Input validation

A CWE-20: Improper Input Validation vulnerability exists that could allow arbitrary files on the server to be read by authenticated users through a limited operating system service account. Affected Product: EcoStruxure Power Monitoring Expert Versions 2020 and prior...

CVE-2022-22726

A CWE-20: Improper Input Validation vulnerability exists that could allow arbitrary files on the server to be read by authenticated users through a limited operating system service account. Affected Product: EcoStruxure Power Monitoring Expert Versions 2020 and prior...

MoonBounce: New malware deployed by APT41 in UEFI firmware

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here. MoonBounce is a new type of malware that hides in the most complex part of an Operating System OS, the Basic Input Output System BIOS chip, and thus persists even after reinstalling your OS or formatting your hard drive...

In Keepalived through 2.2.4 the D-Bus policy does not sufficiently restrict the message destination allowing any user to inspect and manipulate any property. This leads to access-control bypass in some situations in which an unrelated D-Bus system service has a settable (writable) property

...

AZL-6508 CVE-2021-44225 affecting package keepalived for versions less than 2.2.7-1

In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user to inspect and manipulate any property. This leads to access-control bypass in some situations in which an unrelated D-Bus system service has a settable writable property...

UBUNTU-CVE-2021-44225

In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user to inspect and manipulate any property. This leads to access-control bypass in some situations in which an unrelated D-Bus system service has a settable writable property...

AUVESY Versiondog Input Validation Error Vulnerability

AUVESY Versiondog, an automated production data and change management software solution from AUVESY Germany, is vulnerable to an input validation error that stems from the fact that the affected product's operating system service does not validate any given parameter, which could be exploited by ...

MB connect line mbDIALUP 输入验证错误漏洞

MB connect line mbDIALUP is an application from MB connect line. Developed by MB Connect Line GmbH for use by a Software Informer user. An input validation error vulnerability exists in MB connect line mbDIALUP, which originates in MB connect line mbDIALUP version = 3.9R0.0, and can be exploited ...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Tivoli Netcool System Service Monitors/Application Service Monitors

Summary There is a security advisory for openSSL1.1.1g which is used by IBM Tivoli Netcool System Service Monitors/Application Service Monitors 4.0.1 Vulnerability Details CVEID: CVE-2021-3449 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference in...

Polkit D-Bus Authentication Bypass

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'unixcrypt' class MetasploitModule 'Polkit D-Bus Authentication Bypass', 'Description' = %q A vulnerability exists within the polkit system service that can be...

Huawei EulerOS: Security Advisory for dbus (EulerOS-SA-2021-2133)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-25655 URL redirection to untrusted site possible in Avaya Aura Experience Portal

A vulnerability in the system Service Menu component of Avaya Aura Experience Portal may allow URL Redirection to any untrusted site through a crafted attack. Affected versions include 7.0 through 7.2.3 without hotfix and 8.0.0 without hotfix...

SUSE: Security Advisory (SUSE-SU-2018:4128-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Netop Vision Pro - Distance Learning Software is 20/20 in Hindsight

ARCHIVED STORY Netop Vision Pro – Distance Learning Software is 20/20 in Hindsight By Sam Quinn · MAR 21, 2021 · 27 MIN READ The McAfee Labs Advanced Threat Research team is committed to uncovering security issues in both software and hardware to help developers provide safer products for...

HarmonyOS Privilege Bypass Vulnerability

HarmonyOS is a distributed operating system for all scenarios developed by Huawei, a Chinese company. A privilege bypass vulnerability exists in a component API of HarmonyOS 2.0. A local attacker could exploit the vulnerability to repeatedly issue commands that could exhaust system service...

CVE-2021-22294

A component API of the HarmonyOS 2.0 has a permission bypass vulnerability. Local attackers may exploit this vulnerability to issue commands repeatedly, exhausting system service resources...

CVE-2021-22294

HarmonyOS 2.0 contains a component API permission bypass vulnerability that allows a local attacker to issue commands repeatedly, exhausting system service resources. Affected element: HarmonyOS 2.0 component API. Impact: potential resource exhaustion on local access. Root cause described as a pe...

The vulnerability of Intel Graphics Driver drivers, related to insufficient validation of input data, allows a hacker to trigger a service failure.

The vulnerability of Intel Graphics Drivers’ drivers is related to insufficient validation of input data. Exploiting this vulnerability can allow attackers to cause system failures...

Phoenix Contact PLCnext Control Devices Input Validation Error Vulnerability

Phoenix Contact PLCnext Control Devices is a programmable logic controller for industrial environments from Phoenix Contact. An input validation error vulnerability exists in Phoenix Contact PLCnext Control Devices prior to version 2021.0 LTS, which stems from a specially designed LLDP packet tha...

Null pointer dereference

An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9.0, and 10 software. System services may crash because of the lack of a NULL parameter check. The LG ID is LVE-SMP-200024 November 2020...