT-2021-3513 · Autodesk · Autodesk Design Review

Name of the Vulnerable Software and Affected Versions: Autodesk Design Review versions 2011 through 2018 Description: A Type Confusion issue occurs when processing a maliciously crafted PDF file, allowing a malicious actor to execute arbitrary code. The vulnerability is related to errors in data...

OPENSUSE-SU-2021:0186-1 Security update for chromium

This update for chromium fixes the following issues: chromium was updated to 88.0.4324.96 boo1181137 - CVE-2021-21117: Insufficient policy enforcement in Cryptohome - CVE-2021-21118: Insufficient data validation in V8 - CVE-2021-21119: Use after free in Media - CVE-2021-21120: Use after free in...

International Action Targets Emotet Crimeware

Authorities across Europe on Tuesday said theyd seized control over Emotet, a prolific malware strain and cybercrime-as-service operation. Investigators say the action could help quarantine more than a million Microsoft Windows systems currently compromised with malware tied to Emotet infections...

Security Advisory - Buffer Overflow Vulnerability in Some Huawei Mobile Phones

Some Huawei products have a buffer overflow vulnerability. After obtaining the root permission, an attacker can exploit the vulnerability to cause buffer overflow. Vulnerability ID: HWPSIRT-2020-43452 This vulnerability has been assigned a Common Vulnerabilities and Exposures CVE ID:...

Vulnerability fixed in Apple XCode

Apple has fixed a vulnerability in XCode. A malicious could potentially exploit the vulnerability to gain access to arbitrary files and thus sensitive data. The malicious party must entice the victim to install a malicious application. -= Apple =- Apple has made updates available for XCode to fix...

JVN#41853173: OS command injection vulnerability in multiple Infoscience Corporation log management tools

Infoscience Corporation's multiple log management tools provide an FTP upload function as one of the log collection methods, and is able to set to allow the adminitrators to accept FTP uploads. In a situation where the FTP upload function is enabled and there is a flaw of input value handling in...

Security Advisory - Buffer Overflow Vulnerability in Huawei Smartphone

There is a buffer overflow vulnerability in Huawei smartphone. A module does not verify the some input when dealing with messages. Attackers can exploit this vulnerability by sending malicious input through specific module. This could cause buffer overflow, compromising normal service...