CVE-2021-44230

PortSwigger Burp Suite Enterprise Edition before 2021.11 on Windows has weak file permissions for the embedded H2 database, which might lead to privilege escalation. This issue can be exploited by an adversary who has already compromised a valid Windows account on the server via separate means. I...

Privilege escalation

PortSwigger Burp Suite Enterprise Edition before 2021.11 on Windows has weak file permissions for the embedded H2 database, which might lead to privilege escalation. This issue can be exploited by an adversary who has already compromised a valid Windows account on the server via separate means. I...

CVE-2021-44230

PortSwigger Burp Suite Enterprise Edition for Windows prior to 2021.11 exposes weak file permissions on the embedded H2 database, enabling possible privilege escalation for an attacker that already has a valid Windows account on the server and may access sensitive configuration, database, and log...

CVE-2021-44230

PortSwigger Burp Suite Enterprise Edition before 2021.11 on Windows has weak file permissions for the embedded H2 database, which might lead to privilege escalation. This issue can be exploited by an adversary who has already compromised a valid Windows account on the server via separate means. I...

CVE-2021-42954

Zoho Remote Access Plus Server Windows Desktop Binary fixed from 10.1.2121.1 is affected by incorrect access control. The installation directory is vulnerable to weak file permissions by allowing full control for Windows Everyone user group non-admin or any guest users, thereby allowing privilege...

Information disclosure

Zoho Remote Access Plus Server Windows Desktop Binary fixed from 10.1.2121.1 is affected by incorrect access control. The installation directory is vulnerable to weak file permissions by allowing full control for Windows Everyone user group non-admin or any guest users, thereby allowing privilege...

CVE-2021-42954

Zoho Remote Access Plus Server Windows Desktop Binary fixed from 10.1.2121.1 is affected by incorrect access control. The installation directory is vulnerable to weak file permissions by allowing full control for Windows Everyone user group non-admin or any guest users, thereby allowing privilege...

Security Bulletin: Multiple vulnerabilities in F5 NGINX Controller affect IBM Cloud Pak for Automation

Summary The vulnerabilities are related to F5 NGINX Controller, included in the pfs-nginx-prod docker image, that is deployed by IBM Process Federation Server . Vulnerability Details CVEID: CVE-2021-23018 DESCRIPTION: F5 NGINX Controller could allow a remote attacker to obtain sensitive...

Security Bulletin: IBM i2 Analyze is affected by multiple DB2 vulnerabilities

Summary DB2 has multiple security vulnerabilities. DB2 users should refer to the linked DB2 security bulletins to determine is remediation is required. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products|...

Hms Networks eCatcher 安全漏洞

Hms Networks eCatcher is a VPN Virtual Private Network client application from the Swedish company HMS Networks. Hms Networks eCatcher suffers from a security vulnerability that stems from weak file system permissions that may allow access by malicious users. An attacker could exploit the...

Security Bulletin: Multiple vulnerabilities have been identified in IBM® Db2® which is shipped with IBM Operations Analyticsg Predictive Insights

Summary IBM® Db2® is shipped as a component of IBM Operations Analytics Predictive Insights. IBM® Db2® for Linux, UNIX and Windows includes DB2 Connect Server 10.5, 11.1, and 11.5 is vulnerable to a buffer overflow caused by improper bounds checking, denial of service atack due to a hang in the S...

CVE-2021-23022

CVE-2021-23022 affects the BIG-IP Edge Client for Windows: the Windows Installer Service temporary folder has weak permissions, enabling local privilege escalation. Affected versions are 7.2.1.x before 7.2.1.3 and 7.1.x before 7.1.9.9 Update 1; non-vulnerable/End of Technical Support versions are...

SUSE SLES11 Security Update : SUSE Manager Client Tools (SUSE-SU-2020:14538-1)

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2020:14538-1 advisory. - An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can resul...

Security Bulletin: Vulnerabilities in IBM Db2 affect IBM Spectrum Protect Server (CVE-2020-5024, CVE-2020-5025, CVE-2020-4976)

Summary The IBM Spectrum Protect Server is affected by IBM Db2 vulnerabilities such as denial of service, buffer overflow, and weak file permissions. Vulnerability Details CVEID: CVE-2020-5024 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 9.7, 10.1, 10.5, 11.1, and...

Security Bulletin: Multiple security vulnerabilities may affect IBM DB2 shipped with Predictive Maintenance and Quality and Predictive Maintenance Insights On-Premises

Summary IBM DB2 is shipped with IBM Predictive Maintenance and Quality and Predictive Maintenance Insights On-Premises. Information about security vulnerabilities affecting DB2 has been published in multiple security bulletins as below. Vulnerability Details Refer to the security bulletins listed...

Security Bulletin: Multiple vulnerabilities in Db2 affect IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise

Summary IBM® Db2® shipped with IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise is vulnerable to information disclosure. Multiple vulnerabilities have been identified in IBM Db2 and information about their fixes are published as security bulletins. Vulnerability Details Refer to the...

Security Bulletin: IBM® Db2® is vulnerable to weak file permissions allowing access to specific files (CVE-2020-4976)

Summary IBM Db2 for Linux, UNIX and Windows includes DB2 Connect Server could allow a local user to read and write specific files due to weak file permissions. Vulnerability Details CVEID: CVE-2020-4976 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server could allow a loc...

Security Bulletin: IBM DB2 Server Vulnerabilities Affect IBM Emptoris Program Management

Summary IBM DB2 Server Vulnerabilities Affect IBM Emptoris Program Management Vulnerability Details CVEID: CVE-2020-5025 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 9.7, 10.1, 10.5, 11.1, and 11.5 db2fm is vulnerable to a buffer overflow, caused by improper bounds...

Security Bulletin: Multiple IBM DB2 Server Vulnerabilities Affect IBM Emptoris Sourcing

Summary Multiple IBM DB2 Server Vulnerabilities Affect IBM Emptoris Sourcing Vulnerability Details CVEID: CVE-2020-5025 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 9.7, 10.1, 10.5, 11.1, and 11.5 db2fm is vulnerable to a buffer overflow, caused by improper bounds...

Security Bulletin: IBM DB2 Server Vulnerabilities Affect IBM Emptoris Emptoris Supplier Lifecycle Mgmt

Summary IBM DB2 Server Vulnerabilities Affect IBM Emptoris Emptoris Supplier Lifecycle Management. Vulnerability Details CVEID: CVE-2020-5025 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 9.7, 10.1, 10.5, 11.1, and 11.5 db2fm is vulnerable to a buffer overflow, caus...