CVE-2021-29212

A remote unauthenticated directory traversal security vulnerability has been identified in HPE iLO Amplifier Pack versions 1.80, 1.81, 1.90 and 1.95. The vulnerability could be remotely exploited to allow an unauthenticated user to run arbitrary code leading complete impact to confidentiality,...

CVE-2021-29212

A remote unauthenticated directory traversal security vulnerability has been identified in HPE iLO Amplifier Pack versions 1.80, 1.81, 1.90 and 1.95. The vulnerability could be remotely exploited to allow an unauthenticated user to run arbitrary code leading complete impact to confidentiality,...

CVE-2021-29212

CVE-2021-29212 affects HPE iLO Amplifier Pack on versions 1.80/1.81/1.90/1.95. It describes a remote unauthenticated directory traversal that enables arbitrary code execution with root context via the backup endpoint due to improper path validation. ZDI notes no auth required; a fix is available ...

CVE-2021-29212

A remote unauthenticated directory traversal security vulnerability has been identified in HPE iLO Amplifier Pack versions 1.80, 1.81, 1.90 and 1.95. The vulnerability could be remotely exploited to allow an unauthenticated user to run arbitrary code leading complete impact to confidentiality,...

HPE IlO Amplifier Pack 路径遍历漏洞

HPE IlO Amplifier Pack is a database management software for use in clustered environments from HPE, USA. The software supports Gen8, Gen9 and Gen10 Hewlett Packard Enterprise with automatic firmware and driver updates, manual or automatic recovery of firmware-corrupted systems, and maximizes...

Vulnerability fixed in HPE iLO

HPE has fixed a vulnerability in iLO Amplifier Pack. HPE iLO Amplifier Pack is an applicance that allows HPE iLO systems to be be managed. The vulnerability allows a malicious party to opportunity to execute arbitrary code on the HPE iLO Amplifier Pack. HPE recommends that after updating the HPE...

The vulnerability of the Token Authentication logic in the Action Controller component of the actionpack plugin for the Ruby on Rails software framework allows a hacker to cause a service failure due to uncontrolled resource consumption.

The vulnerability of the Token Authentication logic in the Action Controller component of the actionpack plugin for the Ruby on Rails software framework is related to insufficiently strict regular expressions. Exploiting this vulnerability could allow an attacker to cause a service failure...

Security Bulletin: Buffer overflow in IBM® Db2® tool db2licm (CVE-2018-1710).

Summary The Db2 tool db2licm is vulnerable to a buffer overflow. Vulnerability Details CVEID: CVE-2018-1710 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server tool db2licm is affected by buffer overflow vulnerability that can potentially result in arbitrary code executio...

GridPro Request Management For Windows Azure Pack 2.0.7905 Directory Traversal Vulnerability

GridPro Request Management for Windows Azure Pack versions 2.0.7905 and below suffer from a traversal vulnerability that can allow for arbitrary execution of Powershell scripts. PRODUCT : GridPro Request Management for Windows Azure Pack VENDOR : GridPro Software SEVERITY : Critical AFFECTED...

CVE-2021-40371

Gridpro Request Management for Windows Azure Pack before 2.0.7912 allows Directory Traversal for remote code execution, as demonstrated by ..\ in a scriptName JSON value to ServiceManagerTenant/GetVisibilityMap...

CVE-2021-40371

Gridpro Request Management for Windows Azure Pack before 2.0.7912 allows Directory Traversal for remote code execution, as demonstrated by ..\ in a scriptName JSON value to ServiceManagerTenant/GetVisibilityMap...

CVE-2021-40371

Gridpro Request Management for Windows Azure Pack before 2.0.7912 allows Directory Traversal for remote code execution, as demonstrated by ..\ in a scriptName JSON value to ServiceManagerTenant/GetVisibilityMap...

CVE-2021-40371

CVE-2021-40371 affects GridPro Request Management for Windows Azure Pack; vulnerable in versions before 2.0.7912. The flaw is a directory traversal in handling a scriptName JSON value in ServiceManagerTenant/GetVisibilityMap, enabling remote code execution. Patch is 2.0.7912. If exploited, it cou...

CVE-2021-40371

Gridpro Request Management for Windows Azure Pack before 2.0.7912 allows Directory Traversal for remote code execution, as demonstrated by ..\ in a scriptName JSON value to ServiceManagerTenant/GetVisibilityMap...

Microsoft Azure 路径遍历漏洞

Microsoft Azure is a suite of open, enterprise-grade cloud computing platforms from Microsoft Corporation USA. A path traversal vulnerability exists in Gridpro Request Management before Microsoft Azure Pack 2.0.7912 that allows directory traversal for remote code execution...

GridPro Request Management For Windows Azure Pack 2.0.7905 Directory Traversal

Certitude Securtiy Advisory - CSA-2021-003 PRODUCT : GridPro Request Management for Windows Azure Pack VENDOR : GridPro Software SEVERITY : Critical AFFECTED VERSION : =2.0.7905 IDENTIFIERS : CVE-2021-40371 PATCH VERSION : 2.0.7912 FOUND BY : Giulian Guran, Certitude Lab Introduction ------------...

Security Bulletin: Oracle Database Server Vulnerability Affects IBM Emptoris Sourcing (CVE-2021-2329)

Summary An Oracle database server vulnerability has been addressed by BM Emptoris Sourcing. Vulnerability Details CVEID: CVE-2021-2329 DESCRIPTION: An unspecified vulnerability in Oracle Database Server related to the XML DB component could allow an authenticated attacker to take control of the...

Security Bulletin: Oracle Database Server Vulnerability Affects IBM Emptoris Sourcing (CVE-2021-2328)

Summary An Oracle database server vulnerability has been addressed by IBM Emptoris Sourcing. Vulnerability Details CVEID: CVE-2021-2328 DESCRIPTION: An unspecified vulnerability in Oracle Database Server related to the Text component could allow an authenticated attacker to take control of the...

Security Bulletin: Oracle Database Server Security Vulnerability Affects IBM Emptoris Contract Management (CVE-2021-2328)

Summary An Oracle database server vulnerability has been addressed by IBM Emptoris Contract Management. Vulnerability Details CVEID: CVE-2021-2328 DESCRIPTION: An unspecified vulnerability in Oracle Database Server related to the Text component could allow an authenticated attacker to take contro...

Security Bulletin: Oracle Database Server Vulnerability Affects IBM Emptoris Supplier Lifecycle Mgmt (CVE-2021-2351)

Summary An Oracle database server vulnerability has been addressed by IBM Emptoris Supplier Lifecycle Mgmt. Vulnerability Details CVEID: CVE-2021-2351 DESCRIPTION: An unspecified vulnerability in Oracle Database Server related to the Advanced Networking Option component could allow an...