CVE-2021-34474

CVE-2021-34474 is a remote code execution vulnerability in Microsoft Dynamics 365 Business Central. Public data shows exploitable via network with no user interaction; impact is high (C/C/I/A) and the attack requires high privileges (per CVSS 3.1 vector). The issue affects Dynamics 365 Business C...

CVE-2021-34474 Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability

...

Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability

...

Update 17.8 for Microsoft Dynamics 365 Business Central 2020 Release Wave 2 (Application Build 17.8.27267, Platform Build 17.0.27235)

None None...

Update 18.3 for Microsoft Dynamics 365 Business Central 2021 Release Wave 1 (Application Build 18.3.27480, Platform Build 18.0.27469)

None None...

PT-2021-5690 · Microsoft · Dynamics 365 Business Central

Name of the Vulnerable Software and Affected Versions: Microsoft Dynamics 365 Business Central affected versions not specified Description: The issue is related to incorrect code generation management in Microsoft Dynamics 365 Business Central. It allows a remote attacker to execute arbitrary cod...

Security Updates for Microsoft Dynamics 365 Business Central (July 2021)

The Microsoft Dynamics 365 Business Central install is missing a security update. It is, therefore, affected by a Remote Code Execution vulnerability. An authenticated attacker can exploit this, to execute arbitrary commands. Note that Nessus has not attempted to exploit this issue but has instea...

Vulnerability fixed in Microsoft Dynamics

Microsoft has fixed a vulnerability in Dynamics Business Central Control. A malicious party could potentially exploit it to execute arbitrary code under the privileges of the application on the underlying operating system. Microsoft has made updates available that fix the described vulnerability...

Microsoft Dynamics Business Central 代码注入漏洞

Microsoft Dynamics Business Central is an enterprise resource planning system from Microsoft. The system includes functionality for financial management, project management, and supply chain management. A code injection vulnerability exists in Microsoft Dynamics Business Central. The following...

Apache Tomcat 9.0.0.M1 - Open Redirect

Exploit Title: Apache Tomcat 9.0.0.M1 - Open Redirect Date: 10/04/2018 Exploit Author: Central InfoSec Version: Apache Tomcat 9.0.0.M1 to 9.0.0.11, 8.5.0 to 8.5.33, and 7.0.23 to 7.0.90 CVE : CVE-2018-11784 Proof of Concept: Identify a subfolder within your application http://example.com/test/...

Apache Tomcat 9.0.0M1 Open Redirect

Exploit Title: Apache Tomcat 9.0.0.M1 - Open Redirect Date: 10/04/2018 Exploit Author: Central InfoSec Version: Apache Tomcat 9.0.0.M1 to 9.0.0.11, 8.5.0 to 8.5.33, and 7.0.23 to 7.0.90 CVE : CVE-2018-11784 Proof of Concept: Identify a subfolder within your application http://example.com/test/...

Security Bulletin: Vulnerability in SSLv3 affects IBM InfoSphere Optim Performance Manager (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM InfoSphere Optim Performance Manager OPM. Vulnerability Details CVE-ID: CVE-2014-3566 DESCRIPTION: IBM InfoSphere Optim Performance Manager...

Trend Micro Password Manager Integer Truncation Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Password Manager. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Tre...

Security Bulletin: IBM Spectrum Scale and IBM GPFS are affected by security vulnerabilities (CVE-2015-4974, CVE-2015-4981)

Summary Security vulnerabilities have been identified in the current levels of IBM Spectrum Scale V4.1.1, IBM GPFS V4.1 and V3.5: - could allow a local non privileged attacker to execute commands with root privileges CVE-2015-4974 - could allow a local non privileged attacker to read system...

Security Bulletin: IBM Bootable Media Creator (BoMC) is affected by vulnerabilities in libexpat

Summary IBM Bootable Media Creator BoMC has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2018-20843 DESCRIPTION: libexpat is vulnerable to a denial of service, caused by an error in the XML parser. By persuading a victim to open a specially-crafted file, a remote...

CVE-2021-27408

The affected product is vulnerable to an out-of-bounds read, which can cause information leakage leading to arbitrary code execution if chained to the out-of-bounds write vulnerability on the Welch Allyn medical device management tools Welch Allyn Service Tool: versions prior to v1.10, Welch Ally...

Security Bulletin: Vulnerability in IBM Java SDK and IBM Java Runtime affects TPF Toolkit

Summary A vulnerability in IBM® SDK Java™ Technology Edition and IBM® Runtime Environment Java™ that is used by TPF Toolkit has been addressed. Vulnerability Details CVEID: CVE-2021-2161 DESCRIPTION: An unspecified vulnerability in Java SE related to the Libraries component could allow an...

CVE-2021-26314

Potential floating point value injection in all supported CPU products, in conjunction with software vulnerabilities relating to speculative execution with incorrect floating point results, may cause the use of incorrect data from FPVI and may result in data leakage...

The vulnerability of the PayAction.class.php script of the software controller for the centralized control of wireless networks by D-Link Central WiFi Manager CWM(100) allows a hacker to inject any desired web script or HTML code.

The vulnerability of the PayAction.class.php script of the software controller for the centralized control of wireless networks by D-Link Central WiFi Manager CWM100 is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a remote attacker t...

The vulnerability of the central module for managing engineering data and the product’s life cycle in the “LOCMAN Client” system, a system for managing engineering data and the product’s life cycle, arises from the possibility of unlimited loading of dangerous type files, allowing attackers to execute arbitrary codes.

The vulnerability of the central module responsible for managing engineering data and the product’s lifecycle in the LOCsMAN Engineering Data and Product Lifecycle Management system is related to the possibility of unlimited loading of dangerous files. Exploiting this vulnerability could allow...