High-Severity Cisco Flaw Found in CMX Software For Retailers

A high-severity flaw in Cisco’s smart Wi-Fi solution for retailers could allow a remote attacker to alter the password of any account user on affected systems. The vulnerability is part of a number of patches issued by Cisco addressing 67 high-severity CVEs on Wednesday. This included flaws found...

CVE-2021-1258 Cisco AnyConnect Secure Mobility Client Arbitrary File Read Vulnerability

A vulnerability in the upgrade component of Cisco AnyConnect Secure Mobility Client could allow an authenticated, local attacker with low privileges to read arbitrary files on the underlying operating system OS of an affected device. The vulnerability is due to insufficient file permission...

CVE-2021-1258

CVE-2021-1258 affects Cisco AnyConnect Secure Mobility Client. The upgrade component contains a flaw with insufficient file permission restrictions, allowing an authenticated, low-privilege, local attacker to read arbitrary files from the underlying OS by sending a crafted command via the local C...

CVE-2021-1237

Cisco AnyConnect Secure Mobility Client for Windows is affected by CVE-2021-1237 in the Network Access Manager and Web Security Agent components. The issue stems from insufficient validation of runtime-loaded resources, enabling an authenticated, local attacker with valid Windows credentials to c...

Cisco AnyConnect Secure Mobility Client Privilege Escalation (CVE-2020-3153)

A vulnerability exists in Cisco AnyConnect Secure Mobility Client. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

CVE-2020-24634

An attacker is able to remotely inject arbitrary commands by sending especially crafted packets destined to the PAPI Aruba Networks AP Management protocol UDP port 8211 of access-pointsor controllers in Aruba 9000 Gateway; Aruba 7000 Series Mobility Controllers; Aruba 7200 Series Mobility...

CVE-2020-24637

Two vulnerabilities in ArubaOS GRUB2 implementation allows for an attacker to bypass secureboot. Successful exploitation of this vulnerability this could lead to remote compromise of system integrity by allowing an attacker to load an untrusted or modified kernel in Aruba 9000 Gateway; Aruba 7000...

Code injection

An attacker is able to remotely inject arbitrary commands by sending especially crafted packets destined to the PAPI Aruba Networks AP Management protocol UDP port 8211 of access-pointsor controllers in Aruba 9000 Gateway; Aruba 7000 Series Mobility Controllers; Aruba 7200 Series Mobility...

CVE-2020-24637

CVE-2020-24637 concerns two vulnerabilities in ArubaOS GRUB2 that allow bypassing secure boot to load an untrusted kernel, potentially compromising system integrity remotely. Affected products include Aruba 9000 Gateway, Aruba 7000 Series Mobility Controllers, and Aruba 7200 Series Mobility Contr...

CVE-2020-24637

Two vulnerabilities in ArubaOS GRUB2 implementation allows for an attacker to bypass secureboot. Successful exploitation of this vulnerability this could lead to remote compromise of system integrity by allowing an attacker to load an untrusted or modified kernel in Aruba 9000 Gateway; Aruba 7000...

Aruba Networks ArubaOS Command Injection Vulnerability

Aruba Networks ArubaOS is an operating system for Aruba Mobility-Defined Networks including Mobility Controllers and Mobility Access Switches from Aruba Networks, Inc. A security vulnerability exists in ArubaOS. No information about this vulnerability is available at this time, so please stay tun...

Aruba Networks ArubaOS Security Vulnerabilities

Aruba Networks ArubaOS is an operating system for Aruba Mobility-Defined Networks including Mobility Controllers and Mobility Access Switches from Aruba Networks, Inc. A security vulnerability exists in ArubaOS. No information about this vulnerability is available at this time, so please stay tun...

SRC-2021-0007 : NetMotion Mobility Server MvcUtil valueStringToObject Deserialization of Untrusted Data Remote Code Execution Vulnerability

Vulnerability Details: This vulnerability allows remote attackers execute arbitrary code on affected installations of NetMotion Mobility Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the MvcUtil class. The issue results from the lack of prop...

Denial of Service Vulnerability in LTE Digital Cellular Mobile Network MME Devices (CNVD-2020-67628)

LTE digital cellular mobile communication network MME equipment is an important network element of LTE core network, which is responsible for processing signaling. A denial of service vulnerability exists in LTE Digital Cellular Mobile Communications Network MME devices. An attacker can exploit t...

CVE-2020-3556

CVE-2020-3556 affects Cisco AnyConnect Secure Mobility Client (Windows/macOS/Linux). The IPC listener lacks authentication, allowing a local, authenticated attacker to send crafted IPC messages to cause the targeted user to execute a script with the user’s privileges. Exploitation requires an ong...

CVE-2020-27123

CVE-2020-27123 affects Cisco AnyConnect Secure Mobility Client for Windows. A vulnerability in the Interprocess Communication (IPC) channel, due to an exposed IPC function, lets an authenticated, local attacker craft an IPC message to the AnyConnect process to read arbitrary files on the underlyi...

Cisco Zero-Day in AnyConnect Secure Mobility Client Remains Unpatched

Cisco has disclosed a zero-day vulnerability – for which there is not yet a patch – in the Windows, macOS and Linux versions of its AnyConnect Secure Mobility Client Software. While Cisco said it is not aware of any exploits in the wild for the vulnerability, it said Proof-of-Concept PoC exploit...

CVE-2020-3433

A vulnerability in the interprocess communication IPC channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows...

Citrix Systems XenMobile Server Cross-Site Scripting Vulnerability

Citrix Systems XenMobile Server is a mobility management solution from Citrix Systems. The solution is able to manage mobile devices, develop mobile policies and compliance rules, and gain insight into the operation of mobile mobile networks. A cross-site scripting vulnerability exists in Citrix...

Citrix Systems XenMobile Server Information Disclosure Vulnerability

Citrix Systems XenMobile Server is a mobility management solution from Citrix Systems. The solution is able to manage mobile devices, develop mobile policies and compliance rules, and gain insight into the operation of mobile mobile networks. An information disclosure vulnerability exists in Citr...