Ellucian 跨站脚本漏洞

Ellucian is Ellucian's open and flexible technology ecosystem supporting SaaS. A cross-site scripting vulnerability exists in Ellucian Ethos Identity versions prior to 5.10.5, which stems from the presence of an unknown function in the file /cas/logout that leads to cross-site scripting via the...

Trend Micro Apex Central modTMMS SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trend Micro Apex Central. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of deletecertvec requests to the modTMMS endpoint. When parsing the ...

Trend Micro Apex Central modTMMS SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trend Micro Apex Central. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of setcertificatesconfig requests to the modTMMS endpoint. When...

IBM Spectrum Virtualize Information Disclosure Vulnerability (CNVD-2023-40603)

IBM Spectrum Virtualize is a block storage virtualization system from International Business Machines IBM, Inc. that increases the data value, security and simplicity of new and existing storage infrastructures. An information disclosure vulnerability exists in IBM Spectrum Virtualize version 8.5...

PT-2023-3783

Name of the Vulnerable Software and Affected Versions Trend Micro Apex Central on-premise affected versions not specified Description The issue concerns certain dashboard widgets in Trend Micro Apex Central that are susceptible to cross-site scripting XSS attacks. This could potentially allow an...

PT-2023-3781

Name of the Vulnerable Software and Affected Versions Trend Micro Apex Central affected versions not specified Description The issue exists due to inadequate protection of the web page structure in Trend Micro Apex Central, allowing for potential exploitation. This could enable a remote attacker ...

PT-2023-3786 · Trend Micro · Trend Micro Apex Central

Name of the Vulnerable Software and Affected Versions: Trend Micro Apex Central affected versions not specified Description: The issue exists due to a lack of protection for the web page structure, allowing for potential cross-site scripting XSS attacks. This could enable a remote attacker to...

PT-2023-7400 · Trend Micro · Trend Micro Apex Central

Name of the Vulnerable Software and Affected Versions: Trend Micro Apex Central affected versions not specified Description: The issue exists due to inadequate protection of the web page structure. Exploitation may allow a remote attacker to conduct a cross-site scripting attack. The vulnerabilit...

PT-2023-7403 · Trend Micro · Trend Micro Apex Central

Name of the Vulnerable Software and Affected Versions: Trend Micro Apex Central versions affected versions not specified Description: The issue exists due to inadequate protection of the web page structure. It may allow a remote attacker to conduct a cross-site scripting attack. The exploitation...

PT-2023-3782 · Trend Micro · Trend Micro Apex Central

Name of the Vulnerable Software and Affected Versions: Trend Micro Apex Central affected versions not specified Description: The issue exists due to inadequate protection of the web page structure in Trend Micro Apex Central, allowing for potential exploitation. This could enable a remote attacke...

PT-2023-7402 · Trend Micro · Trend Micro Apex Central

Name of the Vulnerable Software and Affected Versions: Trend Micro Apex Central on-premise affected versions not specified Description: The issue is related to potential authenticated reflected cross-site scripting XSS attacks due to user input validation and sanitization issues. An attacker must...

Ivanti Avalanche FileStoreConfig Shell Upload

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Ivanti Avalanche FileStoreConfig File Upload', 'Description' = %q Ivanti Avalanche prior to v6.4.0.186 permits MS-DOS style short names in the...

CVE-2023-27870

IBM Spectrum Virtualize 8.5, under certain circumstances, could disclose sensitive credential information while a download from Fix Central is in progress. IBM X-Force ID: 249518...

Information disclosure

IBM Spectrum Virtualize 8.5, under certain circumstances, could disclose sensitive credential information while a download from Fix Central is in progress. IBM X-Force ID: 249518...

CVE-2023-27870 IBM Spectrum Virtualize information disclosure

IBM Spectrum Virtualize 8.5, under certain circumstances, could disclose sensitive credential information while a download from Fix Central is in progress. IBM X-Force ID: 249518...

CVE-2023-27870 IBM Spectrum Virtualize information disclosure

IBM Spectrum Virtualize 8.5, under certain circumstances, could disclose sensitive credential information while a download from Fix Central is in progress. IBM X-Force ID: 249518...

CVE-2023-27870

IBM Spectrum Virtualize 8.5 is affected by an information-disclosure vulnerability where sensitive IBMid credentials could be exposed during Fix Central downloads (e.g., using satask downloadsoftware or the Obtain the package directly option). Root cause: insufficient protection of service data d...

New DownEx Malware Campaign Targets Foreign Government Institutions in Central Asia

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The DownEx malware was discovered in a cyberattack on government institutions in Kazakhstan and Afghanistan in 2022, likely with state sponsorship. The attackers used spear-phishing emails to infiltrate...

CVE-2022-46308

SGUDA U-Lock central lock control service’s user management function has incorrect authorization. A remote attacker with general user privilege can exploit this vulnerability to call privileged APIs to access, modify and delete user information...

IBM Spectrum Virtualize 信息泄露漏洞

IBM Spectrum Virtualize is a block storage virtualization system from International Business Machines IBM, Inc. that increases the data value, security and simplicity of new and existing storage infrastructures. An information disclosure vulnerability exists in IBM Spectrum Virtualize version 8.5...