Security Bulletin: Vulnerabilities in GPFS affect InfoSphere BigInsights (CVE-2015-0197, CVE-2015-0198, CVE-2015-0199)

Summary GPFS is an IBM component that can be used as distributed file system in Big Insights. The GPFS that is shipped with InfoSphere BigInsights contains multiple security vulnerabilities. These vulnerabilities could allow a local attacker to execute programs with root privileges, and cause...

CVE-2021-1413

Multiple vulnerabilities in the web-based management interface of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an authenticated, remote attacker to execute arbitrary code with elevated privileges equivalent to the web service process on an affected device. These...

Information disclosure

Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or allow an authenticated, local attacker to gain escalated privileges on an affected system. For more information about these vulnerabilities, see the Details secti...

CVE-2021-1472 Cisco Small Business RV Series Routers Vulnerabilities

Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV Series Routers. A remote attacker could execute arbitrary commands or bypass authentication and upload files on an affected device. For more information about these vulnerabilities, see the Details...

CVE-2021-26758

Privilege Escalation in LiteSpeed Technologies OpenLiteSpeed web server version 1.7.8 allows attackers to gain root terminal access and execute commands on the host system...

CVE-2021-26758

Privilege Escalation in LiteSpeed Technologies OpenLiteSpeed web server version 1.7.8 allows attackers to gain root terminal access and execute commands on the host system...

CVE-2020-24139

Server-side request forgery in Wcms 0.3.2 lets an attacker send crafted requests from the back-end server of a vulnerable web application via the path parameter to wex/cssjs.php. It can help identify open ports, local network hosts and execute command on local services...

CVE-2020-24140

Server-side request forgery in Wcms 0.3.2 let an attacker send crafted requests from the back-end server of a vulnerable web application via the pagename parameter to wex/html.php. It can help identify open ports, local network hosts and execute command on local services...

CVE-2020-24139

Server-side request forgery in Wcms 0.3.2 lets an attacker send crafted requests from the back-end server of a vulnerable web application via the path parameter to wex/cssjs.php. It can help identify open ports, local network hosts and execute command on local services...

Server side request forgery (ssrf)

Server-side request forgery in Wcms 0.3.2 lets an attacker send crafted requests from the back-end server of a vulnerable web application via the path parameter to wex/cssjs.php. It can help identify open ports, local network hosts and execute command on local services...

CVE-2021-1459

A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. The vulnerability is due to improper validation of user-supplied input in the...

CVE-2020-24140

Server-side request forgery in Wcms 0.3.2 let an attacker send crafted requests from the back-end server of a vulnerable web application via the pagename parameter to wex/html.php. It can help identify open ports, local network hosts and execute command on local services...

CVE-2020-24139

Server-side request forgery in Wcms 0.3.2 lets an attacker send crafted requests from the back-end server of a vulnerable web application via the path parameter to wex/cssjs.php. It can help identify open ports, local network hosts and execute command on local services...

KODAK Lookout Converged Video System has a file upload vulnerability.

Ltd. is a leading provider of video and security products and solutions. A file upload vulnerability exists in the KODAK Lookout Converged Video System, which can be exploited by attackers to execute arbitrary commands...

Cisco Link Layer Discovery Protocol 缓冲区错误漏洞

Cisco Link Layer Discovery Protocol is a router from Cisco USA. A buffer overflow vulnerability exists in Cisco Link Layer Discovery Protocol, which can be exploited by an unauthenticated, neighboring attacker to execute arbitrary code...

CVE-2021-30058

Knowage Suite before 7.4 is vulnerable to cross-site scripting XSS. An attacker can inject arbitrary external script in '/knowagecockpitengine/api/1.0/pages/execute' via the 'SBIHOST' parameter...

CVE-2021-28832

VSCodeVim before 1.19.0 allows attackers to execute arbitrary code via a crafted workspace configuration...

Knowage 跨站脚本漏洞

Knowage is a suite of open source tools for modern business analytics. A cross-site scripting vulnerability exists in Knowage versions prior to 7.4, which can be exploited by an attacker to inject arbitrary external scripts in '/knowagecockpitengine/api/1.0/pages/execute' via the 'SBIHOST'...

Bosch Video Client Code Issue Vulnerability

Bosch Video Client is an application from the German company Bosch. It is used to display cameras connected to the network in real time. A code issue vulnerability exists in Bosch Video Client, which can be exploited by an attacker to execute arbitrary code on a victim's system...

Rockwell Automation FactoryTalk AssetCentre SQL Injection Vulnerability

Rockwell Automation FactoryTalk AssetCentre is an asset management software tool from Rockwell Automation that allows manufacturers and industrial companies to centrally manage controllers and other automation-related assets. An SQL injection vulnerability exists in Rockwell Automation FactoryTal...