Code injection

Dell EMC ECS, versions prior to 3.5, contains an Exposure of Resource vulnerability. A remote unauthenticated attacker can access the list of DT Directory Table objects of all internally running services and gain knowledge of sensitive data of the system...

CVE-2020-5386

Dell EMC ECS, versions prior to 3.5, contains an Exposure of Resource vulnerability. A remote unauthenticated attacker can access the list of DT Directory Table objects of all internally running services and gain knowledge of sensitive data of the system...

CVE-2020-5386

Dell EMC Elastic Cloud Storage (ECS) prior to version 3.5 contains an Exposure of Resource vulnerability. An unauthenticated remote attacker can access the list of DT (Directory Table) objects for all internal running services, gaining knowledge of sensitive system data due to improper management...

Denial of Service Vulnerability in VisualField VF***.dll Component at Zhejiang ZDAC Information Technology Co.

VisualField VF for short is a software package for control system configuration and monitoring for the ECS-700 system. A denial of service vulnerability exists in the VisualField VF.dll component of Zhejiang ZDZC Information Technology Co. An attacker can exploit this vulnerability to cause the...

Cloudsplaining - An AWS IAM Security Assessment Tool That Identifies Violations Of Least Privilege And Generates A Risk-Prioritized Report

Cloudsplaining is an AWS IAM Security Assessment tool that identifies violations of least privilege and generates a risk-prioritized HTML report. Example report Documentation For full documentation, please visit the project on ReadTheDocs. Installation Cheat sheet Example report Overview...

CVE-2020-3244

A vulnerability in the Enhanced Charging Service ECS functionality of Cisco ASR 5000 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to bypass the traffic classification rules on an affected device. The vulnerability is due to insufficient input validation of...

CVE-2020-3244

Cisco ASR 5000 Series Aggregation Services Routers contain an input validation flaw in the Enhanced Charging Service (ECS) feature that allows an unauthenticated, remote attacker to bypass traffic classification rules by sending a malformed HTTP request. The impact is the ability to avoid chargin...

CVE-2020-3244 Cisco ASR 5000 Series Aggregation Services Routers Enhanced Charging Service Rule Bypass Vulnerability

A vulnerability in the Enhanced Charging Service ECS functionality of Cisco ASR 5000 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to bypass the traffic classification rules on an affected device. The vulnerability is due to insufficient input validation of...

CVE-2020-3244 Cisco ASR 5000 Series Aggregation Services Routers Enhanced Charging Service Rule Bypass Vulnerability

A vulnerability in the Enhanced Charging Service ECS functionality of Cisco ASR 5000 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to bypass the traffic classification rules on an affected device. The vulnerability is due to insufficient input validation of...

Cisco ASR 5000 Series Aggregation Services Routers Enhanced Charging Service Rule Bypass Vulnerability

A vulnerability in the Enhanced Charging Service ECS functionality of Cisco ASR 5000 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to bypass the traffic classification rules on an affected device. The vulnerability is due to insufficient input validation of...

Huawei Data Communication: Multiple Vulnerabilities Released on Microsoft security advisory 4025685 (huawei-sa-20170909-01-windows)

Microsoft had released a Security Advisory 4025685 on June 14 to fix multiple critical security vulnerabilities in such systems as Microsoft Windows XP, Windows Server 2003, Windows VISTA, and Windows 8. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a...

Huawei Data Communication: RCE Vulnerability in Fastjson (huawei-sa-20191204-01-fastjson)

A remote code execution RCE vulnerability exists in the open- source JSON parsing library Fastjson. This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C...

Weaponizing AWS ECS Task Definitionsto Steal Credentials From Running Containers

The post Weaponizing AWS ECS Task Definitions to Steal Credentials From Running Containers appeared first on Rhino Security Labs...

Pillaging AWS ECS Task Definitions for Hardcoded Secrets

The post Pillaging AWS ECS Task Definitions for Hardcoded Secrets appeared first on Rhino Security Labs...

CVE-2019-6469

An error in the EDNS Client Subnet ECS feature for recursive resolvers can cause BIND to exit with an assertion failure when processing a response that has malformed RRSIGs. Versions affected: BIND 9.10.5-S1 - 9.11.6-S1 of BIND 9 Supported Preview Edition...

Dell EMC ECS Cross-Site Scripting Vulnerability

DELL EMC ELASTIC CLOUD STORAGE ECS software-defined object storage, designed for legacy and next-generation workloads, offers excellent scalability, flexibility and resiliency. Dell EMC ECS cross-site scripting vulnerability. The vulnerability stems from a lack of proper validation of client data...

CVE-2020-5317

Dell EMC ECS versions prior to 3.4.0.1 contain an XSS vulnerability. A remote authenticated malicious user could exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When victim users access the data store through their browsers, the malicious...

CVE-2020-5317

Dell EMC ECS versions prior to 3.4.0.1 contain an XSS vulnerability. A remote authenticated malicious user could exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When victim users access the data store through their browsers, the malicious...

Cross site scripting

Dell EMC ECS versions prior to 3.4.0.1 contain an XSS vulnerability. A remote authenticated malicious user could exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When victim users access the data store through their browsers, the malicious...

CVE-2020-5317

Dell EMC ECS is affected by a Cross‑Site Scripting (XSS) vulnerability in versions prior to 3.4.0.1. A remote authenticated attacker can store malicious HTML/JavaScript in a trusted application data store, which executes in victims’ browsers when accessing the data store. A fixed version is 3.4.0...