Allied Telesis CentreCOM AR260S 操作系统命令注入漏洞

The Allied Telesis CentreCOM AR260S is a basic VPN access router from Allied Telesis Japan. A security vulnerability exists in the Allied Telesis CentreCOM AR260S V2 version, which originates from an operating system command injection in the GUI settings page...

Ransomware updates & 1-day exploits

Introduction In our crimeware reporting service, we analyze the latest crime-related trends we come across. Last month, we again posted a lot on ransomware, but we also covered other subjects, such as 1-day exploits. In this blogpost, we provide excerpts from these reports. For questions or more...

RPCMon - RPC Monitor Tool Based On Event Tracing For Windows

A GUI tool for scanning RPC communication through Event Tracing for Windows ETW. The tool was published as part of a research on RPC communication between the host and a Windows container. Overview RPCMon can help researchers to get a high level view over an RPC communication between processes. I...

Vim, gVim: Multiple Vulnerabilities

Background Vim is an efficient, highly configurable improved version of the classic ‘vi’ text editor. gVim is the GUI version of Vim. Description Multiple vulnerabilities have been discovered in Vim and gVim. Please review the CVE identifiers referenced below for details. Impact Please review the...

Security Bulletin: CLI access security issue on IBM SAN Volume Controller and Storwize Family (CVE-2014-0880)

Summary CLI security issue Vulnerability Details CVEID: CVE-2014-0880 DESCRIPTION: An unauthorized user with network access to a system's administrative IP Internet Protocol address may be able to gain CLI Command Line Interface access to the system, allowing the user to issue all administrative...

Security Bulletin: Java vulnerability on IBM SAN Volume Controller and Storwize Family (CVE-2014-0411)

Summary Java vulnerability could allow decryption of long GUI session Vulnerability Details CVEID: CVE-2014-0411 DESCRIPTION: Java is used in the system’s GUI. Timing differences based on the validity of messages can be exploited to decrypt the entire session. The exploit is not trivial, requirin...

CVE-2022-25999

Uncontrolled search path element in the IntelR EnpirionR Digital Power Configurator GUI software, all versions may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2022-25999: Uncontrolled Search Path Element

Uncontrolled search path element in the IntelR EnpirionR Digital Power Configurator GUI software, all versions may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2022-29090: Cleartext Storage of Sensitive Information in GUI

Dell Wyse Management Suite 3.6.1 and below contains a Sensitive Data Exposure vulnerability. A low privileged malicious user could potentially exploit this vulnerability in order to obtain credentials. The attacker may be able to use the exposed credentials to access the target device and perform...

Intel® Enpirion® Digital Power Configurator GUI Advisory

This advisory contains CVEs in Altera products and has been transferred to Altera for support. The updated advisory can be found at the link below: https://www.altera.com/product-security/advisory-archive/intel-sa-00672.html...

Code injection

An issue in \Roaming\Mango\Plugins of University of Texas Multi-image Analysis GUI Mango 4.1 allows attackers to escalate privileges via crafted plugins...

CVE-2022-34567: Undefined Security Weakness

An issue in \Roaming\Mango\Plugins of University of Texas Multi-image Analysis GUI Mango 4.1 allows attackers to escalate privileges via crafted plugins...

[SECURITY] Fedora 36 Update: golang-gioui-0-9.20201225git18d4dbf.fc36

Immediate mode GUI programs in Go for Android, iOS, macOS, Linux, FreeBSD, OpenBSD, Windows, and WebAssembly experimental. See the project page gioui. org for documentation and more information...

CVE-2022-35632

The Velociraptor GUI contains an editor suggestion feature that can display the description field of a VQL function, plugin or artifact. This field was not properly sanitized and can lead to cross-site scripting XSS. This issue was resolved in Velociraptor 0.6.5-2...

Cross site scripting

The Velociraptor GUI contains an editor suggestion feature that can display the description field of a VQL function, plugin or artifact. This field was not properly sanitized and can lead to cross-site scripting XSS. This issue was resolved in Velociraptor 0.6.5-2...

CVE-2022-35632 XSS in User Interface

The Velociraptor GUI contains an editor suggestion feature that can display the description field of a VQL function, plugin or artifact. This field was not properly sanitized and can lead to cross-site scripting XSS. This issue was resolved in Velociraptor 0.6.5-2...

CVE-2022-35632

CVE-2022-35632 affects Velociraptor GUI: the editor’s suggestion feature exposes the description field of VQL functions, plugins, or artifacts without proper sanitization, enabling cross-site scripting (XSS). This issue was fixed in Velociraptor 0.6.5-2. The CVSS data in the entry indicates a MED...

CVE-2022-35632: Improper Neutralization of Input During Web Page Generation

The Velociraptor GUI contains an editor suggestion feature that can display the description field of a VQL function, plugin or artifact. This field was not properly sanitized and can lead to cross-site scripting XSS. This issue was resolved in Velociraptor 0.6.5-2...

Cannot create CS vServer via GUI - Error "Invalid argument [disallowserviceaccess]"

Cannot create CS vServer via GUI - Error "Invalid argument disallowserviceaccess"...

Security update for virtualbox (important)

openSUSE Security Update: Security update for virtualbox Announcement ID: openSUSE-SU-2022:10067-1 Rating: important References: 1198676 1198677 1198678 1198679 1198680 1198703 1199803 1201720 Cross-References: CVE-2022-21465 CVE-2022-21471 CVE-2022-21487 CVE-2022-21488 CVE-2022-21491...