CVE-2022-24552

A flaw was found in the REST API in StarWind Stack. REST command, which manipulates a virtual disk, doesn’t check input parameters. Some of them go directly to bash as part of a script. An attacker with non-root user access can inject arbitrary data into the command that will be executed with roo...

PT-2022-7718 · Starwind · Starwind Iscsi San

Name of the Vulnerable Software and Affected Versions: StarWind iSCSI SAN version 3.2.2 build 2007-02-20 StarWind iSCSI SAN versions prior to 3.5 build 2007-08-09 Description: A flaw was found in the StarWind iSCSI target, allowing an attacker to script standard iSCSI Initiator operations to...

StarWind SAN & NAS 操作系统命令注入漏洞

StarWind SAN & NAS is a standalone hypervisor server or group of servers for StarWind.A command injection vulnerability exists in StarWind SAN & NAS, which can be exploited by attackers to remotely execute code...

StarWind SAN & NAS 授权问题漏洞

StarWind SAN & NAS is a standalone hypervisor server or group of servers for StarWind.A security vulnerability exists in StarWind SAN & NAS that could be exploited by an attacker to reset the passwords of other users...

StarWind iSCSI SAN 资源管理错误漏洞

StarWind iSCSI SAN is a kind of iSCSI storage from StarWind, USA. It is suitable for small and medium-sized businesses that need to store and transfer large amounts of data over a network. A resource management error vulnerability exists in versions prior to StarWind iSCSI SAN 3.5 build 2007-08-0...

Node.js 12.x < 12.22.9 / 14.x < 14.18.3 / 16.x < 16.13.2 / 17.x < 17.3.1 Multiple Vulnerabilities (January 10th 2022 Security Releases).

The version of Node.js installed on the remote host is prior to 12.22.9, 14.18.3, 16.13.2, 17.3.1. It is, therefore, affected by multiple vulnerabilities as referenced in the January 10th 2022 Security Releases advisory. - Accepting arbitrary Subject Alternative Name SAN types, unless a PKI is...

San Francisco Police Illegally Spying on Protesters

Last summer, the San Francisco police illegally used surveillance cameras at the George Floyd protests. The EFF is suing the police: This surveillance invaded the privacy of protesters, targeted people of color, and chills and deters participation and organizing for future protests. The SFPD also...

SUSE SLES12 Security Update : nodejs14 (SUSE-SU-2022:0114-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0114-1 advisory. - CVE-2021-44531: Fixed improper handling of URI Subject Alternative Names bsc1194511. - CVE-2021-44532: Fixed certificate...

openSUSE 15 Security Update : nodejs14 (openSUSE-SU-2022:0112-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:0112-1 advisory. - Accepting arbitrary Subject Alternative Name SAN types, unless a PKI is specifically defined to use a particular SAN type, can result in...

Upcoming Speaking Engagements

This is a current list of where and when I am scheduled to speak: I’m giving an online-only talk on “Securing a World of Physically Capable Computers” as part of Teleport’s Security Visionaries 2022 series, on January 18, 2022. I’m speaking at IT-S Now 2022 in Vienna on June 2, 2022. I’m speaking...

Node.js -- January 2022 Security Releases

Node.js reports: Improper handling of URI Subject Alternative Names MediumCVE-2021-44531 Accepting arbitrary Subject Alternative Name SAN types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js was accepting URI SAN...

CVE-2021-45389

A flaw was found with the JWT token. A self-signed JWT token could be injected into the update manager and bypass the authentication process, thus could escalate privileges. This affects StarWind SAN and NAS build 1578 and StarWind Command Center build 6864...

CVE-2021-45389

A flaw was found with the JWT token. A self-signed JWT token could be injected into the update manager and bypass the authentication process, thus could escalate privileges. This affects StarWind SAN and NAS build 1578 and StarWind Command Center build 6864...

CVE-2021-45389

A flaw was found with the JWT token. A self-signed JWT token could be injected into the update manager and bypass the authentication process, thus could escalate privileges. This affects StarWind SAN and NAS build 1578 and StarWind Command Center build 6864...

Authentication flaw

A flaw was found with the JWT token. A self-signed JWT token could be injected into the update manager and bypass the authentication process, thus could escalate privileges. This affects StarWind SAN and NAS build 1578 and StarWind Command Center build 6864...

CVE-2021-45389

A flaw was found with the JWT token. A self-signed JWT token could be injected into the update manager and bypass the authentication process, thus could escalate privileges. This affects StarWind SAN and NAS build 1578 and StarWind Command Center build 6864...

CVE-2021-45389

CVE-2021-45389 concerns StarWind SAN & NAS build 1578 and StarWind Command Center build 6864. A flaw allows a self-signed JWT token to be injected into the Update Manager, bypassing authentication and enabling privilege escalation via network access. Root cause: JWT validation/token handling flaw...

多款StarWind产品授权问题漏洞

StarWind SAN & NAS and StarWind Command Center are both StarWind products.StarWind SAN & NAS are standalone hypervisor servers or groups of servers.StarWind Command Center is a single management platform to manage and monitor the Ui. designed to simplify and automate the control of routine Hci...

PT-2022-12338 · Starwind · Starwind Command Center +1

Name of the Vulnerable Software and Affected Versions: StarWind SAN and NAS build 1578 StarWind Command Center build 6864 Description: A flaw was found with the JWT token, allowing a self-signed JWT token to be injected into the update manager and bypass the authentication process, thus escalatin...

Security Bulletin: Apache Log4j vulnerability in DCNM Network Management Software used by IBM c-type SAN directors and switches.

Summary Apache Log4j Java logging library vulnerability - CVE-2021-44228 affecting versions prior to v2.15 impacts DCNM Network Management Software. Vulnerability Details CVEID: CVE-2021-44228 DESCRIPTION: Apache Log4j could allow a remote attacker to execute arbitrary code on the system, caused ...