Cisco Firepower Threat Defense Software Ethernet Industrial Protocol Policy Bypass Vulnerabilities

Multiple vulnerabilities in the payload inspection for Ethernet Industrial Protocol ENIP traffic for Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass configured rules for ENIP traffic. These vulnerabilities are due to incomplete processing duri...

Cisco Firepower Threat Defense Software CLI Arbitrary File Write Vulnerability

A vulnerability in Cisco Firepower Threat Defense FTD Software could allow an authenticated, local attacker to overwrite or append arbitrary data to system files using root-level privileges. The attacker must have administrative credentials on the device. This vulnerability is due to incomplete...

Cisco Identity Services Engine File Download Vulnerability

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker with administrative read-only privileges to download files that should be restricted. This vulnerability is due to incorrect permissions settings on an affecte...

Cisco IOS XE SD-WAN Software Command Injection Vulnerability

A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to execute arbitrary commands with root privileges. The vulnerability is due to insufficient input validation by the system CLI. An attacker could exploit this vulnerability by authenticating t...

Movable Type XMLRPC API vulnerable to OS command injection

Overview Movable Type XMLRPC API provided by Six Apart Ltd. contains an OS command injection vulnerability CWE-78. Sending a specially crafted message by POST method to Movavle Type XMLRPC API may allow arbitrary OS command execution. Updated on 2021 November 10 As of 2021 November 10, a...

Security Advisory - CSV Injection Vulnerability in Some Huawei Products

There is a CSV injection vulnerability in some Huawei Products. An attacker with high privilege may exploit this vulnerability through some operations to inject the CSV files. Due to insufficient input validation of some parameters, the attacker can exploit this vulnerability to inject CSV files ...

PT-2021-19273 · Juniper Networks · Junos

Name of the Vulnerable Software and Affected Versions: Juniper Networks Junos OS versions prior to 12.3R12-S18 Juniper Networks Junos OS versions prior to 15.1R7-S9 Juniper Networks Junos OS versions prior to 17.2R3-S3 Juniper Networks Junos OS versions prior to 17.3R3-S7 Juniper Networks Junos O...

PT-2021-19260 · Juniper Networks · Junos

Name of the Vulnerable Software and Affected Versions: Juniper Networks Junos OS on QFX Series versions prior to 17.3R3-S11 Juniper Networks Junos OS on QFX Series versions 17.4 prior to 17.4R2-S13, 17.4R3-S4 Juniper Networks Junos OS on QFX Series versions 18.1 prior to 18.1R3-S12 Juniper Networ...

PT-2021-21117 · Otrs Ag · Otrs

Name of the Vulnerable Software and Affected Versions: OTRS AG OTRS versions 8.0.16 and prior versions. Description: The issue allows agents to lock tickets without the "Owner" permission. Once a ticket is locked, it can be moved to a queue where the agent has "rw" permissions, granting them full...

[eBook] The Guide for Reducing SaaS Applications Risk for Lean IT Security Teams

The Software-as-a-service SaaS industry has gone from novelty to an integral part of today's business world in just a few years. While the benefits to most organizations are clear – more efficiency, greater productivity, and accessibility – the risks that the SaaS model poses are starting to beco...

PT-2021-21990 · Sap · Abap Platform +1

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS ABAP and ABAP Platform versions 700 through 756 Description: The issue allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service. Recommendations: For versions 700...

Information disclosure

A potential security vulnerability has been identified in HPE 3PAR StoreServ, HPE Primera Storage and HPE Alletra 9000 Storage array firmware. An unauthenticated user could remotely exploit the low complexity issue to execute code as administrator. This vulnerability impacts completely the...

CVE-2021-26588

A potential security vulnerability has been identified in HPE 3PAR StoreServ, HPE Primera Storage and HPE Alletra 9000 Storage array firmware. An unauthenticated user could remotely exploit the low complexity issue to execute code as administrator. This vulnerability impacts completely the...

Security Advisory - Use-after-free Vulnerability in Huawei Products

There is a use-after-free UAF vulnerability in Huawei products. An attacker may craft specific packets to exploit this vulnerability. Successful exploitation may cause the service abnormal. Vulnerability ID: HWPSIRT-2020-67955 This vulnerability has been assigned a Common Vulnerabilities and...

Cisco TelePresence Collaboration Endpoint and RoomOS Software Denial of Service Vulnerability

It was previously published that a vulnerability in the memory management of Cisco TelePresence Collaboration Endpoint CE Software and Cisco RoomOS Software could allow an authenticated, local attacker to corrupt a shared memory segment, resulting in a denial of service DoS condition. This...

Cisco Orbital Open Redirect Vulnerability

A vulnerability in the web-based management interface of Cisco Orbital could allow an unauthenticated, remote attacker to redirect users to a malicious webpage. This vulnerability is due to improper validation of URL paths in the web-based management interface. An attacker could exploit this...

Cisco IP Phone Software Arbitrary File Read Vulnerability

A vulnerability in the debug shell of Cisco IP Phone software could allow an authenticated, local attacker to read any file on the device file system. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by providing crafted input to a debug she...

Cisco Smart Software Manager Privilege Escalation Vulnerability

A vulnerability in the web UI of Cisco Smart Software Manager On-Prem SSM On-Prem could allow an authenticated, remote attacker to elevate privileges and create, read, update, or delete records and settings in multiple functions. This vulnerability is due to insufficient authorization of the Syst...

Cisco Business 220 Series Smart Switches Static Key and Password Vulnerabilities

Multiple vulnerabilities in Cisco Business 220 Series Smart Switches firmware could allow an attacker with Administrator privileges to access sensitive login credentials or reconfigure the passwords on the user account. For more information about these vulnerabilities, see the Details "details"...

Cisco Email Security Appliance URL Filtering Bypass Vulnerability

A vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to bypass the URL reputation filters on an affected device. This vulnerability is due to improper processing of URLs. An attacker...