ROS-2-648

2.648 Follow link in chrony CVE-2020-14367 1. Vulnerability Description: CVE-2020-14367 Vulnerability allows a remote attacker to compromise a target system due to issues with a symbolic link to a service.FSTEC Russia Information Security Threats Data Bank Identifier: BDU:2021-01809 2. Possible...

Mandiant Discloses Critical Vulnerability Affecting Millions of IoT Devices

Today, Mandiant disclosed a critical risk vulnerability in coordination with the Cybersecurity and Infrastructure Security Agency “CISA” that affects millions of IoT devices that use the ThroughTek “Kalay” network. This vulnerability, discovered by researchers on Mandiant’s Red Team in late 2020,...

CVE-2021-2436

Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite component: CRM User Management Framework. Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

DEBIAN-CVE-2021-2369

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Library. Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Easily exploitable vulnerability allows...

CVE-2021-2463

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce component: Dynamo Application Framework. Supported versions that are affected are 11.0.0, 11.1.0, 11.2.0 and 11.3.0-11.3.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

The vulnerability of the Python programming language’s pip module relates to deficiencies in pathname restrictions for directories, allowing attackers to compromise data integrity.

The vulnerability of the Python programming language’s pip module is related to shortcomings in pathname restrictions when specifying software for installation via URLs. Exploiting this vulnerability allows an attacker to compromise data integrity remotely...

Kaseya VSA Input Validation Error Vulnerability

Kaseya VSA RMM is a remote monitoring and terminal management solution from Kaseya, Switzerland. Kaseya VSA suffers from an input validation error vulnerability that arises from a network system or product that does not properly validate incoming data. A remote attacker could exploit this...

The vulnerability of SSH clients on operating systems such as iOS, iPadOS, macOS, tvOS, and watchOS allows attackers to compromise the integrity of protected information.

The vulnerability of SSH clients for operating systems such as iOS, iPadOS, macOS, tvOS, and watchOS is related to security configuration errors. Exploiting this vulnerability can allow a malicious actor to compromise the integrity of protected information from a remote perspective...

CVE-2021-22891

CVE-2021-22891 affects Citrix ShareFile storage zones controller. The issue is an unauthenticated remote compromise due to improper resource control in affected versions: 5.7 before 5.7.3, 5.8 before 5.8.3, 5.9 before 5.9.3, 5.10 before 5.10.1, and 5.11 before 5.11.18. Citrix provides fixes in 5....

CVE-2021-22891

A missing authorization vulnerability exists in Citrix ShareFile Storage Zones Controller before 5.7.3, 5.8.3, 5.9.3, 5.10.1 and 5.11.18 may allow unauthenticated remote compromise of the Storage Zones Controller...

CVE-2020-4979

IBM QRadar SIEM 7.3 and 7.4 is vulnerable to insecure inter-deployment communication. An attacker that is able to comprimise or spoof traffic between hosts may be able to execute arbitrary commands. IBM X-Force D: 192538...

Citrix Systems Citrix ShareFile 安全漏洞

Citrix Systems Citrix ShareFile is a file sharing solution from Citrix Systems USA. A security vulnerability exists in the Citrix ShareFile Storage Partition Controller, which originated from a vulnerability that allows an unauthenticated attacker to remotely compromise the Storage Area Controlle...

Citrix ShareFile storage zones controller security update

Description of Problem A security issue has been identified in the Citrix ShareFile storage zones controller which, if exploited, would allow an unauthenticated attacker to remotely compromise the storage zones controller. The issue has been given the following identifier: CVE-ID | Description |...

Nextcloud 注入漏洞

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in the Nextcloud Desktop client, which stems from insufficient validation of input provided to a user passed through a URL....

The vulnerability of the RabbitMQ messaging broker, related to deficiencies in the security measures used for protecting web page structures, allows attackers to compromise data integrity.

The vulnerability of the RabbitMQ messaging broker is related to deficiencies in the security measures used to protect web page structures. Exploiting this vulnerability allows a malicious actor to compromise data integrity remotely...

Apple ImageIO Security Vulnerability

Apple ImageIO is an Apple Inc. component necessary for parsing and writing image data in IOS mobile devices. A security vulnerability exists in Apple ImageIO that could allow a remote attacker to compromise an affected system. The following products and versions are affected: macOS: 10.15, 10.15...

Apple ImageIO Security Vulnerability

Apple ImageIO is an Apple Inc. component necessary for parsing and writing image data in IOS mobile devices. A security vulnerability exists in Apple ImageIO that could allow a remote attacker to compromise an affected system. The following products and versions are affected: macOS: 10.15, 10.15...

Apple ImageIO Buffer Error Vulnerability

Apple ImageIO is an Apple Inc. component necessary for parsing and writing image data in IOS mobile devices. A security vulnerability exists in Apple ImageIO that could allow a remote attacker to compromise a vulnerable system. The following products and versions are affected: macOS: 10.15, 10.15...

Oracle Fusion Middleware Security Vulnerability

Oracle Fusion Middleware Oracle Fusion Middleware is a set of business innovation platforms for enterprise and cloud environments from Oracle. The platform provides middleware, software collections, and other capabilities.WebLogic Server is one of the application server components for both cloud...

CVE-2020-24637

Two vulnerabilities in ArubaOS GRUB2 implementation allows for an attacker to bypass secureboot. Successful exploitation of this vulnerability this could lead to remote compromise of system integrity by allowing an attacker to load an untrusted or modified kernel in Aruba 9000 Gateway; Aruba 7000...