esc bug fix and enhancement update

An update is available for esc. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Linux 9.1...

Metasploit Weekly Wrap-Up

ADCS - ESC Vulnerable certificate template finder Our very own Grant Willcox has developed a new module which allows users to query a LDAP server for vulnerable Active Directory Certificate Services AD CS certificate templates. The module will print the detected certificate details, and the attac...

esc bug fix and enhancement update

An update is available for esc. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Linux 8.7...

esc-clermont.fr Cross Site Scripting vulnerability OBB-2846825

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Cross-site Scripting in tempura

This affects the package tempura before 0.4.0. If the input to the esc function is of type object i.e an array it is returned without being escaped/sanitized, leading to a potential Cross-Site Scripting vulnerability...

Cross-Site Scripting (XSS)

tempura is vulnerable to cross-site scripting XSS attacks. An attacker is able to inject malicious object type inputs to the esc function resulting in a potential cross-site scripting vulnerability due to the lack of sanitations inside the function...

Cross site scripting

This affects the package tempura before 0.4.0. If the input to the esc function is of type object i.e an array it is returned without being escaped/sanitized, leading to a potential Cross-Site Scripting vulnerability...

Cross-site Scripting (XSS)

Overview tempura is an A light, crispy, and delicious template engine. Affected versions of this package are vulnerable to Cross-site Scripting XSS. If the input to the esc function is of type object i.e an array it is returned without being escaped/sanitized, leading to a potential Cross-Site...

esc bug fix and enhancement update

An update is available for esc. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The esc packages contain the Enterprise Security Client ESC, which allows the use...

esc bug fix and enhancement update

An update is available for esc. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Enterprise...

CVE-2021-1312

A vulnerability in the system resource management of Cisco Elastic Services Controller ESC could allow an unauthenticated, remote attacker to cause a denial of service DoS to the health monitor API on an affected device. The vulnerability is due to inadequate provisioning of kernel parameters for...

Design/Logic Flaw

A vulnerability in the system resource management of Cisco Elastic Services Controller ESC could allow an unauthenticated, remote attacker to cause a denial of service DoS to the health monitor API on an affected device. The vulnerability is due to inadequate provisioning of kernel parameters for...

CVE-2021-1312

Cisco Elastic Services Controller (ESC) is affected by CVE-2021-1312, a DoS in the system resource management that can be triggered by a flood of crafted TCP packets to block TCP listen ports used by the health monitor API. The root cause is inadequate provisioning of kernel parameters for the ma...

CVE-2021-1312 Cisco Elastic Services Controller Denial of Service Vulnerability

A vulnerability in the system resource management of Cisco Elastic Services Controller ESC could allow an unauthenticated, remote attacker to cause a denial of service DoS to the health monitor API on an affected device. The vulnerability is due to inadequate provisioning of kernel parameters for...

Cisco Elastic Services Controller Denial of Service Vulnerability

A vulnerability in the system resource management of Cisco Elastic Services Controller ESC could allow an unauthenticated, remote attacker to cause a denial of service DoS to the health monitor API on an affected device. The vulnerability is due to inadequate provisioning of kernel parameters for...

Kubernetes: Half-Blind SSRF found in kube/cloud-controller-manager can be upgraded to complete SSRF (fully crafted HTTP requests) in vendor managed k8s service.

Hello, Who we are : We’re two French security researchers and our respective names are Brice Augras and Christophe Hauquiert, we worked and found the vulnerability together. Brice Augras from https://www.groupe-asten.fr/ company - https://hackerone.com/reeverzax Christophe Hauquiert -...

Authentication flaw

A vulnerability in the REST API of Cisco Elastic Services Controller ESC could allow an unauthenticated, remote attacker to bypass authentication on the REST API. The vulnerability is due to improper validation of API requests. An attacker could exploit this vulnerability by sending a crafted...

CVE-2019-1867 Cisco Elastic Services Controller REST API Authentication Bypass Vulnerability

A vulnerability in the REST API of Cisco Elastic Services Controller ESC could allow an unauthenticated, remote attacker to bypass authentication on the REST API. The vulnerability is due to improper validation of API requests. An attacker could exploit this vulnerability by sending a crafted...

CVE-2019-1867

CVE-2019-1867 affects Cisco Elastic Services Controller (ESC) REST API authentication; an unauthenticated, remote attacker could bypass REST API authentication due to improper validation of API requests, potentially executing arbitrary actions with administrative privileges. Exploitable on ESC re...

CVE-2018-17491

EasyLobby Solo could allow a local attacker to gain elevated privileges on the system. By visiting the kiosk and typing "esc" to exit the program, an attacker could exploit this vulnerability to perform unauthorized actions on the computer...