Aruba Operating System 路径遍历漏洞

The Aruba Operating System is the operating system for wireless LANs and Aruba mobile controllers managed by Aruba Controllers from Aruba Networks, Inc. A path traversal vulnerability exists in the Aruba Operating System due to a lack of validation and filtering of parameters, which can be...

Aruba Networks Aruba Operating System 命令注入漏洞

Aruba Networks Aruba Operating System, the operating system for Aruba controller-managed wireless LANs and Aruba mobile controllers from Aruba Networks, is vulnerable to a command injection vulnerability. The vulnerability is caused by a failure to properly filter special characters, commands, et...

Aruba Operating System路径遍历漏洞

Aruba Networks ArubaOS is an operating system for Aruba Mobility-Defined Networks including mobile controllers and mobile access switches from Aruba Networks, Inc. The vulnerability is caused by a lack of validation and filtering of parameters, which could be exploited by an authenticated attacke...

Aruba Operating System 路径遍历漏洞

Aruba Networks ArubaOS is an operating system for Aruba Mobility-Defined Networks including mobile controllers and mobile access switches from Aruba Networks, Inc. The vulnerability is caused by a failure to effectively validate and filter parameters, which could be exploited by an authenticated...

Aruba Networks Aruba Operating System 命令注入漏洞

Aruba Operating System is the operating system for Aruba Controller-managed wireless LANs and Aruba Mobility Controllers from Aruba Networks, Inc. A command injection vulnerability exists in the Aruba Operating System that can be exploited by an attacker to trigger remote command execution via th...

Exploit for CVE-2021-33766

POC Exploit CVE-2021-33766 ProxyToken POC Exploit for CVE-...

sssd: shell command injection in sssctl

A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a specially crafted sssctl command, such as via sudo, to gain root access. The highest...

CVE-2021-39133

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, a user with admin access to the system resource type is potentially vulnerable to a CSRF attack that could cause the server to run untrusted code on all...

Authentication flaw

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, an authorized user can upload a zip-format plugin with a crafted plugin.yaml, or a crafted aclpolicy yaml file, or upload an untrusted project archive with ...

Cross site request forgery (csrf)

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, a user with admin access to the system resource type is potentially vulnerable to a CSRF attack that could cause the server to run untrusted code on all...

CVE-2021-39133

Summary: CVE-2021-39133 affects Rundeck; prior to versions 3.3.14 and 3.4.3 a user with admin access to the system resource type could be CSRF-ed into causing the server to run untrusted code. The issue exposes all Rundeck editions to potential code execution via CSRF. Affected versions: Rundeck ...

OPENSUSE-SU-2021:1206-1 Security update for aws-cli, python-boto3, python-botocore, python-service_identity, python-trustme, python-urllib3

This patch updates the Python AWS SDK stack in SLE 15: General: aws-cli - Version updated to upstream release v1.19.9 For a detailed list of all changes, please refer to the changelog file of this package. python-boto3 - Version updated to upstream release 1.17.9 For a detailed list of all change...

CVE-2021-1592

A vulnerability in the way Cisco UCS Manager software handles SSH sessions could allow an authenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to improper resource management for established SSH sessions. An attacker could...

CVE-2021-33886

An improper sanitization of input vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote unauthenticated attacker to gain user-level command-line access by passing a raw external string straight through to printf statements. The attacker is required to be on the same network as t...

CVE-2021-33886

An improper sanitization of input vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote unauthenticated attacker to gain user-level command-line access by passing a raw external string straight through to printf statements. The attacker is required to be on the same network as t...

CVE-2021-33886

An improper sanitization of input vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote unauthenticated attacker to gain user-level command-line access by passing a raw external string straight through to printf statements. The attacker is required to be on the same network as t...

PT-2021-20353

Name of the Vulnerable Software and Affected Versions: B. Braun SpaceCom2 versions prior to 012U000062 Description: An improper sanitization of input issue in B. Braun SpaceCom2 allows a remote unauthenticated attacker to gain user-level command-line access by passing a raw external string straig...

CVE-2021-33886: Use of Externally-Controlled Format String

An improper sanitization of input vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote unauthenticated attacker to gain user-level command-line access by passing a raw external string straight through to printf statements. The attacker is required to be on the same network as t...

AZL-8484 CVE-2021-36690 affecting package sqlite for versions less than 3.36.0-3

A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo function when there is a crafted SQL query. NOTE: the vendor disputes the relevance of this report because a sqlite3.exe user already has full privileges e.g., is intentionally allowe...

CVE-2021-36690

A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo function when there is a crafted SQL query. NOTE: the vendor disputes the relevance of this report because a sqlite3.exe user already has full privileges e.g., is intentionally allowe...