PT-2021-10783 · Mercury · Mercury Router Mer1200

Name of the Vulnerable Software and Affected Versions: Mercury Router MER1200 version 1.0.1 Mercury Router MER1200G version 1.0.1 Description: A remote command execution issue exists in the add server service of PPTP SERVER in the affected routers. Recommendations: For Mercury Router MER1200...

PT-2021-4481 · Apache +3 · Apache +3

Name of the Vulnerable Software and Affected Versions: LedgerSMB version 1.8 Description: The issue is related to the absence of the 'Secure' attribute in session authorization cookies when the client uses HTTPS and the LedgerSMB server is behind a reverse proxy. This allows an attacker to obtain...

CVE-2021-42009

An authenticated Apache Traffic Control Traffic Ops user with Portal-level privileges can send a request with a specially-crafted email subject to the /deliveryservices/request Traffic Ops endpoint to send an email, from the Traffic Ops server, with an arbitrary body to an arbitrary email address...

Siemens SIMATIC Process Historian

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: SIMATIC Process Historian Vulnerability: Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could enable the execution of...

PT-2021-4295

Name of the Vulnerable Software and Affected Versions Apache HTTP Server version 2.4.49 Apache HTTP Server version 2.4.50 Description An insufficient fix for a previous path traversal issue allows an attacker to map URLs to files outside the directories configured by Alias-like directives. If the...

PT-2021-23108 · Scrapy +2 · Scrapy +2

Name of the Vulnerable Software and Affected Versions: Scrapy versions prior to 2.5.1 Scrapy versions 1.8 and earlier Description: The issue affects Scrapy when using HttpAuthMiddleware for HTTP authentication, causing all requests to expose credentials to the request target. This includes reques...

Apache Releases Security Update for Apache HTTP Server

Updated October 7, 2021 Apache has released additional fixes for CVE-2021-41773, which is tracked as CVE-2021-42013. For more information see the Apache vulnerabilities page. Originally published October 6, 2021 The Apache Software Foundation has released Apache HTTP Server version 2.4.50 to...

PT-2021-15571 · Rexroth +1 · Indramotion Mlc L20 +13

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: The issue involves information disclosure where the main configuration, including users and their hashed passwords, is exposed through an unprotected web server resource. This...

PT-2021-21211 · Dell · Dell Enterprise Sonic Os

Name of the Vulnerable Software and Affected Versions: Dell Enterprise SONiC OS versions 3.3.0 and earlier Description: The issue allows an authenticated malicious user with access to the system to read sensitive information using the TACACSRadius credentials stored, potentially using it in furth...

A guide to combatting human-operated ransomware: Part 2

This blog is part two of a two-part series focused on how Microsoft DART helps customers with human-operated ransomware. For more guidance on human-operated ransomware and how to defend against these extortion-based attacks, refer to our human-operated ransomware docs page. In part one of this bl...

PT-2021-20516 · Zoom · Zoom Client Plugin For Sharing +2

Name of the Vulnerable Software and Affected Versions: Zoom Client for Meetings for MacOS versions prior to 5.2.0 Zoom Client Plugin for Sharing iPhone/iPad versions prior to 5.2.0 Zoom Rooms for Conference versions prior to 5.1.0 Description: A flaw was discovered in the installation packages of...

PT-2021-15242 · Github · Github Enterprise Server

Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server versions 3.0.0 through 3.0.15 GitHub Enterprise Server versions 3.1.0 through 3.1.7 Description: An improper access control issue in GitHub Enterprise Server allowed a workflow job to execute in a self-hosted runner...

Festo SBRD-Q/SBOC-Q/SBOI-Q

SUMMARY The affected product families are cameras SBOC/SBOI and the Controller SBRD. The vulnerabilities are located within the Ethernet IP Stack from EIPStackGroup OpENer Ethernet/IP. 2. IMPACT Please consult the CVEs listed above and ICSA-21-105-02. 3. MITIGATION - Minimize network exposure...

CLSA-2021-1632261762 Fix of CVE: CVE-2021-23017

Update fix for CVE-2021-23017 accoding nginx.org recomendations...

Fix of CVE: CVE-2021-23017

Update fix for CVE-2021-23017 accoding nginx.org recomendations...

PT-2021-4687 · Canonical +1 · Apport +2

Name of the Vulnerable Software and Affected Versions: apport versions prior to 2.14.1-0ubuntu3.29+esm8 apport versions prior to 2.20.1-0ubuntu2.30+esm2 apport versions prior to 2.20.9-0ubuntu7.26 apport versions prior to 2.20.11-0ubuntu27.20 apport versions prior to 2.20.11-0ubuntu65.3...

PT-2021-15376 · F5 · Big-Ip

Name of the Vulnerable Software and Affected Versions: BIG-IP versions 13.1.x through 13.1.3.6 BIG-IP versions 14.1.x through 14.1.3.1 BIG-IP versions 15.1.x through 15.1.3 Description: When the brute force protection feature of BIG-IP Advanced WAF or BIG-IP ASM is enabled on a virtual server and...

ROS-2-2113

2.2113 Mozilla Firefox browser vulnerability CVE-2021-29970, CVE-2021-29976 1. Vulnerability description: CVE-2021-29970 A vulnerability in the Mozilla Firefox browser, is related to a release error in accessibility functions when processing HTML content. Exploitation of the vulnerability could...

3 steps to prevent and recover from ransomware

On July 14, 2021, the National Cybersecurity Center of Excellence1 NCCoE at the National Institute of Standards and Technology2 NIST hosted a virtual workshop3 to seek feedback from government and industry experts on practical approaches to preventing and recovering from ransomware and other...

PT-2021-30879 · Fortinet · Fortios

Name of the Vulnerable Software and Affected Versions: FortiOS versions 6.4.1 and below FortiOS versions 6.2.9 and below Description: The issue allows a remote unauthenticated attacker to either redirect users to malicious websites via a crafted Host header or to execute JavaScript code in the...