Schneider Electric StruxureWare Data Center Expert 安全漏洞

Schneider Electric StruxureWare Data Center Expert StruxureWare Data Center Management Expert is a monitoring software from the French company Schneider Electric Schneider Electric. Suitable for a variety of organizations to monitor their company-wide power, cooling, security, environment. A...

CVE-2022-32520

A CWE-522: Insufficiently Protected Credentials vulnerability exists that could result in unwanted access to a DCE instance when performed over a network by a malicious third-party. This CVE is unique from CVE-2022-32518. Affected Products: Data Center Expert Versions prior to V7.9.0...

CVE-2022-32519

A CWE-257: Storing Passwords in a Recoverable Format vulnerability exists that could result in unwanted access to a DCE instance when performed over a network by a malicious third-party. Affected Products: Data Center Expert Versions prior to V7.9.0...

CVE-2022-32521

A CWE 502: Deserialization of Untrusted Data vulnerability exists that could allow code to be remotely executed on the server when unsafely deserialized data is posted to the web server. Affected Products: Data Center Expert Versions prior to V7.9.0...

CVE-2022-32519

CVE-2022-32519 affects Schneider Electric StruxureWare Data Center Expert prior to V7.9.0. The root cause is storing passwords in a recoverable format, which could allow a malicious third party to gain unauthorized, potentially full control over a DCE instance when accessed over a network. Affect...

CVE-2022-32518

CVE-2022-32518 affects Schneider Electric Data Center Expert prior to version 7.9.0. It is a CWE-522 Insufficiently Protected Credentials flaw that could allow unauthorized access to a DCE instance over a network by a malicious third party. The vulnerability impact is described as high/critical i...

Exploit for Argument Injection in Atlassian Bitbucket

CVE-2022-36804: Pre-Auth RCE in Atlassian Bitbucket Server A c...

HSTS configuration not working in confluence 8.0.2

h3. Issue Summary This is reproducible on Data Center: Yes h3. Steps to Reproduce Configure confluence on SSL Follow KB -...

Atlassian Bitbucket < 7.6.19 / 7.17.12 / 7.21.6 / 8.0.5 / 8.1.5 / 8.2.4 / 8.3.3 / 8.4.2 Command Injection

The version of Atlassian Bitbucket installed on the remote host 7.0.0 prior to 7.6.19, 7.7.0 prior to 7.17.12, 7.18.0 prior to 7.21.6, 8.0 prior to 8.0.5, 8.1 prior to 8.1.5, 8.2 prior to 8.2.4, 8.3 prior to 8.3.3 or 8.4 prior to 8.4.2. It is, therefore, affected by a command injection...

Recog Release v3.0.3

Recog Release v3.0.3, which is available now, includes updated fingerprints for Zoho ManageEngine PAM360, Password Manager Pro, and Access Manager Plus; Atlassian Bitbucket Server; and Supervisord Supervisor. It also includes new fingerprints and a number of bug fixes, all of which are detailed...

Wiz launches Australia cloud data center further demonstrating commitment to ANZ and multinational organizations

Wiz announces availability of new regional data center and adds support for Essential Eight controls...

PT-2023-5866

Name of the Vulnerable Software and Affected Versions HTTP/2 protocol affected versions not specified Description A flaw exists in the handling of multiplexed streams within the HTTP/2 protocol. Multiplexing allows multiple requests to be sent over a single TCP connection as parallel streams. A...

PT-2023-7517 · Atlassian · Confluence

Name of the Vulnerable Software and Affected Versions: Atlassian Confluence Server versions 4.x.x through 8.5.3 Atlassian Confluence Data Center versions 4.x.x through 8.6.1 Description: This issue allows an authenticated attacker, including one with anonymous access, to inject unsafe user input...

The vulnerability of the Huawei ManageOne data center management system, related to insufficient validation of input data, allows attackers to escalate their privileges.

The vulnerability of the Huawei ManageOne data center management system is related to insufficient validation of input data. Exploiting this vulnerability can allow attackers to enhance their privileges through specially created files...

Exploit for Expression Language Injection in Atlassian Confluence_Data_Center

CVE-2022-26134 练习 go 写 poc 用法 bash go get -u -v gith...

The CSV import function in JSM Insight’s data processing center for Atlassian Jira Server and Data Center is vulnerable, allowing attackers to perform SSRF attacks.

The vulnerability of the CSV import function in JSM Insight, a data processing tool for Atlassian Jira Server and Data Center, is related to insufficient validation of requests at the server side. Exploiting this vulnerability could allow a malicious actor to perform an SSRF attack remotely...

PT-2022-27618 · Atlassian +3 · Bitbucket Server +5

Name of the Vulnerable Software and Affected Versions: Jettison versions prior to 1.5.2 Bitbucket Data Center and Server versions 7.17.0 through 8.12.0 Description: A stack overflow in Jettison allows attackers to cause a Denial of Service DoS via crafted JSON data. This issue has a high impact o...

PT-2022-6900

Name of the Vulnerable Software and Affected Versions hutool-json version 5.8.10 org.json:json versions prior to 20230227 Bitbucket Data Center and Server versions 7.17.0 through 8.12.0 Description A stack overflow in the XML.toJSONObject component allows attackers to cause a Denial of Service Do...

Intel Data Center Manager 4.1 SQL Injection Vulnerability

Intel Data Center Manager's endpoint at "/DcmConsole/DataAccessServlet?action=getRoomRackData" is vulnerable to an authenticated, blind SQL injection attack when user-supplied input to the HTTP POST parameter "dataName" is processed by the web application. Versions 4.1 and below are affected. 1...

Intel Data Center Manager 5.1 Local Privilege Escalation Vulnerability

The latest version 5.1 and all prior versions of Intel's Data Center Manager are vulnerable to a local privileges escalation vulnerability using the application user "dcm" used to run the web application and the rest interface. An attacker who gained remote code execution using this dcm user i.e....