Design/Logic Flaw

In Amazon AWS Firecracker before 0.21.3, and 0.22.x before 0.22.1, the serial console buffer can grow its memory usage without limit when data is sent to the standard input. This can result in a memory leak on the microVM emulation thread, possibly occupying more memory than intended on the host...

CVE-2020-27173

In vm-superio before 0.1.1, the serial console FIFO can grow to unlimited memory usage when data is sent to the input source i.e., standard input. This behavior cannot be reproduced from the guest side. When no rate limiting is in place, the host can be subject to memory pressure, impacting all...

CVE-2020-27173

In vm-superio before 0.1.1, the serial console FIFO can grow to unlimited memory usage when data is sent to the input source i.e., standard input. This behavior cannot be reproduced from the guest side. When no rate limiting is in place, the host can be subject to memory pressure, impacting all...

Design/Logic Flaw

In vm-superio before 0.1.1, the serial console FIFO can grow to unlimited memory usage when data is sent to the input source i.e., standard input. This behavior cannot be reproduced from the guest side. When no rate limiting is in place, the host can be subject to memory pressure, impacting all...

Fewer False Alarms, Faster Reporting: InsightVM Introduces New One-Click Fix For False Positives

Let’s talk about false positives. They’re frustrating and faulty, but also about as certain as death and taxes for anyone working in IT security. The good news? We’ve added even more ways to reduce the noise they cause. According to Forrester Consulting’s 2019 study, customers have experienced a...

IBM Spectrum Protect Plus File Upload RCE

The IBM Spectrum Protect Plus SPP administrative console running on the remote host is affected by a remote code execution vulnerability due to the fact that it allows remote installation of console plugins. An unauthenticated, remote attacker can exploit this and CVE-2020-4711 together, via...

IBM WebSphere Application Server 8.5.x < 8.5.5.16 / 9.0.x < 9.0.5.0 XSS (CVE-2019-4271)

The IBM WebSphere Application Server running on the remote host is version 8.5.0.x prior to 8.5.5.16 or 9.0.x prior to 9.0.5.0. It is, therefore, affected by a cross-site scripting vulnerability in the WebSphere Application Server Admin Console due to improper validation of user-supplied input...

keycloak: security headers missing on REST endpoints

A flaw was found in Keycloak’s Admin Console, where it is missing HTTP security headers in HTTP responses. This issue is not a direct vulnerability and may not lead to a security issue, but increases the chances of allowing attackers to exploit other security flaws. Examples of these possible...

Guide: Scale or Fail — Why MSSPs Need Multitenant Security Solutions

Managed Security Services Providers MSSPs have it rough. They have the burden of protecting their client organizations from cyberattacks, with clients from different industries, different security stacks, and different support requirements. And everything is in a constant state of flux. MSSPs are...

Guide: Scale or Fail — Why MSSPs Need Multitenant Security Solutions

Managed Security Services Providers MSSPs have it rough. They have the burden of protecting their client organizations from cyberattacks, with clients from different industries, different security stacks, and different support requirements. And everything is in a constant state of flux. MSSPs are...

VulnCheck KEV: CVE-2019-7276

Optergy Proton/Enterprise devices allow Remote Root Code Execution via a Backdoor Console...

Informatica: ..; bypass leading to tomcat scripts [Unauthenticated]

Hello all Using the technique ..; i was able to bypass the protection mechanism to access Tomcat Example Scripts hosted at https://███/. Steps to reproduce 1 - Open all URL's bellow inside your browser https://█████████/..;/examples/servlets/servlet/SessionExample | Will lead to Session...

55 New Security Flaws Reported in Apple Software and Services

A team of five security researchers analyzed several Apple online services for three months and found as many as 55 vulnerabilities, 11 of which are critical in severity. The flaws — including 29 high severity, 13 medium severity, and 2 low severity vulnerabilities — could have allowed an attacke...

HPE KVM IP Console Switches Remote Code Injection Vulnerability

HPE KVM IP Console Switches is an HP switch device. A remote code injection vulnerability exists in HPE KVM IP Console Switches, which allows remote attackers to exploit the vulnerability by submitting a special request to execute arbitrary code in an application context...

Unbreakable Enterprise kernel security update

2.6.39-400.325.1 - media: rc: prevent memory leak in cx23888irprobe Navid Emamdoost Orabug: 31351676 CVE-2019-19054 - vgacon: Fix for missing check in scrollback handling Yunhai Zhang Orabug: 31705125 CVE-2020-14331 CVE-2020-14331 - rename kABI whitelists to lockedlists Dan Duval Orabug: 31783153...

keycloak: security headers missing on REST endpoints

A flaw was found in Keycloak’s Admin Console, where it is missing HTTP security headers in HTTP responses. This issue is not a direct vulnerability and may not lead to a security issue, but increases the chances of allowing attackers to exploit other security flaws. Examples of these possible...

Unauthorized Access Vulnerability in RG-NBR700G Router from Riptide Networks

RG-NBR700G is an Internet Behavior Management IBM router from Ruijie, which is designed for office scenarios. Unauthorized access vulnerability exists in RG-NBR700G, which can be exploited by an attacker to access the main page address of a web console or a connection that is not allowed to be...

The vulnerability in the Intel Raid Web Console 3, which exists due to insufficient validation of input data, allows a hacker to trigger a service failure.

The vulnerability of Intel Raid Web Console 3 exists due to insufficient verification of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

CVE-2019-4326

"HCL AppScan Enterprise security rules update administration section of the web application console is missing HTTP Strict-Transport-Security Header."...

CVE-2019-4326

The CVE-2019-4326 entry concerns HCL AppScan Enterprise: the security rules update administration section of the web application console lacks the HTTP Strict-Transport-Security (HSTS) header. Affected component is the admin/service console for AppScan Enterprise; underlying issue is missing HSTS...