CVE-2020-3284 Cisco IOS XR Software Enhanced Preboot eXecution Environment Unsigned Code Execution Vulnerability

A vulnerability in the enhanced Preboot eXecution Environment PXE boot loader for Cisco IOS XR 64-bit Software could allow an unauthenticated, remote attacker to execute unsigned code during the PXE boot process on an affected device. The PXE boot loader is part of the BIOS and runs over the...

Authentication Bypass

shiro-spring-boot-web-starter is vulnerable to authentication bypass. An attacker is able to bypass authentication via a malicious HTTP request...

Cisco IOS XR RCE (cisco-sa-iosxr-pxe-unsign-code-exec-qAa78fD2)

According to its self-reported version, IOS-XR is affected by a remote code execution vulnerability in the enhanced Preboot eXecution Environment PXE boot loader due to a failure to verify commands issued during a network boot. An unauthenticated, remote attacker can exploit this to execute...

Unbreakable Enterprise kernel security update

4.1.12-124.44.4 - scsi: qla2xxx: Fix NULL pointer crash due to active timer for ABTS [email protected] Orabug: 32020790 4.1.12-124.44.3 - qed: Reduce verbosity of unimplemented MFW messages Mintz, Yuval Orabug: 31959299 - kexec: validate pe files against the systemblacklistkeyring Eric...

SpringBootVulExploit

This repository contains a collection of Spring Boot vulnerability exploit checklists, which are used for authorized testing and security research purposes. The repository includes various exploits and techniques for exploiting Spring Boot applications, including: 1. Spring Boot Vulnerability...

SUSE-SU-2020:3161-1 Security update for u-boot

This update for u-boot fixes the following issues: - CVE-2020-8432: Fixed a double free in the cmd/gpt.c dorenamegptparts function, which allowed an attacker to execute arbitrary code bsc1162198 - CVE-2020-10648: Fixed improper signature verification during verified boot bsc1167209...

Cisco IOS XR Software Enhanced Preboot eXecution Environment Unsigned Code Execution Vulnerability

A vulnerability in the enhanced Preboot eXecution Environment PXE boot loader for Cisco IOS XR 64-bit Software could allow an unauthenticated, remote attacker to execute unsigned code during the PXE boot process on an affected device. The PXE boot loader is part of the BIOS and runs over the...

anaconda bug fix and enhancement update

The anaconda packages contain parts of the Anaconda installation program that allows reconfiguration and advanced installation options. Bug Fixes and Enhancements: Mellanox VPI and CX-4 adapter cards InfiniBand mode PXE boot of RHEL8.3 failed BZ1890261...

Cisco Adaptive Security Appliance and Firepower Threat Defense Secure Boot Bypass Vulnerability

Cisco Firepower Threat Defense and Cisco Adaptive Security Appliance are both products of Cisco, Inc. Cisco Firepower Threat Defense is a suite of unified software that provides next-generation firewall services.Cisco Adaptive Security Appliance is a firewall and network security platform. Cisco...

Semrush: Critically Sensitive Spring Boot Endpoints Exposed

Spring Boot includes a number of additional features to help you monitor and manage your application when you push it to production. Hacker found that actuator endpoints containing potentially sensitive data such as internal tokens and service data were left public. Semrush has a microservices...

Target device boot issue from PVS server - vDisk cannot be accessed (a).

When booting the target device from vDisk we get the following error on pre-boot screen: "vDisk cannot be accessed a."...

PT-2022-2032

Name of the Vulnerable Software and Affected Versions Spring Framework versions prior to 5.2.20 and 5.3.18 Spring Boot versions prior to 2.5.12 and 2.6.6 libspring-aop-java - 4.3.22-4ubuntu0.1esm1 libspring-beans-java - 4.3.22-4ubuntu0.1esm1 libspring-context-java - 4.3.22-4ubuntu0.1esm1...

CVE-2020-16261

Winston 1.5.4 devices allow a U-Boot interrupt, resulting in local root access...

CVE-2020-16261

Winston 1.5.4 devices allow a U-Boot interrupt, resulting in local root access...

Design/Logic Flaw

Winston 1.5.4 devices allow a U-Boot interrupt, resulting in local root access...

CVE-2020-16261

Winston 1.5.4 devices allow a U-Boot interrupt, resulting in local root access...

CVE-2020-16261

CVE-2020-16261 affects Winston 1.5.4 devices. The vulnerability arises from a U-Boot interrupt that can grant local root access, indicating a component/root-cause issue at boot-time or firmware control paths. The available sources describe the impact as local root access with confidentiality, int...

Stripo Inc: Memory Dump and Env Disclosure via Spring Boot Actuator

Memory Dump and Env Disclosure via Spring Boot Actuator Spring boot actuator files/endpoints can be accessed via path like stripo.email/██████/actuator/, including a 110 MB heapdump file, which expose source code, private keys and some internal data! The maximum severity of this asset is medium, ...

Cisco FXOS Secure Boot Bypass Vulnerability

Cisco FXOS Software is a set of firewall software from Cisco that runs in Cisco security appliances. Cisco FXOS has a security vulnerability that stems from insufficient protection of the secure boot process. An attacker can exploit the vulnerability to break the chain of trust and inject code in...

Jeecg-Boot suffers from SQL injection vulnerability (CNVD-2020-62597)

Jeecg-Boot is a code generator based rapid development platform , using front-end and back-end separation architecture : SpringBoot 2.x, Ant Design & Vue, Mybatis-plus, Shiro, JWT. Jeecg-Boot suffers from a SQL injection vulnerability. An attacker can exploit the vulnerability to obtain sensitive...