CVE-2021-22885: Generation of Error Message Containing Sensitive Information

A possible information disclosure / unintended method execution vulnerability in Action Pack = 2.0.0 when using the redirectto or polymorphicurlhelper with untrusted user input...

CVE-2021-30188

CODESYS V2 runtime system SP before 2.4.7.55 has a Stack-based Buffer Overflow...

CVE-2021-30186

CODESYS V2 runtime system SP before 2.4.7.55 has a Heap-based Buffer Overflow...

Getting a persistent shell on a 747 IFE

TL:DR The Coronavirus pandemic has hit the airline industry hard. One sad consequence was early retirement of most of the 747 passenger fleet. This does however create opportunities for aviation security research, as airframes are parked up before parting out in breakers yards. This 747 was flyin...

Security Bulletin: IBM MQ Appliance is affected by a Java SE vulnerability (CVE-2020-14781)

Summary IBM MQ Appliance has resolved a Java SE vulnerability. Vulnerability Details CVEID: CVE-2020-14781 DESCRIPTION: An unspecified vulnerability in Java SE related to the JNDI component could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality...

Security Bulletin: IBM MQ is vulnerable to an issue in IBM® Runtime Environment Java™ Technology Edition. (CVE-2020-14779)

Summary An issue was identified within IBM® Runtime Environment Java™ Technology Edition that is shipped with and used by IBM MQ. Vulnerability Details CVEID: CVE-2020-14779 DESCRIPTION: An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated...

Discourse 2.7.0.beta9 Security Update

A new Discourse update includes one security fix. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:discourse:discourse";...

PT-2021-8567

Name of the Vulnerable Software and Affected Versions BMC Remedy Mid Tier version 9.1SP3 Description The system is affected by remote and local file inclusion due to a lack of restrictions on targeted files. This can lead to attacks such as system fingerprinting, internal port scanning, Server Si...

BMC Software BMC Remedy 9.1SP3 日志信息泄露漏洞

BMC Software BMC Remedy 9.1SP3 is an application from BMC Software, Inc. It provides off-the-shelf IT Information Library ITIL service support functionality. A security vulnerability exists in BMC Remedy Mid Tier 9.1SP3 that originates from an unauthenticated user having access to remote logs,...

HPESBHF04130 rev.2 - HPE Synergy Systems with Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 4 (iLO 4), Multiple Remote and Local Vulnerabilities

Potential Security Impact: Local: Buffer Overflow; Remote: Cross-Site Scripting XSS, Carriage Return Line Feed CRLF Injection SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Synergy 480 Gen9 Compute Module - Prior to HPE Synergy Service Pack SSP 2021.05.01 HPE Synergy 480 Gen1...

HPESBHF04147 rev.1 - HPE Synergy Gen10/Gen10 Plus, GRUB2 Secure Boot Vulnerability, Local Execution of Arbitrary Code

Potential Security Impact: Local: Execution of Arbitrary Code SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Intelligent Provisioning - Prior to IP 3.62 for Gen10/Gen10 Plus, prior to IP 2.84 for Gen9 Scripting Toolkit for Linux - Prior to Scripting Toolkit for Linux 11.5121 Apr...

PT-2021-18042

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.0.0 through 7.3.5 Liferay DXP 7.0 before fix pack 97 Liferay DXP 7.1 before fix pack 21 Liferay DXP 7.2 before fix pack 10 Liferay DXP 7.3 before fix pack 1 Description: A cross-site scripting XSS issue exists in the...

PT-2021-18049

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.3.0 through 7.3.5 Liferay DXP 7.3 before fix pack 1 Description: The issue concerns the Data Engine module, which fails to check permissions in...

CVE-2021-29047

The SimpleCaptcha implementation in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.3 before fix pack 1 does not invalidate CAPTCHA answers after it is used, which allows remote attackers to repeatedly perform actions protected by a CAPTCHA challenge by reusing the same CAPTCHA answer...

PT-2021-18040

Name of the Vulnerable Software and Affected Versions: Liferay DXP version 7.3 before fix pack 1 Description: A denial-of-service issue exists in the Multi-Factor Authentication module, allowing remote authenticated attackers to prevent user authentication. This can be achieved by either enabling...

CVE-2021-32073

DedeCMS V5.7 SP2 contains a CSRF vulnerability that allows a remote attacker to send a malicious request to to the web manager allowing remote code execution...

Security Bulletin: Multiple Vulnerabilities in Apache HttpComponents and HttpCommons affect WebSphere Application Server

Summary There are multiple vulnerabilities in Apache HttpComponents and HttpCommons libraries which affect WebSphere Application Server. This has been addressed. Vulnerability Details CVEID: CVE-2015-5262 DESCRIPTION: Apache Commons is vulnerable to a denial of service, caused by the failure to...

HPE iLO Amplifier Pack Remote Code Execution Vulnerability

HPE IlO Amplifier Pack is a database management software for use in clustered environments from HPE, USA. The software supports Gen8, Gen9 and Gen10 Hewlett Packard Enterprise automatic update of firmware, drivers, support for manual or automatic recovery of firmware damage to the system, maximiz...

Microsoft Excel 2013 Service Pack 1 Multiple Vulnerabilities (KB5001936)

This host is missing an important security update according to Microsoft KB5001936 Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This...

Microsoft Office Remote Code Execution Vulnerabilities (KB5001927)

This host is missing an important security update according to Microsoft KB5001927 Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This...