Check Point Response to CVE-2023-28133 - Local privilege escalation in Check Point Endpoint Security Client via crafted OpenSSL configuration file

Symptoms - Local privilege escalation in Check Point Endpoint Security Client. Affected versions: E87.30 and lower, including all E86.x clients. Affected clients: Standalone Remote Access VPN clients, Endpoint Security Clients with Remote Access VPN enabled. Affected processes: TracSrvWrapper.exe...

Virtuozzo Hybrid Infrastructure 5.4 Update 3 Hotfix 1 (5.4.3-102)

This update provides important security fixes. Vulnerability id: VSTOR-71357 Fixes for three high-severity and six medium-severity security vulnerabilities...

SA-2023-06-20-CVE-2023-28323

SECURITY ADVISORY 06-20-2023 Product Affected: Ivanti Endpoint Manager A vulnerability was recently discovered for EPM 2022 SU3 and all previous versions. We have a Hotfix available to remediate this vulnerability that can be found by going to CVE-2023-28323 Full details . Please log into the...

Virtuozzo Hybrid Infrastructure 5.4 Update 2 Hotfix 1 (5.4.2-66)

This update provides important improvements for the core storage and compute services. Vulnerability id: VSTOR-69329 The compute networking service may get stuck after an update to version 5.4 Update 2. Vulnerability id: VSTOR-66925, VSTOR-68759, VSTOR-69819 Important stability improvements...

Critical OAuth Vulnerability in Expo Framework Allows Account Hijacking

A critical security vulnerability has been disclosed in the Open Authorization OAuth implementation of the application development framework Expo.io. The shortcoming, assigned the CVE identifier CVE-2023-28131, has a severity rating of 9.6 on the CVSS scoring system. API security firm Salt Labs...

Virtuozzo PowerPanel Update 2 Hotfix 1 (7.0.4-77)

The update for Virtuozzo PowerPanel introduces stability fixes. Vulnerability id: PP-746 Controller installation may fail with a credentials-related error...

Veritas NetBackup prior to 10.0 Privilege Escalation (VTS23-006)

The Veritas NetBackup application installed on the remote Windows host is prior to 10.0 or is missing a vendor-supplied security hotfix. It is, therefore, affected by privilege escalation vulnerability. An issue was discovered in Veritas NetBackup before 10.0. A vulnerability in the way NetBackup...

How to Change the Software Open iSCSI IQN in XenServer

This article contains information about how to identify and change the software iSCSI initiator IQN. By default a random IQN is generated when you install XenServer formerly Citrix Hypervisor. The IQN is a requirement when running iSCSI to identify the XenServer host on the iSCSI network. It is...

Siemens Siveillance

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please seeSiemens' ProductCERT Security Advisories CERT Services | Services |...

Directory traversal

3CX before 18 Hotfix 1 build 18.0.3.461 on Windows allows unauthenticated remote attackers to read %WINDIR%\system32 files via /Electron/download directory traversal in conjunction with a path component that has a drive letter and uses backslash characters. NOTE: this issue exists because of an...

Directory traversal

3CX before 18 Update 2 Security Hotfix build 18.0.2.315 on Windows allows unauthenticated remote attackers to read certain files via /Electron/download directory traversal. Files may have credentials, full backups, call recordings, and chat logs...

CVE-2022-48482

CVE-2022-48482 affects 3CX Phone System on Windows prior to 18 Update 2 Security Hotfix 18.0.2.315. The issue is a directory traversal vulnerability in the /Electron/download interface that allows unauthenticated remote readers to access files (including credentials, backups, call recordings, and...

CVE-2022-48482

3CX before 18 Update 2 Security Hotfix build 18.0.2.315 on Windows allows unauthenticated remote attackers to read certain files via /Electron/download directory traversal. Files may have credentials, full backups, call recordings, and chat logs...

CVE-2023-2373 Ubiquiti EdgeRouter X Web Management command injection

A vulnerability was identified in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This vulnerability affects unknown code of the component Web Management Interface. Such manipulation of the argument ecn-up leads to command injection. The attack may be performed from remote. The exploit is publicly...

PT-2023-19204 · Ubiquiti · Edgerouter X

Name of the Vulnerable Software and Affected Versions: Ubiquiti EdgeRouter X versions up to 2.0.9-hotfix.6 Description: A critical issue has been found in the Web Service component, allowing for denial of service through remote attack. The exploit has been disclosed publicly. Recommendations: For...

Ubiquiti EdgeRouter 命令注入漏洞

The Ubiquiti EdgeRouter is a router from Ubiquiti, Inc. A command injection vulnerability exists in Ubiquiti EdgeRouter X version 2.0.9-hotfix.6 and prior versions, which stems from an incorrect manipulation of the parameter src that can lead to command injection...

PT-2023-19166

Name of the Vulnerable Software and Affected Versions Ubiquiti EdgeRouter X versions up to 2.0.9-hotfix.6 Description A critical issue was found in the Web Management Interface component. The manipulation of the ecn-up argument leads to command injection, allowing remote attacks. The exploit has...

Ubiquiti EdgeRouter 安全漏洞

The Ubiquiti EdgeRouter is a router from Ubiquiti USA. A security vulnerability exists in Ubiquiti EdgeRouter X version 2.0.9-hotfix.6 and prior versions. An attacker could exploit this vulnerability to cause a denial of service on the system...

Ubiquiti EdgeRouter 命令注入漏洞

The Ubiquiti EdgeRouter is a router from Ubiquiti USA. A command injection vulnerability exists in Ubiquiti EdgeRouter X version 2.0.9-hotfix.6 and prior versions, which stems from an incorrect operation of the parameter ecn-down that can lead to command injection...

Ubiquiti EdgeRouter 命令注入漏洞

The Ubiquiti EdgeRouter is a router from Ubiquiti USA. A command injection vulnerability exists in Ubiquiti EdgeRouter X version 2.0.9-hotfix.6 and prior versions, which stems from the fact that incorrect manipulation of the parameter suffix-rate-up can lead to command injection...