PT-2021-16727 · Avaya · Avaya Aura Utility Services

Name of the Vulnerable Software and Affected Versions: Avaya Aura Utility Services versions 7.x Description: An information disclosure issue was found in the directory and file management of Avaya Aura Utility Services. This issue may allow any local user to access system functionality and...

PT-2021-16728 · Avaya · Avaya Aura Utility Services

Name of the Vulnerable Software and Affected Versions: Avaya Aura Utility Services versions 7.x Description: A privilege escalation issue was discovered in Avaya Aura Utility Services, potentially allowing a local user to execute specially crafted scripts as a privileged user. Recommendations: Fo...

Avaya Aura Utility Services 安全漏洞

Avaya Aura Utility Services is a group of tools and applications that support enterprise IP telephony from Avaya USA. A security vulnerability exists in Avaya Aura Utility Services that allows local users to escalate privileges. It affects all 7.x versions...

Pakistan-linked hackers targeted Indian power company with ReverseRat

A threat actor with suspected ties to Pakistan has been striking government and energy organizations in the South and Central Asia regions to deploy a remote access trojan on compromised Windows systems, according to new research. "Most of the organizations that exhibited signs of compromise were...

Utilities ‘Concerningly’ at Risk from Active Exploits

The amount of time that utility networks spend exposed to a known application exploit has spiked over the past two months — something analysts called out as a “concerning datapoint,” and an important reminder that ransomware isn’t the only threat utility networks need to secure against. A new...

elFinder Archive Command Injection

elFinder versions below 2.1.59 are vulnerable to a command injection vulnerability via its archive functionality. When creating a new zip archive, the name parameter is sanitized with the escapeshellarg php function and then passed to the zip utility. Despite the sanitization, supplying the -TmTT...

Irzip Reuse After Release Vulnerability

Irzip is a compression utility that excels at compressing large files. A post-release reuse vulnerability exists in the lzmadecompressbuf function in stream.c in Irzip version 0.631, which can be exploited by an attacker to cause a denial of service via specially crafted compressed files...

Circutor SGE-PLC1000 OS Command Injection Vulnerability

Circutor SGE-PLC1000 is a smart metering system device. The primary function is to manage utility power through CIRWATT meters or other meters with PRIME technology.An operating system command injection vulnerability exists in firmware version 0.9.2b of the Circutor SGE-PLC1000, which can be...

Circutor SGE-PLC1000 Licensing Issue Vulnerability

Circutor SGE-PLC1000 is a smart metering system device. The main function is to manage utility power through CIRWATT meters or other meters with PRIME technology.An authorization issue vulnerability exists in Circutor SGE-PLC1000 firmware version 0.9.2b, which can be exploited by attackers to pas...

CVE-2021-23024

On version 8.0.x before 8.0.0.1, and all 6.x and 7.x versions, the BIG-IQ Configuration utility has an authenticated remote command execution vulnerability in undisclosed pages. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

Design/Logic Flaw

On version 8.0.x before 8.0.0.1, and all 6.x and 7.x versions, the BIG-IQ Configuration utility has an authenticated remote command execution vulnerability in undisclosed pages. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2021-23024

On version 8.0.x before 8.0.0.1, and all 6.x and 7.x versions, the BIG-IQ Configuration utility has an authenticated remote command execution vulnerability in undisclosed pages. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2021-23024

The CVE-2021-23024 issue affects F5 BIG-IQ Centralized Management, specifically the BIG-IQ Configuration utility. Affected versions include BIG-IQ 8.x before 8.0.0.1 and all 6.x/7.x lines. The root cause is command injection via the configuration utility due to undisclosed/poor input handling, en...

Xxe

SilverStripe through 4.6.0-rc1 has an XXE Vulnerability in CSSContentParser. A developer utility meant for parsing HTML within unit tests can be vulnerable to XML External Entity XXE attacks. When this developer utility is misused for purposes involving external or user submitted data in custom...

[SECURITY] Fedora 34 Update: transfig-3.2.8a-2.fc34

The transfig utility creates a makefile which translates FIG created by xfig or PIC figures into a specified LaTeX graphics language for example, PostScriptTM. Transfig is used to create TeX documents which are portable i.e., they can be printed in a wide variety of environments. Install transfig...

F5 BIG-IQ Command Injection Vulnerability

F5 BIG-IQ is a software-based cloud management solution from F5 USA. The solution supports the deployment of application delivery and network services across public and private clouds, traditional data centers and hybrid environments. BIG-IQ Centralized Management suffers from a command injection...

F5 BIG-IQ 命令注入漏洞

F5 BIG-IQ is a software-based cloud management solution from F5 USA. The solution supports the deployment of application delivery and network services across public and private clouds, traditional data centers and hybrid environments. BIG-IQ Centralized Management suffers from a command injection...

Vulnerability fixed in F5 BIG-IQ Centralized Management

F5 has fixed a vulnerability in BIG-IQ Centralized Management. An authenticated remote malicious party could potentially exploit the vulnerability potentially exploit it to execute arbitrary code under root privileges. The vulnerability is located in the BIG-IQ Configuration utility. Successful...

Important: Red Hat Security Advisory: glib2 security update

An update for glib2 is now available for Red Hat Enterprise Linux 7.4 Advanced Update Support, Red Hat Enterprise Linux 7.4 Telco Extended Update Support, and Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact...

Important: glib2 security and bug fix update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fixes: glib: integer overflow in...