17641 matches found
This Week in Security News - January 14, 2022
This week, read about how crucial it is for security teams to adopt an integrated approach to threat detection, such as remote control, and Congress’s plan to update the Federal Information Security Management Act FISMA for the first time in eight years...
Design/Logic Flaw
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsin...
CVE-2021-34943
Bentley View 10.15.0.75 is affected by a JT-file parsing flaw that may read past the end of an allocated buffer due to insufficient validation. This can disclose sensitive information and, in conjunction with other vulnerabilities, potentially enable arbitrary code execution in the context of the...
CVE-2021-34937
Bentley View 10.15.0.75 is affected by CVE-2021-34937 due to a JT file parsing flaw that does not validate object existence before operating on it, enabling remote code execution with user interaction (the target must open a malicious file/page). The issue is described as a use-after-free-like co...
Improper Access Control
snipe/snipe-it is vulnerable to Improper Access Control. The vulnerability allows a remote authenticated attacker to view, edit and delete asset model information with DENY permissions...
Cisco Releases Security Updates for Multiple Products
Cisco has released security updates to address a vulnerability affecting Cisco Unified Contact Center Management Portal Unified CCMP and Cisco Unified Contact Center Domain Manager Unified CCDM. A remote attacker could exploit this vulnerability to take control of an affected system. CISCA...
CVE-2022-0013
The CVE-2022-0013 entry concerns a file information exposure in Palo Alto Networks Cortex XDR agent during support file generation. A local attacker can read arbitrary files with elevated privileges. Affected versions include Cortex XDR agent: 5.0 prior to 5.0.12; 6.1 prior to 6.1.9; 7.2 prior to...
CVE-2021-45388
CVE-2021-45388 is rejected/not used; reference CVE-2021-45608 instead.
Siemens COMOS Web Component Path Traversal Vulnerability
COMOS is a unified data platform for collaborative plant design, operations, and management that supports the collection, processing, storage, and distribution of information throughout the plant lifecycle.A path traversal vulnerability exists in the Siemens COMOS Web component, which could be...
Siemens COMOS Web Component SQL Injection Vulnerability
COMOS is a unified data platform for collaborative plant design, operations and management that supports the collection, processing, storage and distribution of information throughout the plant lifecycle.A SQL injection vulnerability exists in the Siemens COMOS Web component, which can be exploit...
CVE-2021-29701
CVE-2021-29701 affects IBM Engineering Workflow Management (EWM) versions 7.0, 7.0.1, 7.0.2 and IBM Rational Team Concert (RTC) 6.0.6 and 6.0.6.1. The vulnerability allows an authenticated attacker to obtain sensitive information from build definitions, enabling potential follow-on attacks. Root ...
CVE-2021-41769
CVE-2021-41769 affects Siemens SIPROTEC 5 devices (CPU variants CP050/CP100/CP300) with firmware versions before 8.83. The root cause is improper input validation in the web server, allowing an unauthenticated user to access device information. Impact is unauthorized disclosure of device data. Mi...
[SECURITY] [DLA 2876-1] vim security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-2876-1 [email protected] https://www.debian.org/lts/security/ Anton Gladky January 10, 2022 https://wiki.debian.org/LTS -...
CVE-2021-46166
CVE-2021-46166 affects Zoho ManageEngine Desktop Central prior to 10.0.662. The vulnerability allows authenticated users to disclose sensitive information from the database by visiting the Reports page. The available documents confirm an information-disclosure impact but do not provide exploit ve...
CVE-2022-22289
CVE-2022-22289 describes an improper access control vulnerability in the Samsung S Assistant prior to version 7.5. The accepted details across multiple sources confirm that the issue allows an attacker to remotely obtain sensitive information . The NVD metrics indicate a network-remote vector wit...