The vulnerability of the Zero Touch Provisioning (ZTP) service for managing VoIP devices in the software-based IP telephones of Poly VVX, CCX, and Trio allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the Zero Touch Provisioning ZTP service for VoIP device management in the software-based IP telephones of Poly VVX, CCX, and Trio is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access...

CVE-2021-25356

An improper caller check vulnerability in Managed Provisioning prior to SMR APR-2021 Release 1 allows unprivileged application to install arbitrary application, grant device admin permission and then delete several installed application...

CVE-2021-25356

An improper caller check vulnerability in Managed Provisioning prior to SMR APR-2021 Release 1 allows unprivileged application to install arbitrary application, grant device admin permission and then delete several installed application...

Input validation

An improper caller check vulnerability in Managed Provisioning prior to SMR APR-2021 Release 1 allows unprivileged application to install arbitrary application, grant device admin permission and then delete several installed application...

CVE-2021-25356

CVE-2021-25356 pertains to Samsung’s Managed Provisioning. An improper caller check prior to SMR APR-2021 Release 1 allows an unprivileged application to install arbitrary applications, grant device admin permissions, and subsequently delete multiple installed apps. The issue’s root cause is an i...

CVE-2021-25356

An improper caller check vulnerability in Managed Provisioning prior to SMR APR-2021 Release 1 allows unprivileged application to install arbitrary application, grant device admin permission and then delete several installed application...

PT-2021-16549 · Unknown · Managed Provisioning

Name of the Vulnerable Software and Affected Versions: Managed Provisioning versions prior to SMR APR-2021 Release 1 Description: The issue is related to an improper caller check in Managed Provisioning, allowing an unprivileged application to install arbitrary applications, grant device admin...

Looking Back and Moving Forward With Rapid7’s Cloud Security Solution

This blog post was co-authored by Jamie Gale and Charles Stokes. Done with Q1 The DivvyCloud by Rapid7 team has had a busy and productive start to 2021, and we anticipate that the rest of this year will be equally exciting for our valued customers. In the first three months alone, we incorporated...

How to Run Provisioning File on Receiver for Android

This article is intended for Citrix administrators and technical teams only.Non-admin users must contact their company’s Help Desk/IT support team and can refer toCTX297149for more information This article describes about configuring a store on Receiver for Android by executing a provisioning fil...

CVE-2021-21631

Jenkins Cloud Statistics Plugin 0.26 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission and knowledge of random activity IDs to view related provisioning exception error messages...

Code injection

Jenkins Cloud Statistics Plugin 0.26 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission and knowledge of random activity IDs to view related provisioning exception error messages...

CVE-2021-21631

Jenkins Cloud Statistics Plugin 0.26 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission and knowledge of random activity IDs to view related provisioning exception error messages...

PT-2021-14674 · Jenkins · Jenkins Cloud Statistics Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Cloud Statistics Plugin versions 0.26 and earlier Description: The issue concerns a lack of permission check in an HTTP endpoint, allowing attackers with Overall/Read permission and knowledge of random activity IDs to view related...

Jenkins Cloud Statistics 安全漏洞

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . An improper authorization...

Foreman 安全漏洞

Foreman is a set of lifecycle management tools for use in physical and virtual servers. The tool provides features such as service provisioning, configuration management, and status reporting. A security vulnerability exists in Foreman that arises from improper authorization handling...

Missing permission check in cloud-stats

cloud-stats 0.26 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission and knowledge of random activity IDs to view related provisioning exception error messages. cloud-stats 0.27 requires Overall/Administer permission to access...

Foreman 安全漏洞

Foreman is a set of lifecycle management tools for use in physical and virtual servers. The tool provides service provisioning, configuration management, and status reporting. Foreman has a security vulnerability that can be exploited by an attacker to emulate foreman-proxy...

Citrix Provisioning "The trust relationship between this workstation and the primary domain failed."

Windows 10 image loosing trust relationship to the domain after reboot. Machine account reset from PVS server succeeds however VM still gets the same error after reboot and can not login with domain account...

wpa_supplicant: Use-after-free in P2P provision discovery processing

A flaw was found in the wpasupplicant, in the way it processes P2P Wi-Fi Direct provision discovery requests. This flaw allows an attacker who is within radio range of the device running P2P discovery to cause termination of the wpasupplicant process or potentially cause code execution. The highe...

CVE-2021-0380

In onReceive of DcTracker.java, there is a possible way to trigger a provisioning URL and modify other telephony settings due to a missing permission check. This could lead to local escalation of privilege during the onboarding flow with no additional execution privileges needed. User interaction...