The vulnerability of static data created by software for generating reports in Cisco Security Manager’s extended security environments allows attackers to gain unauthorized access to protected information.

The vulnerability of static data in the software tool for creating reports in Cisco Security Manager-enabled extended security environments is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to...

Cisco Security Manager Input Validation Error Vulnerability (CNVD-2020-72726)

Cisco Security Manager CSM is a suite of enterprise-level management applications from Cisco that are used to configure firewall, VPN, and intrusion protection security services on Cisco network and security devices. A security vulnerability exists in Cisco Security Manager that stems from...

UAFuzz - Binary-level Directed Fuzzing For Use-After-Free Vulnerabilities

Directed Greybox Fuzzing DGF like AFLGo aims to perform stress testing on pre-selected potentially vulnerable target locations, with applications to different security contexts: 1 bug reproduction, 2 patch testing or 3 static analysis report verification. There are recently more research work tha...

CVE-2020-6879

Some ZTE devices have input verification vulnerabilities. The devices support configuring a static prefix through the web management page. The restriction of the front-end code can be bypassed by constructing a POST request message and sending the request to the creation of a static routing rule...

Design/Logic Flaw

Some ZTE devices have input verification vulnerabilities. The devices support configuring a static prefix through the web management page. The restriction of the front-end code can be bypassed by constructing a POST request message and sending the request to the creation of a static routing rule...

CVE-2020-6879

Some ZTE devices have input verification vulnerabilities. The devices support configuring a static prefix through the web management page. The restriction of the front-end code can be bypassed by constructing a POST request message and sending the request to the creation of a static routing rule...

ZTE ZXHN F670 and ZTE ZXHN H108N Input Validation Error Vulnerability

The ZTE ZXHN F670 and the ZTE ZXHN H108N are both modems from China's ZTE Corporation ZTE. An input validation error vulnerability exists in some of the ZTE devices, which stems from the fact that these devices support configuration of static prefixes via a web management page. It is possible to...

Cisco Patches Critical Flaw After PoC Exploit Code Release

A day after proof-of-concept PoC exploit code was published for a critical flaw in Cisco Security Manager, Cisco has hurried out a patch. Cisco Security Manager is an end-to-end security management application for enterprise administrators, which gives them the ability to enforce various security...

CVE-2020-27125

A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to access sensitive information on an affected system. The vulnerability is due to insufficient protection of static credentials in the affected software. An attacker could exploit this vulnerability by...

CVE-2020-27125

A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to access sensitive information on an affected system. The vulnerability is due to insufficient protection of static credentials in the affected software. An attacker could exploit this vulnerability by...

Design/Logic Flaw

A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to access sensitive information on an affected system. The vulnerability is due to insufficient protection of static credentials in the affected software. An attacker could exploit this vulnerability by...

CVE-2020-27125 Cisco Security Manager Static Credential Vulnerability

A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to access sensitive information on an affected system. The vulnerability is due to insufficient protection of static credentials in the affected software. An attacker could exploit this vulnerability by...

CVE-2020-27125 Cisco Security Manager Static Credential Vulnerability

A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to access sensitive information on an affected system. The vulnerability is due to insufficient protection of static credentials in the affected software. An attacker could exploit this vulnerability by...

Cisco Security Manager < 4.22 Static Credential Usage (cisco-sa-csm-rce-8gjUz9fW)

The version of Cisco Security Manager running on the remote web server is prior to 4.22. It is, therefore, affected static credential usage. An unauthenticated, remote attacker could exploit this, by analyzing the application source code and obtaining credentials, to access sensitive information ...

CVE-2020-27125

A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to access sensitive information on an affected system. The vulnerability is due to insufficient protection of static credentials in the affected software. An attacker could exploit this vulnerability by...

Cisco Security Manager Static Credential Vulnerability

A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to access sensitive information on an affected system. The vulnerability is due to insufficient protection of static credentials in the affected software. An attacker could exploit this vulnerability by...

IMChecker

This repository is an offensive tool for API misuse detection, specifically designed to identify API misuse bugs in C programs. The tool is called IMChecker, and it uses a constraint-directed static analysis technique powered by a domain-specific language DSL for specifying API usage constraints...

RUSTSEC-2020-0115 Singleton lacks bounds on Send and Sync.

Singleton is meant to be a static object that can be initialized lazily. In order to satisfy the requirement that static items must implement Sync, Singleton implemented both Sync and Send unconditionally. This allows for a bug where non-Sync types such as Cell can be used in singletons and cause...

Cisco Security Manager 输入验证错误漏洞

Cisco Security Manager CSM is a suite of enterprise-level management applications from Cisco that are used to configure firewall, VPN, and intrusion protection security services on Cisco network and security devices. A security vulnerability exists in Cisco Security Manager that stems from...

GitLab Enterprise Edition Security Vulnerability

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in the GitLab EE version...