RHEL 7 : openstack-cinder (RHSA-2020:4391)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:4391 advisory. OpenStack Block Storage cinder manages block storage mounting and the presentation of such mounted block storage to instances. The backend physical...

RHEL 8 : openstack-cinder (RHSA-2020:4283)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:4283 advisory. OpenStack Block Storage cinder manages block storage mounting and the presentation of such mounted block storage to instances. The backend physical...

httpd: allow connecting via SSL to a backend worker when the backend keystore file's ID is 'unknown'

A flaw was found in JBCS httpd in version 2.4.37 SP3, where it uses a back-end worker SSL certificate with the keystore file's ID is 'unknown'. The validation of the certificate whether CN and hostname are matching stopped working and allow connecting to the back-end work. The highest threat from...

openstack-cinder: Improper handling of ScaleIO backend credentials

An insecure-credentials flaw was found in openstack-cinder. When using openstack-cinder with the Dell EMC ScaleIO or VxFlex OS backend storage driver, credentials for the entire backend are exposed in the connectioninfo element in all Block Storage v3 Attachments API calls containing that element...

Moderate: Red Hat Security Advisory: openstack-cinder security update

An update for openstack-cinder is now available for Red Hat OpenStack Platform 16.1 Train. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Stored Cross-Site Scripting Vulnerability at ShuipfCMS Backend Login

ShuipFCMS is a content management system based on ThinkPHP framework as the core and developed in an independent grouping approach. A stored cross-site scripting vulnerability exists in the ShuipfCMS backend login, which can be exploited by an attacker to remotely obtain an administrator cookie...

SQL Injection Vulnerability in ZZCMS Backend a***_ma***.php File

ZZCMS is a content management system for Webmaster Merchants. A SQL injection vulnerability exists in the ama.php file in the background of ZZCMS. An attacker can exploit the vulnerability to obtain sensitive information in the database...

Command execution vulnerability in the backend of more than 100 systems shipped

Shipping 100 is a virtual goods automatic shipping system / article pay to read system, without human guards, customers can buy online to automatically complete the transaction. A command execution vulnerability exists in the backend of several Shipment 100 systems. Attackers can use the...

Logic Flaw Vulnerability in the Backend of Zhirui Admission and Registration System

Zhirui admission query enrollment system is the positioning of education enrollment development of the system, specializing in colleges and universities, vocational and technical schools, training colleges and universities and private education, training institutions to develop enrollment and...

BEESCMS Backend Login suffers from SQL Injection Vulnerability

BEESCMS is an enterprise website management system based on PHP+Mysql architecture. BEESCMS backend login has a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database information...

File upload vulnerability in ShopXO backend (CNVD-2020-61907)

ShopXO is an open source PHP e-commerce system. There is a file upload vulnerability in the ShopXO backend that can be exploited by an attacker to gain access to the site's administrative privileges...

Dynamic Data Resolver - Version 1.0.1 beta

By Holger Unterbrink. Cisco Talos is releasing a new beta version of Dynamic Data Resolver DDR today. This release comes with a new architecture for samples using multi-threading. The process and thread tracing has been completely reimplemented. We also fixed a few bugs and memory leaks. Another...

HTTP Request Smuggling in Agoo

agoo through 2.12.3 allows request smuggling attacks where agoo is used as a backend and a frontend proxy also being vulnerable. It is possible to conduct HTTP request smuggling attacks by sending the Content-Length header twice. Furthermore, invalid Transfer Encoding headers were found to be...

Slow Response to the Client Requests when USIP Mode is Enabled on ADC

When using ADC inUse Source IP USIP mode, a slow response to the client requests is experienced. Servers had requests in surge queues that were not processed. Background The USIP mode enables the NetScaler appliance to communicate with the backend servers by using the original Client IP address a...

SQL Injection Vulnerability in ZZCMS2020 Backend (CNVD-2020-59406)

ZZCMS is a content management system. A SQL injection vulnerability exists in the backend of ZZCMS2020, which can be exploited by attackers to obtain sensitive information from the database...

SQL Injection Vulnerability in ZZCMS2020 Backend (CNVD-2020-59407)

ZZCMS is a content management system. A SQL injection vulnerability exists in the backend of ZZCMS2020, which can be exploited by attackers to obtain sensitive information from the database...

SQL Injection Vulnerability in ZZCMS2020 Backend (CNVD-2020-59315)

ZZCMS is a content management system. A SQL injection vulnerability exists in the backend of ZZCMS2020, which can be exploited by attackers to obtain sensitive information from the database...

SQL Injection Vulnerability in ZZCMS2020 Backend (CNVD-2020-59313)

ZZCMS is a content management system. A SQL injection vulnerability exists in the backend of ZZCMS2020, which can be exploited by attackers to obtain sensitive information from the database...

SQL Injection Vulnerability in ZZCMS2020 Backend (CNVD-2020-59404)

ZZCMS is a content management system. A SQL injection vulnerability exists in the backend of ZZCMS2020, which can be exploited by attackers to obtain sensitive information from the database...

SQL Injection Vulnerability in ZZCMS2020 Backend (CNVD-2020-59398)

ZZCMS is a content management system. A SQL injection vulnerability exists in the backend of ZZCMS2020, which can be exploited by attackers to obtain sensitive information from the database...