CVE-2022-39301 sra-admin is vulnerable to storage cross-site scripting (XSS) via unrestricted file upload

sra-admin is a background rights management system that separates the front and back end. sra-admin version 1.1.1 has a storage cross-site scripting XSS vulnerability. After logging into the sra-admin background, an attacker can upload an html page containing xss attack code in "Personal Center" ...

sra-upstateny.org Cross Site Scripting vulnerability OBB-2988416

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2021-32958

Successful exploitation of this vulnerability on Claroty Secure Remote Access SRA Site versions 3.0 through 3.2 allows an attacker with local command line interface access to gain the secret key, subsequently allowing them to generate valid session tokens for the web user interface UI. With acces...

CVE-2021-32958

The CVE-2021-32958 vulnerability affects Claroty Secure Remote Access (SRA) Site versions 3.0–3.2. Attack requires local command-line access to obtain the secret key, then enables generation of valid session tokens for the web UI. This allows an attacker with local access to reach assets managed ...

Jenkins Serena SRA Deploy Plugin stores credentials in plain text

Jenkins Serena SRA Deploy Plugin stores credentials unencrypted in its global configuration file com.urbancode.ds.jenkins.plugins.serenarapublisher.UrbanDeployPublisher.xml on the Jenkins controller. These credentials can be viewed by users with access to the Jenkins controller file system...

GHSA-RWRX-HRF2-V577 Jenkins Serena SRA Deploy Plugin stores credentials in plain text

Jenkins Serena SRA Deploy Plugin stores credentials unencrypted in its global configuration file com.urbancode.ds.jenkins.plugins.serenarapublisher.UrbanDeployPublisher.xml on the Jenkins controller. These credentials can be viewed by users with access to the Jenkins controller file system...

CVE-2022-22279

A post-authentication arbitrary file read vulnerability impacting end-of-life Secure Remote Access SRA products and older firmware versions of Secure Mobile Access SMA 100 series products, specifically the SRA appliances running all 8.x, 9.0.0.5-19sv and earlier versions and Secure Mobile Access...

CVE-2022-22279

CVE-2022-22279 describes a post-authentication arbitrary file read affecting end-of-life SonicWall SRA appliances (all 8.x and 9.0.0.5-19sv and earlier) and SMA 100 series firmware (9.0.0.9-26sv and earlier). The available sources do not specify the exact vulnerable component or root cause. Impac...

sra.sag.gob.cl Cross Site Scripting vulnerability OBB-2454417

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

SonicWall Secure Remote Access (SRA) SQL Injection Vulnerability

SonicWall Secure Remote Access SRA products contain an improper neutralization of a SQL Command leading to SQL injection...

Command injection

UNSUPPORTED WHEN ASSIGNED Improper neutralization of Special Elements leading to OS Command Injection vulnerability impacting end-of-life Secure Remote Access SRA products and older firmware versions of Secure Mobile Access SMA 100 series products, specifically the SRA appliances running all 8.x,...

CVE-2022-22273

Improper neutralization of Special Elements leading to OS Command Injection vulnerability impacting end-of-life Secure Remote Access SRA products and older firmware versions of Secure Mobile Access SMA 100 series products, specifically the SRA appliances running all 8.x, 9.0.0.5-19sv and earlier...

CVE-2022-22273

Improper neutralization of Special Elements leading to OS Command Injection vulnerability impacting end-of-life Secure Remote Access SRA products and older firmware versions of Secure Mobile Access SMA 100 series products, specifically the SRA appliances running all 8.x, 9.0.0.5-19sv and earlier...

CVE-2022-22273

CVE-2022-22273 describes an OS Command Injection in end-of-life SonicWall SRA appliances and SMA 100 series firmware (SRA 8.x and SMA 9.0.0.5-19sv / 9.0.0.9-26sv and earlier). Root cause: improper neutralization of special elements. Impact: post-auth access leading to command execution with high ...

SonicWall SSLVPN 操作系统命令注入漏洞

SonicWALL SSLVPN is a transparent software application for Windows and Linux users from SonicWALL USA. It enables remote users to securely connect to the corporate network. An operating system command injection vulnerability exists in SonicWall SSLVPN and affects the following products and...

Security Bulletin: IBM Spectrum Virtualize Family Storage Replication Adapter (SRA) is affected by a vulnerability in Apache Log4j (CVE-2021-4104)

Summary A vulnerability was identified within the Apache Log4j library that is used by IBM Spectrum Virtualize Family Storage Replication Adapter SRA for IBM Spectrum Virtualize family storage systems. This vulnerability has been addressed. Vulnerability Details CVEID: CVE-2021-4104 DESCRIPTION:...

CVE-2021-20028

Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access SRA products, specifically the SRA appliances running all 8.x firmware and 9.0.0.9-26sv or earlier...

Sql injection

UNSUPPORTED WHEN ASSIGNED Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access SRA products, specifically the SRA appliances running all 8.x firmware and 9.0.0.9-26sv or earlier...

CVE-2021-20028

Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access SRA products, specifically the SRA appliances running all 8.x firmware and 9.0.0.9-26sv or earlier...

CVE-2021-20028

CVE-2021-20028 is an SQL injection in SonicWall Secure Remote Access (SRA) appliances and SRA/SMA endpoints due to improper neutralization of SQL commands. Affected products include end-of-life SRA appliances with 8.x firmware and 9.0.0.9-26sv or earlier. The vulnerability has a high/critical imp...