Security Advisory - Possible Out-Of-Bounds Read Vulnerability in Huawei Products

There is an out of bounds read vulnerability in some Huawei products. A local attacker can exploit this vulnerability by sending specific message to the target device. Due to insufficient validation of internal message, successful exploit may cause the process and the service abnormal...

PT-2021-18830 · Apple · Ios +3

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 11.4 Security Update versions prior to 2021-003 Catalina Security Update versions prior to 2021-004 Mojave iOS versions prior to 14.6 iPadOS versions prior to 14.6 Description: A memory corruption issue was addressed...

Cisco Finesse Cross-Site Scripting Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Finesse could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the...

Cisco DNA Spaces Connector Command Injection Vulnerabilities

Multiple vulnerabilities in Cisco DNA Spaces Connector could allow an authenticated, remote attacker to perform a command injection attack on an affected device. These vulnerabilities are due to insufficient input sanitization when executing affected commands. A high-privileged attacker could...

Cisco DNA Spaces Connector Privilege Escalation Vulnerabilities

Multiple vulnerabilities in Cisco DNA Spaces Connector could allow an authenticated, local attacker to elevate privileges and execute arbitrary commands on the underlying operating system as root. These vulnerabilities are due to insufficient restrictions during the execution of affected CLI...

Cisco Small Business 100, 300, and 500 Series Wireless Access Points Command Injection Vulnerabilities

Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote attacker to perform command injection attacks against an affected device. These vulnerabilities are due to improper...

Cisco Modeling Labs Web UI Command Injection Vulnerability

A vulnerability in the web UI of Cisco Modeling Labs could allow an authenticated, remote attacker to execute arbitrary commands with the privileges of the web application on the underlying operating system of an affected Cisco Modeling Labs server. This vulnerability is due to insufficient...

Security Advisory - Out of Bounds Write Vulnerability in Huawei CloudEngine Product

There is an out of bounds write vulnerability in some Huawei products. An attacker can exploit this vulnerability by sending crafted data in the packet to the target device. Due to insufficient validation of message, successful exploit can cause certain service abnormal. Vulnerability ID:...

Security Advisory - Resource Management Error Vulnerability in Some Huawei Products

There is a resource management error vulnerability in some Huawei Products. An authentication attacker needs to perform specific operations to exploit the vulnerability on the affected device. Due to improper resource management of the function, the vulnerability can be exploited to cause service...

Security Advisory - Improper Authorization Vulnerability in Huawei Products

There is an improper authorization vulnerability in Huawei products. A file access is not authorized correctly. Attacker with low access may launch privilege escalation in a specific scenario. This may compromise the normal service. Vulnerability ID: HWPSIRT-2020-05262 This vulnerability has been...

Security Advisory - Denial of Service Vulnerability in Some Huawei Products

There is a denial of service vulnerability in some Huawei products. An attacker could exploit this vulnerability by sending specific message to a targeted device. Due to insufficient input validation, successful exploit can cause the service abnormal. Vulnerability ID: HWPSIRT-2020-24699 This...

Vulnerabilities fixed in Xerox WorkCentre

Vulnerabilities have been fixed in Xerox WorkCentre. The vulnerabilities allow a remote malicious person to execute arbitrary code. There are no known CVE numbers for these vulnerabilities. Xerox has released updates to fix the vulnerabilities. More information can be found on the page below:...

Security Advisory - Denial of Service Vulnerability in Huawei Product

There is a denial of service vulnerability in Huawei products. A module cannot deal with specific messages due to validating inputs insufficiently. Attackers can exploit this vulnerability by sending specific messages to affected module. This can cause denial of service. Vulnerability ID:...

Intel® Processors Load Value Injection Advisory

Summary: Potential security vulnerabilities in some Intel® Processors may allow information disclosure. Intel and others are releasing software updates to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2020-0551 Description: Load value injection in some IntelR...

Speculative Execution and Indirect Branch Prediction Side Channel Analysis Method

Summary: Updated Recommendations Section 04/04/2018 Today a team of security researchers disclosed several software analysis methods that, when used for malicious purposes, have the potential to improperly gather sensitive data from many types of computing devices with many different vendors’...

Q3 2018 Speculative Execution Side Channel Update

Summary: Security researchers have identified a speculative execution side-channel method called L1 Terminal Fault L1TF. This method impacts select microprocessor products supporting Intel® Software Guard Extensions Intel® SGX. Further investigation by Intel has identified two related application...

Security Advisory - Memory Leak Vulnerability in Huawei Products

There is a memory leak vulnerability in Huawei products. A resource management weakness exists in a module. Attackers with high privilege can exploit this vulnerability by performing some operations. This can lead to memory leak. Vulnerability ID: HWPSIRT-2020-89990 This vulnerability has been...

Security Advisory - Insufficient Input Validation Vulnerability in FusionCompute Product

There is an insufficient input validation vulnerability in FusionCompute product. Due to the input validation is insufficient, an attacker can exploit this vulnerability to upload any files to the device. Successful exploit may cause the service abnormal. Vulnerability ID: HWPSIRT-2020-05085 This...

Cisco Integrated Management Controller Open Redirect Vulnerability

A vulnerability in the web-based management interface of Cisco Integrated Management Controller IMC Software could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of the parameters in an HTTP request. An...

Cisco SD-WAN vManage Software Information Disclosure Vulnerability

A vulnerability in the cluster management interface of Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system. To be affected by this vulnerability, the vManage software must be in cluster mode. This vulnerability is due t...