CVE-2021-20647

Cross-site request forgery CSRF vulnerability in ELECOM WRC-300FEBK-S allows remote attackers to hijack the authentication of administrators and execute an arbitrary request via unspecified vector. As a result, the device settings may be altered and/or telnet daemon may be started...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in ELECOM WRC-300FEBK-S allows remote attackers to hijack the authentication of administrators and execute an arbitrary request via unspecified vector. As a result, the device settings may be altered and/or telnet daemon may be started...

Input validation

ELECOM WRC-300FEBK-S contains an improper certificate validation vulnerability. Via a man-in-the-middle attack, an attacker may alter the communication response. As a result, an arbitrary OS command may be executed on the affected device...

Design/Logic Flaw

ELECOM WRC-300FEBK-S allows an attacker with administrator rights to execute arbitrary OS commands via unspecified vectors...

CVE-2021-20649

CVE-2021-20649 affects ELECOM WRC-300FEBK-S with an improper server certificate verification (CWE-295). A MITM can modify the response, potentially allowing arbitrary OS commands to be executed on the device. Affected product in this CVE entry is the WRC-300FEBK-S; impact is confirmed as remote e...

CVE-2021-20648

ELECOM WRC-300FEBK-S allows an attacker with administrator rights to execute arbitrary OS commands via unspecified vectors...

CVE-2021-20649

ELECOM WRC-300FEBK-S contains an improper certificate validation vulnerability. Via a man-in-the-middle attack, an attacker may alter the communication response. As a result, an arbitrary OS command may be executed on the affected device...

CVE-2021-20648

CVE-2021-20648 affects ELECOM WRC-300FEBK-S: an attacker with administrator rights can execute arbitrary OS commands on the device via unspecified vectors. Public sources confirm the affected product and vulnerability class (OS command injection). No explicit exploit details or vectors are provid...

CVE-2021-20647

CVE-2021-20647 is a CSRF vulnerability in ELECOM WRC-300FEBK-S. The issue allows remote attackers to hijack administrator authentication and issue arbitrary requests, potentially changing device settings or starting a telnet daemon via an unspecified vector. Product: ELECOM WRC-300FEBK-S. Impact ...

Cisco Unified Computing System (UCS) Central Software Improper Certificate Validation (cisco-sa-ucs-invcert-eOpRvCKH)

According to its self-reported version, Cisco Unified Computing System Central Software is affected by an improper certificate validation vulnerability. An authenticated, adjacent attacker could exploit this, by sending a crafted HTTP request to the registration API, to register a rogue Cisco UCS...

Cisco IOS XR Software Unauthorized Information Disclosure (cisco-sa-ios-infodisc-4mtm9Gyt)

According to its self-reported version, IOS-XR is affected by an information disclosure vulnerability in its CLI parser component due to insufficient application of restrictions for a specific command. An authenticated, local attacker can exploit this, by issuing a crafted command at the command...

U.S. Dept Of Defense: Reflected XSS in https://██████████ via "████████" parameter

Hello Security Team, I would like to report the XSS vulnerability on your system. The ██████████ parameter is not escaped properly for URL encoded values. ██████ Impact An XSS attack allows an attacker to execute arbitrary JavaScript in the context of the attacked website and the attacked user...

MGASA-2021-0067 Updated messagelib packages fix a security vulnerability

In KDE KMail, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted parts can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended...

Updated messagelib packages fix a security vulnerability

In KDE KMail, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted parts can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended...

Cisco Firepower Threat Defense HTTP Detection Engine File Policy Bypass (cisco-sa-snort-filepolbypass-67DEwMe2)

According to its version and configuration, the Cisco Firepower Threat Defense FTD Software running on the remote device is affected by affected by a file policy bypass vulnerability due to the incorrect handling of a HTTP range header. An unauthenticated, remote attacker could send a carefully...

SonicWall Secure Mobile Access Remote Code Execution (SNWLID-2021-0001)

According to its self-reported version, the remote SonicWall Secure Mobile Access is affected by a remote code execution vulnerability. An unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands. Note that Nessus has not tested for these issues bu...

Google Chrome < 88.0.4324.146 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 88.0.4324.146. It is, therefore, affected by multiple vulnerabilities as referenced in the 202102stable-channel-update-for-desktop advisory. - Use after free in Navigation in Google Chrome prior to 88.0.4324.146 allowed...

Google Chrome < 88.0.4324.146 Multiple Vulnerabilities

The version of Google Chrome installed on the remote macOS host is prior to 88.0.4324.146. It is, therefore, affected by multiple vulnerabilities as referenced in the 202102stable-channel-update-for-desktop advisory. - Use after free in Navigation in Google Chrome prior to 88.0.4324.146 allowed a...

ELECOM WRC-300FEBK-S Arbitrary Command Execution Vulnerability

The ELECOM WRC-300FEBK-S is a wireless access device. An arbitrary command execution vulnerability exists in the ELECOM WRC-300FEBK-S, which can be exploited by an attacker to execute arbitrary OS commands...

CentOS 8 : thunderbird (CESA-2020:0577)

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2020:0577 advisory. - Mozilla: Message ID calculation was based on uninitialized data CVE-2020-6792 - Mozilla: Out-of-bounds read when processing certain email messages...