CVE-2021-22312

CVE-2021-22312 is a memory-leak vulnerability in Huawei devices (IPS Module, NGFW Module, Secospace USG6300/USG6500/USG6600/USG9500). The root cause is improper memory release after handling certain messages, allowing an authenticated remote attacker to trigger a leak by sending a specific messag...

CVE-2021-22312

There is a memory leak vulnerability in some Huawei products. An authenticated remote attacker may exploit this vulnerability by sending specific message to the affected product. Due to not release the allocated memory properly, successful exploit may cause some service abnormal. Affected product...

Huawei Data Communication: Denial of Service Vulnerability in Huawei Product (huawei-sa-20210210-03-dos)

There is a denial of service vulnerability in Huawei products. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software...

Imperva Observes Hive of Activity Following Hafnium Microsoft Exchange Disclosures

Introduction On 2 March 2021, Microsoft and Veloxity produced disclosures outlining the discovery of four zero day vulnerabilities affecting multiple versions of Microsoft Exchange Server. Each of the vulnerabilities have been attributed a severity rating from high to critical, however the most...

CVE-2021-22320

There is a denial of service vulnerability in Huawei products. A module cannot deal with specific messages correctly. Attackers can exploit this vulnerability by sending malicious messages to an affected module. This can lead to denial of service. Affected product include some versions of IPS...

Denial of service

There is a denial of service vulnerability in Huawei products. A module cannot deal with specific messages correctly. Attackers can exploit this vulnerability by sending malicious messages to an affected module. This can lead to denial of service. Affected product include some versions of IPS...

CVE-2021-22320

Summary of CVE-2021-22320 (Huawei) A denial-of-service vulnerability exists in several Huawei network devices where a module fails to properly handle certain messages, allowing an attacker to trigger a DoS by sending malicious messages. Affected products include IPS Module, NGFW Module, NIP6600, ...

CVE-2021-22320

There is a denial of service vulnerability in Huawei products. A module cannot deal with specific messages correctly. Attackers can exploit this vulnerability by sending malicious messages to an affected module. This can lead to denial of service. Affected product include some versions of IPS...

CVE-2020-15937

An improper neutralization of input vulnerability in FortiGate version 6.2.x below 6.2.5 and 6.4.x below 6.4.1 may allow a remote attacker to perform a stored cross site scripting attack XSS via the IPS and WAF logs dashboard...

Cross site scripting

An improper neutralization of input vulnerability in FortiGate version 6.2.x below 6.2.5 and 6.4.x below 6.4.1 may allow a remote attacker to perform a stored cross site scripting attack XSS via the IPS and WAF logs dashboard...

CVE-2020-15937

Fortinet FortiGate devices running FortiOS 6.2.x before 6.2.5 and 6.4.x before 6.4.1 are vulnerable to a stored cross‑site scripting (XSS) via the IPS/WAF logs dashboard caused by improper input neutralization. A remote attacker could exploit this via the logs dashboard. The connected documents p...

CVE-2020-35559

An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an unused function that allows an authenticated attacker to use up all available IPs of an account and thus not allow creation of new devices and users...

Code injection

An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an unused function that allows an authenticated attacker to use up all available IPs of an account and thus not allow creation of new devices and users...

olcne security update

kubernetes 1.18.10-3 - Kata CVE-2020-28914 kata-proxy 1.11.5-1 - Added Oracle Specific Build Files for kata-proxy kata-shim 1.11.5-1 - Added Oracle Specific Build Files for kata-shim kata-ksm-throttler 1.11.5-1 - Added Oracle Specific Build Files for kata-ksm-throttler kata-runtime 1.11.5-1 - Add...

Cisco Firepower Threat Defense Snort Application Detection Engine Policy Bypass (cisco-sa-snort-app-bypass-cSBYCATq)

According to its self-reported version, Cisco Firepower Threat Defense is affected by a vulnerability in the UTD SNORT IPS detection engine due to a flaw in the detection algorithm. An unauthenticated, remote attacker can exploit this by sending crafted packets that would flow through an affected...

Cisco IOS XE Products Snort Application Detection Engine Policy Bypass (cisco-sa-snort-app-bypass-cSBYCATq)

According to its self-reported version, Cisco IOS XE is affected by a vulnerability in the UTD SNORT IPS detection engine due to a flaw in the detection algorithm. An unauthenticated, remote attacker can exploit this by sending crafted packets that would flow through an affected system. A...

CVE-2021-3024

HashiCorp Vault and Vault Enterprise disclosed the internal IP address of the Vault node when responding to some invalid, unauthenticated HTTP requests. Fixed in 1.6.2 & 1.5.7...

AZL-35135 CVE-2020-8554 affecting package python-kubernetes for versions less than 21.7.0-1

Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status which is considered a privileged operation and should not...

AZL-34893 CVE-2020-8554 affecting package kubernetes for versions less than 1.28.3-2

Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status which is considered a privileged operation and should not...

kubernetes: MITM using LoadBalancer or ExternalIPs

A flaw was found in kubernetes. If a potential attacker can already create or edit services and pods, then they may be able to intercept traffic from other pods or nodes in the cluster...