PT-2021-21230

Name of the Vulnerable Software and Affected Versions Dell EMC Streaming Data Platform versions prior to 1.3 Description The issue allows a remote malicious user to potentially execute SQL commands, performing unauthorized actions and retrieving sensitive information from the database...

CVE-2021-36327: Server-Side Request Forgery (SSRF)

Dell EMC Streaming Data Platform versions before 1.3 contain a Server Side Request Forgery Vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to perform port scanning of internal networks and make HTTP requests to an arbitrary domain of the attacker's choi...

CVE-2021-36329: Authorization Bypass Through User-Controlled Key

Dell EMC Streaming Data Platform versions before 1.3 contain an Indirect Object Reference Vulnerability. A remote malicious user may potentially exploit this vulnerability to gain sensitive information...

Dell Emc Streaming Data Platform security vulnerabilities

Dell Emc Streaming Data Platform is a platform for ingesting, storing and analyzing continuous streaming data in real time from Dell USA. communication to an unencrypted format...

CVE-2021-36326: Selection of Less-Secure Algorithm During Negotiation

Dell EMC Streaming Data Platform, versions prior to 1.3 contain an SSL Strip Vulnerability in the User Interface UI. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to a downgrade in the communications between the client and server into an unencrypted forma...

PT-2021-21233

Name of the Vulnerable Software and Affected Versions Dell EMC Streaming Data Platform versions prior to 1.3 Description The issue allows a remote unauthenticated attacker to potentially reuse old session artifacts and impersonate a legitimate user due to insufficient session expiration...

CVE-2021-36330: Insufficient Session Expiration

Dell EMC Streaming Data Platform versions before 1.3 contain an Insufficient Session Expiration Vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to reuse old session artifacts to impersonate a legitimate user...

CVE-2021-36326

Dell EMC Streaming Data Platform, versions prior to 1.3 contain an SSL Strip Vulnerability in the User Interface UI. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to a downgrade in the communications between the client and server into an unencrypted forma...

CVE-2021-36329

Dell EMC Streaming Data Platform versions before 1.3 contain an Indirect Object Reference Vulnerability. A remote malicious user may potentially exploit this vulnerability to gain sensitive information...

CVE-2021-36328

Dell EMC Streaming Data Platform versions before 1.3 contain a SQL Injection Vulnerability. A remote malicious user may potentially exploit this vulnerability to execute SQL commands to perform unauthorized actions and retrieve sensitive information from the database...

Cisco HyperFlex HX Data Platform Command Injection Vulnerability

Cisco HyperFlex HX Installer Virtual Machine contains an insufficient input validation vulnerability which could allow an attacker to execute commands on an affected device as the tomcat8 user...

IBM Cloud Pak for Data Information Disclosure Vulnerability (CNVD-2021-95146)

Ibm Cloud Pak For Data is an open and scalable data platform from Ibm USA, Inc. provides a data structure that makes all data available for AI and analytics on any cloud.A security vulnerability exists in IBM Cloud Pak for Data that stems from the fact that IBM Cloud Pak for Data can allow a loca...

ingenii-azure-data-platform (>=0.0.2, <=0.0.5), python-fx (0.1.0b2.post1) potentially affected by CVE-2021-38305 via yamale (>=3.0.6, <=3.0.7)

yamale PYPI version =3.0.6, =0.0.2, =0.0.5 - python-fx 0.1.0b2.post1 Source cves: CVE-2021-38305 Source advisory: OSV:GHSA-435P-F82X-MXWM...

ingenii-azure-data-platform (>=0.0.2, <=0.0.5), python-fx (0.1.0b2.post1) potentially affected by CVE-2021-38305 via yamale (>=3.0.6, <=3.0.7)

yamale PYPI version =3.0.6, =0.0.2, =0.0.5 - python-fx 0.1.0b2.post1 Source cves: CVE-2021-38305 Source advisory: GHSA-435P-F82X-MXWM...

ingenii-azure-data-platform (>=0.0.2, <=0.0.5), python-fx (0.1.0b2.post1) potentially affected by CVE-2021-38305 via yamale (>=3.0.6, <=3.0.7)

yamale PYPI version =3.0.6, =0.0.2, =0.0.5 - python-fx 0.1.0b2.post1 Source cves: CVE-2021-38305 Source advisory: OSV:PYSEC-2021-119...

Cisco HyperFlex HX Data Platform File Upload / Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Cisco HyperFlex HX Data Platform unauthenticated file upload to RCE CVE-2021-1499', 'Description' = %q This module exploits an unauthenticated fi...

Cisco HyperFlex HX Data Platform Web Interface Arbitrary File Upload

The vulnerability in the web interface for managing data storage systems in Cisco HyperFlex HX Data Platform deployments is related to the absence of authentication procedures. Exploiting this vulnerability allows an attacker to upload arbitrary files by sending specially crafted HTTP requests...

Metasploit Wrap-Up

NSClient++ Community contributor Yann Castel has contributed an exploit module for NSClient++ which targets an authenticated command execution vulnerability. Users that are able to authenticate to the service as admin can leverage the external scripts feature to execute commands with SYSTEM level...

SQL Injection Vulnerability in Jiangsu Wo Ye Software Co.

Jiangsu Wo Ye Software Co., Ltd. focuses on auditing, housing construction, transportation, municipal, seven-color sheep and office automation and other engineering projects throughout the process of management of big data information platform development, engaged in intelligent government cloud...

CVE-2021-1499

A vulnerability in the web-based management interface of Cisco HyperFlex HX Data Platform could allow an unauthenticated, remote attacker to upload files to an affected device. This vulnerability is due to missing authentication for the upload function. An attacker could exploit this vulnerabilit...