Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM WebSphere Cast Iron Solution & App Connect Professional

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, which are used by IBM Cast Iron Solution & App Connect Professional . These issues were disclosed as part of the IBM Java SDK updates in January 2021, IBM Cast Iron & App Connect Professional have addressed the...

Cisco SD-WAN Solution Software Privilege Escalation (cisco-sa-vmpresc-SyzcS4kC)

According to its self-reported version, Cisco SD-WAN Solution Software is affected by a privilege escalation vulnerability due to insufficient input validation. An authenticated, local attacker can exploit this by sending a crafted request in order to gain administrative privileges. Please see th...

RHEL 7 : curl (RHSA-2021:0877)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0877 advisory. The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, a...

Cybozu Office Cross-Site Scripting Vulnerability (CNVD-2021-18063)

Cybozu Office is a Web-based, cross-platform collaboration solution from Cybozu. A cross-site scripting vulnerability exists in the address book in Cybozu Office. The vulnerability can be exploited to execute arbitrary script in a logged-in user's web browser...

MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 Cross-Site Scripting Vulnerability (CNVD-2021-56802)

MB CONNECT LINE mymbCONNECT24 is an internal remote maintenance solution for virtual environments from the German company MB CONNECT LINE Mb Connect Line. MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 are vulnerable to cross-site scripting. No detailed vulnerability details are currently availabl...

DomainMOD < 4.18.0 Session Expiration Vulnerability

DomainMOD is prone to a session expiration vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:domainmod:domainmod"; i...

One-Click Microsoft Exchange On-Premises Mitigation Tool – March 2021

We have been actively working with customers through our customer support teams, third-party hosters, and partner network to help them secure their environments and respond to associated threats from the recent Exchange Server on-premises attacks. Based on these engagements we realized that there...

One-Click Microsoft Exchange On-Premises Mitigation Tool - March 2021

We have been actively working with customers through our customer support teams, third-party hosters, and partner network to help them secure their environments and respond to associated threats from the recent Exchange Server on-premises attacks. Based on these engagements we realized that there...

One-Click Microsoft Exchange On-Premises Mitigation Tool - March 2021

We have been actively working with customers through our customer support teams, third-party hosters, and partner network to help them secure their environments and respond to associated threats from the recent Exchange Server on-premises attacks. Based on these engagements we realized that there...

Hikvision Integrated Video and Environmental Monitoring Management System Exploits Arbitrary File Download Vulnerability

Hikvision is a video-centric IoT solution provider, offering integrated security, smart business and big data services. An arbitrary file download vulnerability exists in Hikvision's integrated video and environmental surveillance management system, which can be exploited by attackers to obtain...

Cisco SD-WAN Solution Command Injection (cisco-sa-sdwclici-cvrQpH9v)

According to its self-reported version, Cisco SD-WAN Solution is affected by a command injection vulnerability due to insufficient input validation. An authenticated, local attacker can exploit this, by authenticating to the device and submitting crafted input to the CLI utility, in order to inje...

Debian: Security Advisory (DLA-2589-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cisco SD-WAN Solution SQLI (cisco-sa-20200122-sdwan-sqlinj)

According to its self-reported version, Cisco SD-WAN vManage is affected by an SQL injection SQLI vulnerability in the web interface due to insufficient validation of user-supplied input. An authenticated, remote attacker can exploit this, by sending crafted input that includes SQL statements to ...

Cisco SD-WAN Solution vManage Cross-Site Request Forgery (cisco-sa-20191120-vman-csrf)

The version of Cisco SD-WAN Solution vManage installed on the remote host is affected by a vulnerability as referenced in the cisco-sa-20191120-vman-csrf advisory, as follows: - A vulnerability in the vManage web-based UI web UI of the Cisco SD-WAN Solution could allow an unauthenticated, remote...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli System Automation Application Manager Jan 2021 CPU (CVE-2020-27221)

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition used by IBM Tivoli System Automation Application Manager. These issues were disclosed as part of the IBM Java SDK updates in Jan 2021. Vulnerability Details CVEID: CVE-2020-27221 DESCRIPTION: Eclipse OpenJ9 is vulnerabl...

Owncloud Authorization Issues Vulnerabilities

OwnCloud OwnCloud is a personal cloud storage solution from OwnCloud Owncloud, an American company. An authorization issue vulnerability exists in OwnCloud, which can be exploited by an attacker to bypass authentication of password-protected images by displaying a preview...

MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 Cross-Site Request Forgery Vulnerability (CNVD-2021-17231)

Mb Connect Line MB CONNECT LINE mymbCONNECT24 is an in-house remote maintenance solution for virtual environments from MB CONNECT LINE Mb Connect Line, Germany. A cross-site request forgery vulnerability exists in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24, which can be exploited by an attacke...

Emerson Smart Wireless Gateway 1420 4.6.59 Privilege Escalation Vulnerability

Title: Privilege Escalation Product: Emerson Smart Wireless Gateway Vendor Homepage: http://emerson.com Vulnerable Version: 1420 4.6.59 CVE Number: CVE-2020-19417 Authors: Harsha Bhat Anish Mitra and Unmesh Guragol Timeline: 2019-08-02 Disclosed to the vendor 2019-08-22 Vendor confirmed that the...

MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 File Containment Vulnerability

Mb Connect Line MB CONNECT LINE mymbCONNECT24 is an in-house remote maintenance solution for virtual environments from MB CONNECT LINE Mb Connect Line, Germany. A local file inclusion vulnerability exists in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24, which can be exploited by a remote attacke...

Huawei EulerOS: Security Advisory for unbound (EulerOS-SA-2021-1523)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...