CVE-2021-45024

CVE-2021-45024 affects ASG-Zena Cross Platform Server Enterprise Edition 4.2.1. The connected documents describe an XML External Entity (XXE) vulnerability in the XML import handling that can lead to SSRF and data exfiltration via the server (endpoints such as oc_main/zenaweb/scheduler/operation)...

PT-2022-12290

Name of the Vulnerable Software and Affected Versions ASG-Zena Cross Platform Server Enterprise Edition version 4.2.1 Description The issue concerns an XML External Entity XXE problem. No information is provided about the estimated number of potentially affected devices worldwide or real-world...

ASG Technologies ASG-Zena Cross Platform Server Enterprise Edition – Cross-Site Script Vulnerability

ASG technologies ASG-Zena Cross Platform Server Enterprise Edition is a modern multi-platform workload automation solution from ASG technologies, Inc. A cross-site scripting vulnerability exists in ASG technologies ASG-Zena Cross Platform Server Enterprise Edition version 4.2.1, which stems from...

PT-2022-12292 · Asg · Asg-Zena Cross Platform Server Enterprise Edition

Name of the Vulnerable Software and Affected Versions: ASG-Zena Cross Platform Server Enterprise Edition version 4.2.1 Description: The issue is related to Cross Site Scripting XSS. No information is provided about the estimated number of potentially affected devices worldwide or real-world...

CVE-2021-45024: Improper Restriction of XML External Entity Reference

ASG technologies A Rocket Software Company ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to XML External Entity XXE...

CVE-2021-45026: Improper Neutralization of Input During Web Page Generation

ASG technologies ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to Cross Site Scripting XSS...

CVE-2021-45025: Cleartext Storage of Sensitive Information

ASG technologies A Rocket Software Company ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to Cleartext Storage of Sensitive Information in a Cookie...

@proactive-as/angular.vendor (8.0.0), @ts-core/frontend (>=1.0.1, <=1.0.5) +6 more potentially affected by CVE-2021-4231 via @angular/platform-server (>=8.0.0, <=8.2.12)

@angular/platform-server NPM version =8.0.0, =1.0.1, =1.0.5, =0.0.1, =1.0.135, =2.0.20 Source cves: CVE-2021-4231 Source advisory: MEND:CVE-2021-4231...

@mxtommy/kip (>=1.1.1, <=1.1.2), angular-nest-starter (0.1.0) +4 more potentially affected by CVE-2021-4231 via @angular/platform-server (>=9.0.0, <=9.1.11)

@angular/platform-server NPM version =9.0.0, =1.1.1, =0.0.0, =0.0.1 - jio-digiapi-auto-mate-plus-ui-app 1.2.0 - node-angular-app-template 0.0.1 - shared-encoding-library 0.0.0 Source cves: CVE-2021-4231 Source advisory: MEND:CVE-2021-4231...

@amicus/auth (>=1.0.3, <=1.1.5), @amicus/broadcasting (>=1.0.3, <=1.1.5) +149 more potentially affected by CVE-2021-4231 via @angular/platform-server (>=4.0.0, <=4.4.6)

@angular/platform-server NPM version =4.0.0, =1.0.3, =1.0.3, =1.0.3, =1.1.1, =3.0.0-beta.45, =0.2.1, =0.2.1, =0.2.1, =0.2.1, =0.2.0, =0.2.1, =0.2.1, =2.0.2, =0.0.1, =0.0.21 - @kouki-o/angular-custom-tour 0.0.19 and more Source cves: CVE-2021-4231 Source advisory: MEND:CVE-2021-4231...

@dometec/ng2-smart-table-demo (1.3.5-dom), @easybi/ng2-smart-table (1.4.1) +23 more potentially affected by CVE-2021-4231 via @angular/platform-server (>=6.0.0, <=6.1.9)

@angular/platform-server NPM version =6.0.0, =1.0.1, =2.0.0, =0.0.46, =1.1.8-bata.1, =5.1.0, =2.0.0, =0.0.0, =1.23.7, =1.23.20 and more Source cves: CVE-2021-4231 Source advisory: MEND:CVE-2021-4231...

@mxtommy/kip (>=0.1.9, <=1.0.3), @proactive-as/angular.vendor (>=7.0.0-beta.1, <=7.2.13) +5 more potentially affected by CVE-2021-4231 via @angular/platform-server (>=7.0.4, <=7.2.13)

@angular/platform-server NPM version =7.0.4, =0.1.9, =7.0.0-beta.1, =0.0.71, =0.0.2, =0.1.1, =1.2.1-beta.777, =0.0.1-1.1, =0.0.111 Source cves: CVE-2021-4231 Source advisory: MEND:CVE-2021-4231...

@daybreaksoft/angular-elastic-ui (>=1.0.0-beta.1, <=5.0.0-beta.3), @landsoft/wng-auth-module (>=1.0.0, <=1.0.4) +33 more potentially affected by CVE-2021-4231 via @angular/platform-server (>=5.0.0, <=5.2.10)

@angular/platform-server NPM version =5.0.0, =1.0.0-beta.1, =1.0.0, =0.0.8-hotfix-6, =1.2.0, =1.2.1, =1.0.0, =1.0.0, =0.41.0, =0.50.0 and more Source cves: CVE-2021-4231 Source advisory: MEND:CVE-2021-4231...

GHSA-5VMG-X99G-396Q Shopware vulnerable to SSRF

Shopware before 6.2.3 is vulnerable to a Server-Side Request Forgery SSRF in its "Mediabrowser upload by URL" feature. This allows an authenticated user to send HTTP, HTTPS, FTP, and SFTP requests on behalf of the Shopware platform server...

CVE-2021-27765 HCL BigFix Platform Server API is affected by Privilege Escalation Vulnerability

The BigFix Server API installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed...

CVE-2022-22772

The CVE-2022-22772 entry concerns TIBCO Managed File Transfer Platform Server for UNIX (8.1.0 and below) and z/Linux (8.1.0 and below). The affected components are cfsend, cfrecv, and CyberResp, with a difficult to exploit Remote Code Execution (RCE) vulnerability that allows a low-privileged, ne...

PT-2022-15663

Name of the Vulnerable Software and Affected Versions TIBCO Managed File Transfer Platform Server for UNIX versions 8.1.0 and below TIBCO Managed File Transfer Platform Server for z/Linux versions 8.1.0 and below Description The cfsend, cfrecv, and CyberResp components of TIBCO Software Inc.'s...

CVE-2022-22772: Undefined Security Weakness

The cfsend, cfrecv, and CyberResp components of TIBCO Software Inc.'s TIBCO Managed File Transfer Platform Server for UNIX and TIBCO Managed File Transfer Platform Server for z/Linux contain a difficult to exploit Remote Code Execution RCE vulnerability that allows a low privileged attacker with...

TIBCO Security Advisory: March 30, 2022 - TIBCO Managed File Transfer Platform Server -2022-22772

TIBCO Managed File Transfer Platform Server Remote Code Execution Vulnerability Original release date: March 30,2022 Last revised: --- CVE-2022-22772 Source: TIBCO Software Inc. Products Affected TIBCO Managed File Transfer Platform Server for UNIX versions 8.1.0 and below TIBCO Managed File...

Cross site scripting

A stored XSS vulnerability was discovered in the ECT Provider in OutSystems before 2020-09-04, affecting generated applications. It could allow an unauthenticated remote attacker to craft and store malicious Feedback content into /ECTProvider/, such that when the content is viewed it can only be...