Oracle Solaris Critical Patch Update : oct2020_SRU11_4_24_75_2

This Solaris system is missing necessary patches to address critical security updates : - Vulnerability in the Oracle Solaris product of Oracle Systems component: Filesystem. The supported version that is affected is 11. Easily exploitable vulnerability allows low privileged attacker with logon t...

Taken - Takeover AWS Ips And Have A Working POC For Subdomain Takeover

Takeover AWS ips and have a working POC for Subdomain Takeover. Idea is simple Get subdomains. Do reverse lookups to only save AWS ips. Restart EC2 instance every min. and public ip gets rotated on each restart. Match it with your existing list of subdomain ips and you have a working subdomain...

Design/Logic Flaw

HttpUtilsgetURLConnection method disables explicitly hostname verification for HTTPS connections making clients vulnerable to man-in-the-middle attacks. Calcite uses internally this method to connect with Druid and Splunk so information leakage may happen when using the respective Calcite adapter...

CVE-2020-13955

CVE-2020-13955 affects Apache Calcite: HttpUtils#getURLConnection disables hostname verification for HTTPS, enabling potential MITM attacks and information leakage when Calcite adapters connect to Druid or Splunk. The issue originates from a utility method that can be used to create vulnerable HT...

The vulnerability of the “exempi” utility, caused by a full overflow of integers, allows a malicious actor to trigger a service failure.

The vulnerability of the “exempi” utility is caused by a numerical overflow. Exploiting this vulnerability can allow an attacker to cause a service failure using specially crafted “.avi” data...

Moderate: Red Hat Security Advisory: cpio security update

An update for cpio is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

MGASA-2020-0376 Updated cifs-utils packages fix security vulnerability

The mount.cifs utility has a shell injection issue where one can embed shell commands via the username mount option. Those commands will be run via popen in the context of the user calling mount CVE-2020-14342...

CVE-2020-24625

Unathenticated directory traversal in the ReceiverServlet class doGet method can lead to arbitrary file reads in HPE Pay Per Use PPU Utility Computing Service UCS Meter version 1.9...

CVE-2020-24625

Unathenticated directory traversal in the ReceiverServlet class doGet method can lead to arbitrary file reads in HPE Pay Per Use PPU Utility Computing Service UCS Meter version 1.9...

Directory traversal

Unathenticated directory traversal in the ReceiverServlet class doGet method can lead to arbitrary file reads in HPE Pay Per Use PPU Utility Computing Service UCS Meter version 1.9...

CVE-2020-24624

Unathenticated directory traversal in the DownloadServlet class execute method can lead to arbitrary file reads in HPE Pay Per Use PPU Utility Computing Service UCS Meter version 1.9...

CVE-2020-24626

Unathenticated directory traversal in the ReceiverServlet class doPost method can lead to arbitrary remote code execution in HPE Pay Per Use PPU Utility Computing Service UCS Meter version 1.9...

CVE-2020-24625

Summary: CVE-2020-24625 is an unauthenticated directory traversal vulnerability in the ReceiverServlet doGet() of Hewlett Packard Enterprise Pay per Use (PPU) Utility Computing Service (UCS) Meter, up to version 1.9 (vulnerability exists prior to 1.9). The root cause is lack of proper validation ...

The vulnerability of the Device Driver Utility component of the Oracle Solaris operating system allows a hacker to gain access to modify, add, or delete data, or cause service failures.

The vulnerability of the Device Driver Utility component of the Oracle Solaris operating system is related to access control deficiencies. Exploiting this vulnerability could allow an attacker to modify, add, or delete data, or cause service failures...

vega-util input validation error vulnerability

vega-util is a JavaScript utility program for Vega. The program provides a function generator, type checker, log messages, and more. An input validation error vulnerability exists in versions of vega-util prior to 1.13.1. The vulnerability stems from a networked system or product that does not...

CVE-2020-10056

A vulnerability has been identified in License Management Utility LMU All versions V2.4. The lmgrd service of the affected application is executed with local SYSTEM privileges on the server while its configuration can be modified by local users. The vulnerability could allow a local authenticated...

CVE-2020-10056

A vulnerability has been identified in License Management Utility LMU All versions V2.4. The lmgrd service of the affected application is executed with local SYSTEM privileges on the server while its configuration can be modified by local users. The vulnerability could allow a local authenticated...

Design/Logic Flaw

A vulnerability has been identified in License Management Utility LMU All versions V2.4. The lmgrd service of the affected application is executed with local SYSTEM privileges on the server while its configuration can be modified by local users. The vulnerability could allow a local authenticated...

CVE-2020-10056

CVE-2020-10056 affects Siemens License Management Utility (LMU) prior to v2.4. The lmgrd service runs with local SYSTEM privileges while its configuration can be modified by local users, enabling a local authenticated attacker to execute arbitrary commands with SYSTEM privileges. Publicly availab...

PT-2020-11886 · Unknown · License Management Utility

Name of the Vulnerable Software and Affected Versions: License Management Utility LMU versions prior to V2.4 Description: A security issue has been identified where the lmgrd service of the affected application runs with local SYSTEM privileges on the server, and its configuration can be modified...