CVE-2020-9351

An issue was discovered in SmartClient 12.0. If an unauthenticated attacker makes a POST request to /tools/developerConsoleOperations.jsp or /isomorphic/IDACall with malformed XML data in the transaction parameter, the server replies with a verbose error showing where the application resides the...

CVE-2020-9353

An issue was discovered in SmartClient 12.0. The Remote Procedure Call RPC loadFile provided by the console functionality on the /tools/developerConsoleOperations.jsp or /isomorphic/IDACall URL is affected by unauthenticated Local File Inclusion via directory-traversal sequences in the elem XML...

Path traversal

An issue was discovered in SmartClient 12.0. The Remote Procedure Call RPC saveFile provided by the console functionality on the /tools/developerConsoleOperations.jsp or /isomorphic/IDACall URL allows an unauthenticated attacker to overwrite files via vectors involving an XML comment and /.. path...

PT-2020-20606 · Isomorphic · Smartclient

Name of the Vulnerable Software and Affected Versions: SmartClient version 12.0 Description: An issue was discovered in the downloadWSDL feature, allowing unauthenticated exploitation of blind XXE. This can occur by sending a POST request to the "/tools/developerConsoleOperations.jsp" endpoint wi...

PT-2020-20607 · Isomorphic · Smartclient

Name of the Vulnerable Software and Affected Versions: SmartClient version 12.0 Description: An issue was discovered in the Remote Procedure Call RPC loadFile provided by the console functionality. The issue affects the /tools/developerConsoleOperations.jsp or /isomorphic/IDACall URL, where...

PT-2020-20605 · Isomorphic · Smartclient

Name of the Vulnerable Software and Affected Versions: SmartClient version 12.0 Description: An issue was discovered in SmartClient where an unauthenticated attacker can make a POST request to "/tools/developerConsoleOperations.jsp" or "/isomorphic/IDACall" with malformed XML data in the...

CVE-2020-9352

SmartClient 12.0 is affected by an unauthenticated blind XML External Entity (XXE) in the downloadWSDL feature. An attacker can trigger the vulnerability by sending a POST to /tools/developerConsoleOperations.jsp with a valid payload in the _transaction parameter. The issue is documented across m...

metasploit-framework

This is the Metasploit Framework repository, a widely used penetration testing tool. It is an offensive tool for penetration testing and vulnerability assessment. The primary target of this tool is the Metasploit Framework itself, which is a Ruby-based framework for developing and executing...

UBUNTU-CVE-2015-9543

An issue was discovered in OpenStack Nova before 18.2.4, 19.x before 19.1.0, and 20.x before 20.1.0. It can leak consoleauth tokens into log files. An attacker with read access to the service's logs may obtain tokens used for console access. All Nova setups using novncproxy are affected. This is...

PT-2020-7914

Name of the Vulnerable Software and Affected Versions: OpenStack Nova versions prior to 18.2.4 OpenStack Nova versions 19.x before 19.1.0 OpenStack Nova versions 20.x before 20.1.0 Description: The issue can leak consoleauth tokens into log files, allowing an attacker with read access to the...

The vulnerability of the Intel Raid Web Console 2 installer allows a hacker to increase their privileges.

The vulnerability of the Intel Raid Web Console 2 installer is related to incorrect standard resolutions. Exploiting this vulnerability can allow attackers to increase their privileges...

CVE-2019-20456

Goverlan Reach Console before 9.50, Goverlan Reach Server before 3.50, and Goverlan Client Agent before 9.20.50 have an Untrusted Search Path that leads to Command Injection and Local Privilege Escalation via DLL hijacking...

Security Bulletin: IBM FileNet Content Manager and Case Foundation security vulnerability in Administration Console for Content Platform Engine (ACCE)

Summary IBM FileNet Content Manager and Case Foundation have multiple security vulnerabilities in Administration Console for Content Platform Engine ACCE. Vulnerability Details CVEID: CVE-2019-4642 DESCRIPTION: IBM FileNet Content Manager allows web pages to be stored locally which can be read by...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server, which is shipped with, or a required product for, IBM Tivoli Network Manager IP Edition (CVE-2019-4268).

Summary IBM WebSphere Application Server is shipped with IBM Tivoli Network Manager IP Edition versions 3.9 and 4.1.1; IBM WebSphere Application Server is a required product for IBM Tivoli Network Manager IP Edition version 4.2. Information about a security vulnerability affecting IBM WebSphere...

CVE-2020-8647

A flaw was found in the Linux kernel’s virtual console resize functionality. An attacker with local access to virtual consoles can use the virtual console resizing code to gather kernel internal data structures. Mitigation The attack vector can be significantly reduced by preventing users from...

CVE-2020-8648

A use-after-free flaw was found in the Linux kernel console driver when using the copy-paste buffer. This flaw allows a local user to crash the system. Mitigation Mitigation for this issue is either not available or the currently available options dont meet the Red Hat Product Security criteria...

Unable to Add Workers to Bahrain or Hong Kong Regions

Challenge When adding a worker instance to the Bahrain or Hong Kong regions, the following error occurs: AWS was not able to validate the provided access credentials. Cause Veeam Backup for AWS uses the Global STS endpoint. Solution To add a worker to the Bahrain or Hong Kong regions, do the...

Console Driver Job Object Process Limit Bypass

The console driver in Windows 8.1 can be used to break out of a process with an active process job limit. Recent assessments: busterb at May 09, 2019 5:57pm UTC reported: Attacker requires too much control in advance for this to be useful. Assessed Attacker Value: 1 Assessed Attacker Value:...

Intel Raid Web Console 2 Elevation of Privilege Vulnerability

Intel Raid Web Console 2 is a web-based application from Intel Corporation that provides monitoring, maintenance, troubleshooting, and configuration capabilities for Intel RAID products. An elevation of privilege vulnerability exists in Intel Raid Web Console 2. An attacker can exploit the...

Intel RAID Web Console 3 (RWC3) for Windows Elevation of Privilege Vulnerability

Intel RAID Web Console 3 RWC3 is a Web-based application from Intel Corporation that provides monitoring, maintenance, troubleshooting, and configuration capabilities for Intel RAID products. Intel RAID Web Console 3 RWC3 for Windows elevation of privilege vulnerability. An attacker can exploit t...