Vulnerability fixed in Cisco Prime Infrastructure and Evolved Programmable Network Manager

Cisco has fixed a vulnerability in Prime Infrastructure and Evolved Programmable Network Manager. An authenticated malicious person with access to the command-line interface could exploit the exploit the vulnerability to gain access to sensitive information. Cisco has released updates to fix the...

Aruba Operating System路径遍历漏洞

Aruba Networks ArubaOS is an operating system for Aruba Mobility-Defined Networks including mobile controllers and mobile access switches from Aruba Networks, Inc. The vulnerability is caused by a lack of validation and filtering of parameters, which could be exploited by an authenticated attacke...

Aruba Operating System路径遍历漏洞

Aruba Networks ArubaOS is an operating system for Aruba Mobility-Defined Networks including mobile controllers and mobile access switches from Aruba Networks, Inc. The vulnerability is caused by a lack of validation and filtering of parameters, which could be exploited by an authenticated attacke...

Aruba Networks Aruba Operating System 命令注入漏洞

Aruba Networks Aruba Operating System, the operating system for Aruba controller-managed wireless LANs and Aruba mobile controllers from Aruba Networks, is vulnerable to a command injection vulnerability. The vulnerability is caused by a failure to properly filter special characters, commands, et...

Aruba Operating System 路径遍历漏洞

The Aruba Operating System is the operating system for wireless LANs and Aruba mobile controllers managed by Aruba Controllers from Aruba Networks, Inc. A path traversal vulnerability exists in the Aruba Operating System due to a lack of validation and filtering of parameters, which can be...

Aruba Networks Aruba Operating System 命令注入漏洞

Aruba Operating System is the operating system for Aruba Controller-managed wireless LANs and Aruba Mobility Controllers from Aruba Networks, Inc. A command injection vulnerability exists in the Aruba Operating System that can be exploited by an attacker to trigger remote command execution via th...

Aruba Operating System 路径遍历漏洞

Aruba Networks ArubaOS is an operating system for Aruba Mobility-Defined Networks including mobile controllers and mobile access switches from Aruba Networks, Inc. The vulnerability is caused by a failure to effectively validate and filter parameters, which could be exploited by an authenticated...

Exploit for CVE-2021-33766

POC Exploit CVE-2021-33766 ProxyToken POC Exploit for CVE-...

sssd: shell command injection in sssctl

A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a specially crafted sssctl command, such as via sudo, to gain root access. The highest...

CVE-2021-39133

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, a user with admin access to the system resource type is potentially vulnerable to a CSRF attack that could cause the server to run untrusted code on all...

Cross site request forgery (csrf)

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, a user with admin access to the system resource type is potentially vulnerable to a CSRF attack that could cause the server to run untrusted code on all...

Authentication flaw

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, an authorized user can upload a zip-format plugin with a crafted plugin.yaml, or a crafted aclpolicy yaml file, or upload an untrusted project archive with ...

CVE-2021-39133

Summary: CVE-2021-39133 affects Rundeck; prior to versions 3.3.14 and 3.4.3 a user with admin access to the system resource type could be CSRF-ed into causing the server to run untrusted code. The issue exposes all Rundeck editions to potential code execution via CSRF. Affected versions: Rundeck ...

OPENSUSE-SU-2021:1206-1 Security update for aws-cli, python-boto3, python-botocore, python-service_identity, python-trustme, python-urllib3

This patch updates the Python AWS SDK stack in SLE 15: General: aws-cli - Version updated to upstream release v1.19.9 For a detailed list of all changes, please refer to the changelog file of this package. python-boto3 - Version updated to upstream release 1.17.9 For a detailed list of all change...

CVE-2021-1592

A vulnerability in the way Cisco UCS Manager software handles SSH sessions could allow an authenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to improper resource management for established SSH sessions. An attacker could...

CVE-2021-33886

An improper sanitization of input vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote unauthenticated attacker to gain user-level command-line access by passing a raw external string straight through to printf statements. The attacker is required to be on the same network as t...

CVE-2021-33886

An improper sanitization of input vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote unauthenticated attacker to gain user-level command-line access by passing a raw external string straight through to printf statements. The attacker is required to be on the same network as t...

CVE-2021-33886

An improper sanitization of input vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote unauthenticated attacker to gain user-level command-line access by passing a raw external string straight through to printf statements. The attacker is required to be on the same network as t...

AZL-8484 CVE-2021-36690 affecting package sqlite for versions less than 3.36.0-3

A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo function when there is a crafted SQL query. NOTE: the vendor disputes the relevance of this report because a sqlite3.exe user already has full privileges e.g., is intentionally allowe...

CVE-2021-36690

A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo function when there is a crafted SQL query. NOTE: the vendor disputes the relevance of this report because a sqlite3.exe user already has full privileges e.g., is intentionally allowe...