Citrix Systems Citrix Gateway 和 Citrix ADC 安全漏洞

Citrix Systems Citrix Gateway Citrix Systems NetScaler Gateway and Citrix ADC are both products of Citrix Systems, Inc.Citrix Gateway is a secure remote access solution. The product provides administrators with application-level and data-level controls to enable users to remotely access...

Image Optimizer, Resizer and CDN < 6.8.1 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. Step 1: Install the plugin and register for an...

Fortinet FortiADC SQL Injection Vulnerability (CNVD-2023-02484)

Fortinet FortiADC is an application delivery controller from Fortinet, Inc. Fortinet FortiADC is vulnerable to SQL injection, which stems from the use of special elements that are not neutralized and can be exploited by an attacker to execute unauthorized code or send commands via specially craft...

Ten Reasons a Website Needs a CDN

Today’s website visitors expect a fast and efficient user experience with no delays or site performance issues. However, high traffic volumes and global reaching websites mean website managers are faced with the challenge of added latency and slow page load times, which can result in lost busines...

Security Bulletin: IBM Cloud Transformation Advisor is affected by a vulnerability in WebSphere Application Server Liberty (CVE-2018-1902)

Summary IBM Cloud Transformation Advisor has addressed the following vulnerability. CVE-2018-1902 Vulnerability Details CVEID: CVE-2018-1902 DESCRIPTION: IBM WebSphere Application Server could allow a remote attacker to spoof connection information which could be used to launch further attacks...

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance may be vulnerable to arbitrary code execution due to CVE-2022-1355

Summary LibTIFF is not used directly by IBM App Connect Enterprise Certified Container but is present in the DesignerAuthoring image used for mapping assistance, which may be vulnerable to arbitrary code execution or denial of service. This bulletin provides patch information to address the...

(Pwn2Own) Microsoft Teams URL Allowlist Bypass Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Teams. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the enforcement of...

Malicious Package

Overview firefoxupdate is a malicious package. This is a "dependency confusion" package, which means the package name is based on existing repositories, namespaces, or components. It aims to trick users into downloading the package which contains obfuscated malicious code and initiates connection...

DEV-0569 finds new ways to deliver Royal ransomware, various payloads

Recent activity from the threat actor that Microsoft tracks as DEV-0569, known to distribute various payloads, has led to the deployment of the Royal ransomware, which first emerged in September 2022 and is being distributed by multiple threat actors. Observed DEV-0569 attacks show a pattern of...

DEV-0569 finds new ways to deliver Royal ransomware, various payloads

Recent activity from the threat actor that Microsoft tracks as DEV-0569, known to distribute various payloads, has led to the deployment of the Royal ransomware, which first emerged in September 2022 and is being distributed by multiple threat actors. Observed DEV-0569 attacks show a pattern of...

CVE-2022-39383

KubeVela is an open source application delivery platform. Users using the VelaUX APIServer could be affected by this vulnerability. When using Helm Chart as the component delivery method, the request address of the warehouse is not restricted, and there is a blind SSRF vulnerability. Users who're...

F5 BIG-IP 跨站请求伪造漏洞

F5 BIG-IP is an application delivery platform that integrates network traffic management, application security management, and load balancing from F5 USA. A security vulnerability exists in F5 BIG-IP. An attacker exploited the vulnerability to perform cross-site request forgery via iControl SOAP...

F5 BIG-IP 命令注入漏洞

F5 BIG-IP is an application delivery platform that integrates network traffic management, application security management, load balancing, and other features from F5 USA. A security vulnerability exists in F5 BIG-IP. An attacker can bypass the restrictions of F5 BIG-IP via iControl REST to elevat...

kernel: KVM: NULL pointer dereference in kvm_irq_delivery_to_apic_fast()

A flaw was found in the Linux kernel’s KVM when attempting to set a SynIC IRQ. This issue makes it possible for a misbehaving VMM to write to SYNIC/STIMER MSRs, causing a NULL pointer dereference. This flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a...

The vulnerability of Citrix ADC application delivery controllers (formerly known as Citrix NetScaler Application Delivery Controller), as well as Citrix Gateway access control systems (formerly known as Citrix NetScaler Gateway), relates to bypassing authentication procedures by using an alternative path or channel. This allows attackers to increase their privileges.

The vulnerability of the Citrix ADC application delivery controller previously called Citrix NetScaler Application Delivery Controller and the Citrix Gateway access control system previously called Citrix NetScaler Gateway relates to bypassing authentication procedures by using an alternative pat...

kernel: KVM: NULL pointer dereference in kvm_irq_delivery_to_apic_fast()

A flaw was found in the Linux kernel’s KVM when attempting to set a SynIC IRQ. This issue makes it possible for a misbehaving VMM to write to SYNIC/STIMER MSRs, causing a NULL pointer dereference. This flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a...

Citrix Gateway和Citrix ADC 数据伪造问题漏洞

Citrix Systems Citrix Gateway Citrix Systems NetScaler Gateway and Citrix ADC are both products of Citrix Systems, Inc.Citrix Gateway is a secure remote access solution. The product provides administrators with application-level and data-level controls to enable users to remotely access...

Citrix Gateway和Citrix ADC 安全漏洞

Citrix Systems Citrix Gateway Citrix Systems NetScaler Gateway and Citrix ADC are both products of Citrix Systems, Inc.Citrix Gateway is a secure remote access solution. The product provides administrators with application-level and data-level controls to enable users to remotely access...

Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to denial of service due to CVE-2022-36083

Summary Node.js module jose is used by IBM App Connect Enterprise Certified Container for securing internal communications and in connections by connectors to SaaS endpoints. IBM App Connect Enterprise Certified Container operands may be vulnerable to denial of service. This bulletin provides pat...

CVE-2022-20960

A vulnerability in Cisco AsyncOS Software for Cisco Email Security Appliance ESA could allow an unauthenticated remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to improper handling of certain TLS connections that are processed by an...