The vulnerability of the CLI component in Cisco IOS XE routers for Cisco IOS XE SD-WAN allows a attacker to execute arbitrary commands with superuser privileges.

The vulnerability of Cisco IOS XE operating system-based routers in Cisco IOS XE SD-WAN solutions exists due to insufficient validation of input data. Exploiting this vulnerability can allow attackers to execute arbitrary commands with superuser privileges...

Catalyst IT Mahara Cross-Site Request Forgery Vulnerability

Catalyst IT Mahara is a social networking system from Catalyst IT Catalyst It in New Zealand. The system includes a blog, resume builder, file manager and more. A cross-site request forgery vulnerability exists in Catalyst IT Mahara 20.10, which can be exploited by an attacker to delete inbox-mai...

The vulnerability of the Samba networking communication package, related to pointer arithmetic errors, allows a hacker to trigger a service failure.

The vulnerability of the Samba networking communication package is related to errors in pointer manipulation. Exploiting this vulnerability can allow a remote attacker to cause service failures...

DEBIAN-CVE-2021-20206

An improper limitation of path name flaw was found in containernetworking/cni in versions before 0.8.1. When specifying the plugin to load in the 'type' field in the network configuration, it is possible to use special elements such as "../" separators to reference binaries elsewhere on the syste...

AZL-44838 CVE-2021-20206 affecting package buildah for versions less than 1.41.4-2

An improper limitation of path name flaw was found in containernetworking/cni in versions before 0.8.1. When specifying the plugin to load in the 'type' field in the network configuration, it is possible to use special elements such as "../" separators to reference binaries elsewhere on the syste...

Design/Logic Flaw

An improper limitation of path name flaw was found in containernetworking/cni in versions before 0.8.1. When specifying the plugin to load in the 'type' field in the network configuration, it is possible to use special elements such as "../" separators to reference binaries elsewhere on the syste...

CVE-2021-20206

An improper limitation of path name flaw was found in containernetworking/cni in versions before 0.8.1. When specifying the plugin to load in the 'type' field in the network configuration, it is possible to use special elements such as "../" separators to reference binaries elsewhere on the syste...

Securing our approach to domain fronting within Azure

Every single day our teams analyze the trillions of signals we see to understand attack vectors, and then take those learnings and apply them to our products and solutions. Having that understanding of the threat landscape is key to ensuring our customers are kept safe every day. However, being a...

Cisco IOS XE Software 路径遍历漏洞

Cisco IOS XE is a set of modular operating system based on Linux kernel developed by Cisco for its network equipment. A command injection vulnerability exists in the web UI of Cisco IOS XE. The vulnerability stems from insufficient input validation. An attacker can exploit this vulnerability by...

Cisco IOS XE SD-WAN Software 默认配置问题漏洞

Cisco IOS XE is a set of modular operating system based on Linux kernel developed by Cisco for its network equipment. An elevation of privilege vulnerability exists in role-based access control for SD-WAN in Cisco IOS XE. The vulnerability stems from the use of a default configuration for console...

多款Netgear产品命令注入漏洞

Netgear RBK753 and others are products of Netgear USA.RBK753 is a home WiFi system.RBR750 is a home WiFi system.NETGEAR is a router. A command injection vulnerability exists in multiple Netgear products that allows an unauthenticated attacker to inject commands. The following products and version...

The vulnerability of Google Chrome’s networking component allows attackers to gain access to confidential data.

The vulnerability of the networking component of Google Chrome is related to insufficient implementation of policies. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data...

[SECURITY] Fedora 34 Update: glib-networking-2.68~rc-1.fc34

This package contains modules that extend the networking support in GIO. In particular, it contains libproxy- and GSettings-based GProxyResolver implementations and a gnutls-based GTlsConnection implementation...

Fedora: Security Advisory for glib-networking (FEDORA-2021-303f6623fa)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Critical F5 BIG-IP Flaw Now Under Active Attack

Attackers are exploiting a recently-patched, critical vulnerability in F5 devices that have not yet been updated. The unauthenticated remote command execution flaw CVE-2021-22986 exists in the F5 BIG-IP and BIG-IQ enterprise networking infrastructure, and could allow attackers to take full contro...

QEMU: slirp: use-after-free in ip_reass() function in ip_input.c

A use-after-free flaw was found in the SLiRP networking implementation of the QEMU emulator. Specifically, this flaw occurs in the ipreass routine while reassembling incoming IP fragments whose combined size is bigger than 65k. This flaw allows an attacker to crash the QEMU process on the host,...

SUSE SLES12 Security Update : kernel (SUSE-SU-2021:0835-1)

This update for the Linux Kernel 4.4.121-92149 fixes several issues. The following security issues were fixed : CVE-2020-27786: Fixed a potential user after free which could have led to memory corruption or privilege escalation bsc1179616. CVE-2020-28374: Fixed insufficient identifier checking in...

Improper access control

HLOS to access EL3 stack canary by just mapping imem region due to Improper access control and can lead to information exposure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice ...

Design/Logic Flaw

Part of RPM region was not protected from xblSec itself due to improper policy and leads to unprivileged access in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking...

Information disclosure

Usage of syscall by non-secure entity can allow extraction of secure QTEE diagnostic information in clear text form due to insufficient checks in the syscall handler and leads to information disclosure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,...