SAP Solution Manager 7.2 Remote Command Execution Exploit

This Metasploit module exploits the CVE-2020-6207 vulnerability within the SAP EEM servlet of SAP Solution Manager SolMan running version 7.2. The vulnerability occurs due to missing authentication checks when submitting a SOAP request to the /EemAdminService/EemAdmin page to get information abou...

JVN#83042295: Yomi-Search vulnerable to cross-site scripting

Yomi-Search provided by WonderLink is a directory type search engine program. Yomi-Search contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the web browser of the user who is accessing a website that uses Yomi-Search. Solution Consider stop using...

FreeBSD-SA-21:07.openssl

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-21:07.openssl Security Advisory The FreeBSD Project Topic: Multiple vulnerabilities in OpenSSL Category: contrib Module: openssl Announced: 2021-03-25 Affects:...

Fedora: Security Advisory for kernel (FEDORA-2021-f0181b8085)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

WordPress Thrive Headline Optimizer premium plugin <= 1.3.7.2 - Unauthenticated Option Update vulnerability

Unauthenticated Option Update vulnerability discovered by WordFence in WordPress Thrive Headline Optimizer premium plugin versions = 1.3.7.2. Solution Update the WordPress Thrive Headline Optimizer premium plugin to the latest available version at least 1.3.7.3...

WordPress Focusblog premium theme <= 1.97 - Unauthenticated Arbitrary File Upload and Option Deletion

Unauthenticated Arbitrary File Upload and Option Deletion discovered by WordFence in WordPress Focusblog premium theme versions = 1.97. Solution Update the WordPress Focusblog premium theme to the latest available version at least 2.0.0...

Medius’ small IT team supports distributed workforce with Azure Active Directory

In today’s Voice of the Customer blog post, IT Manager Jacob Andersson and IT Systems Architect Fredrik Frööjd of Medius share how Azure Active Directory Azure AD has inspired employees to live by the cloud commitment the company encourages from customers and helped their small team support a...

FTAPI Cross-Site Scripting Vulnerability

FTAPI is an end-to-end encrypted file transfer and data room solution with unlimited file size. A cross-site scripting vulnerability exists in the "Background Image" upload function in the "Submit Box Template Editor" in FTAPI 4.0 - 4.10. An attacker can exploit this vulnerability by uploading an...

SAP Solution Manager Remote Code Execution (CVE-2020-6207)

A remote code execution vulnerability exists in SAP Solution Manager. The vulnerability is due to a lack of authentication in the User Experience Monitoring componant. A remote, unauthenticated attacker could exploit this vulnerability by sending a crafted request to the target server. Successful...

Fedora: Security Advisory for tracker3-miners (FEDORA-2021-303f6623fa)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Security Bulletin: Vulnerabilities in IBM Java SDK affect IBM WebSphere Cast Iron Solution & App Connect Professional

Summary Vulnerabilities in IBM® SDK Java™ Technology Edition, which are used by IBM WebSphere Cast Iron Solution & App Connect Professional . These issues were disclosed as part of the IBM Java SDK updates in Oct 2020 , IBM WebSphere Cast Iron Solution & App Connect Professional have addressed th...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM WebSphere Cast Iron Solution & App Connect Professional

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, which are used by IBM Cast Iron Solution & App Connect Professional . These issues were disclosed as part of the IBM Java SDK updates in January 2021, IBM Cast Iron & App Connect Professional have addressed the...

Cisco SD-WAN Solution Software Privilege Escalation (cisco-sa-vmpresc-SyzcS4kC)

According to its self-reported version, Cisco SD-WAN Solution Software is affected by a privilege escalation vulnerability due to insufficient input validation. An authenticated, local attacker can exploit this by sending a crafted request in order to gain administrative privileges. Please see th...

RHEL 7 : curl (RHSA-2021:0877)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0877 advisory. The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, a...

DomainMOD < 4.18.0 Session Expiration Vulnerability

DomainMOD is prone to a session expiration vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:domainmod:domainmod"; i...

MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 Cross-Site Scripting Vulnerability (CNVD-2021-56802)

MB CONNECT LINE mymbCONNECT24 is an internal remote maintenance solution for virtual environments from the German company MB CONNECT LINE Mb Connect Line. MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 are vulnerable to cross-site scripting. No detailed vulnerability details are currently availabl...

Cybozu Office Cross-Site Scripting Vulnerability (CNVD-2021-18063)

Cybozu Office is a Web-based, cross-platform collaboration solution from Cybozu. A cross-site scripting vulnerability exists in the address book in Cybozu Office. The vulnerability can be exploited to execute arbitrary script in a logged-in user's web browser...

One-Click Microsoft Exchange On-Premises Mitigation Tool – March 2021

We have been actively working with customers through our customer support teams, third-party hosters, and partner network to help them secure their environments and respond to associated threats from the recent Exchange Server on-premises attacks. Based on these engagements we realized that there...

One-Click Microsoft Exchange On-Premises Mitigation Tool - March 2021

We have been actively working with customers through our customer support teams, third-party hosters, and partner network to help them secure their environments and respond to associated threats from the recent Exchange Server on-premises attacks. Based on these engagements we realized that there...

One-Click Microsoft Exchange On-Premises Mitigation Tool - March 2021

We have been actively working with customers through our customer support teams, third-party hosters, and partner network to help them secure their environments and respond to associated threats from the recent Exchange Server on-premises attacks. Based on these engagements we realized that there...