Cross site scripting

Cross-site Scripting XSS vulnerability in the main dashboard of Ellipse APM versions allows an authenticated user or integrated application to inject malicious data into the application that can then be executed in a victim’s browser. This issue affects: Hitachi ABB Power Grids Ellipse APM 5.3...

CVE-2021-27887 Stored XSS vulnerability in Ellipse APM

Cross-site Scripting XSS vulnerability in the main dashboard of Ellipse APM versions allows an authenticated user or integrated application to inject malicious data into the application that can then be executed in a victim’s browser. This issue affects: Hitachi ABB Power Grids Ellipse APM 5.3...

CVE-2021-27887

CVE-2021-27887 is a stored XSS vulnerability in the main dashboard of Hitachi ABB Power Grids Ellipse APM. Affected products are Ellipse APM versions prior to 5.3.0.1, prior to 5.2.0.3, and prior to 5.1.0.6. The flaw allows an authenticated user or integrated application to inject malicious data ...

F5 Networks BIG-IP : BIG-IP APM ACL bypass vulnerability (K75540265)

The version of F5 Networks BIG-IP installed on the remote host is prior to 13.1.4 / 14.1.4.1 / 15.1.3 / 16.0.1.2 / 16.1.0. It is, therefore, affected by a vulnerability as referenced in the K75540265 advisory. - On BIG-IP APM versions 15.1.x before 15.1.3, 14.1.x before 14.1.4.1, 13.1.x before...

Information Disclosure

Elastic APM .NET Agent is vulnerable to information disclosure. Confidential HTTP header information is disclosed when logging the details during an application error...

Elastic APM .NET Agent 1.10.0 Security Update

Elastic APM .NET Agent information disclosure ESA-2021-14 The Elastic APM .NET Agent can leak sensitive HTTP header information when logging the details during an application error. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM serve...

GHSA-QQC5-RGCC-CJQH Information Disclosure in go.elastic.co/apm

The Elastic APM agent for Go versions before 1.11.0 can leak sensitive HTTP header information when logging the details during an application panic. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM server. During an application panic it...

Information Disclosure in go.elastic.co/apm

The Elastic APM agent for Go versions before 1.11.0 can leak sensitive HTTP header information when logging the details during an application panic. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM server. During an application panic it...

GO-2022-0706 Information disclosure in go.elastic.co/apm

Sensitive HTTP headers may not be properly sanitized before being sent to the APM server if the program panics...

Insertion of Sensitive Information into Log File

The Elastic APM agent for Go versions before 1.11.0 can leak sensitive HTTP header information when logging the details during an application panic. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM server. During an application panic it...

Security Bulletin: Multiple vulnerabilities of Mozilla Firefox (less than Firefox 78.9.0 ESR +  CVE-2021-23987) have affected Synthetic Playback Agent 8.1.4.0-8.1.4 IF13 + CP4MCM2.2

Summary Synthetic Playback Agent has addressed the following vulnerabilities: CVE-2021-23987, CVE-2021-23982, CVE-2021-23981, CVE-2021-23984 Vulnerability Details CVEID: CVE-2021-23987 DESCRIPTION: Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by...

Security Bulletin: Multiple vulnerabilities of Mozilla Firefox (less than Firefox 78.9.0 ESR +  CVE-2020-16044) have affected Synthetic Playback Agent 8.1.4.0-8.1.4 IF13 + CP4MCM2.2

Summary Synthetic Playback Agent has addressed the following vulnerabilities: CVE-2020-16044 Vulnerability Details CVEID: CVE-2020-16044 DESCRIPTION: Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free write when handling a malicious...

Security Bulletin: Multiple vulnerabilities of Mozilla Firefox (less than Firefox 78.9.0 ESR +  196306) have affected Synthetic Playback Agent 8.1.4.0-8.1.4 IF13 + CP4MCM 2020.2.2

Summary Synthetic Playback Agent has addressed the following vulnerabilities: 196306 Vulnerability Details Third Party Entry: 196306 DESCRIPTION: Mozilla Firefox depth pitch buffer overflow CVSS Base score: 9.8 CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/196306...

CVE-2021-23016

On BIG-IP APM versions 15.1.x before 15.1.3, 14.1.x before 14.1.4.1, 13.1.x before 13.1.4, and all versions of 16.0.x, 12.1.x, and 11.6.x, an attacker may be able to bypass APM's internal restrictions and retrieve static content that is hosted within APM by sending specifically crafted requests t...

Code injection

On BIG-IP APM versions 15.1.x before 15.1.3, 14.1.x before 14.1.4.1, 13.1.x before 13.1.4, and all versions of 16.0.x, 12.1.x, and 11.6.x, an attacker may be able to bypass APM's internal restrictions and retrieve static content that is hosted within APM by sending specifically crafted requests t...

CVE-2021-23016

CVE-2021-23016 affects F5 BIG-IP APM. An attacker may bypass APM’s internal restrictions and retrieve static content hosted within APM by crafting requests to an APM Virtual Server. Affected branches/versions include BIG-IP APM: 15.1.x before 15.1.3, 14.1.x before 14.1.4.1, 13.1.x before 13.1.4, ...

CVE-2021-23016

On BIG-IP APM versions 15.1.x before 15.1.3, 14.1.x before 14.1.4.1, 13.1.x before 13.1.4, and all versions of 16.0.x, 12.1.x, and 11.6.x, an attacker may be able to bypass APM's internal restrictions and retrieve static content that is hosted within APM by sending specifically crafted requests t...

CVE-2021-23008

On version 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, 12.1.x before 12.1.6, and all versions of 16.0.x and 11.6.x., BIG-IP APM AD Active Directory authentication can be bypassed via a spoofed AS-REP Kerberos Authentication Service Response response sent over a hijacked KDC...

CVE-2021-23008

On version 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, 12.1.x before 12.1.6, and all versions of 16.0.x and 11.6.x., BIG-IP APM AD Active Directory authentication can be bypassed via a spoofed AS-REP Kerberos Authentication Service Response response sent over a hijacked KDC...

CVE-2021-23008

On version 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, 12.1.x before 12.1.6, and all versions of 16.0.x and 11.6.x., BIG-IP APM AD Active Directory authentication can be bypassed via a spoofed AS-REP Kerberos Authentication Service Response response sent over a hijacked KDC...