Apache Storm 1.x < 1.2.4 / 2.1.x < 2.1.1 / 2.2.x < 2.2.1 Multiple Vulnerabilities

The version of Apache Storm running on the remote host is affected by multiple vulnerabilities, as follows: - An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution RCE. CVE-2021-40865 - A Command Injecti...

CVE-2023-32186

A Allocation of Resources Without Limits or Throttling vulnerability in SUSE RKE2 allows attackers with access to K3s servers apiserver/supervisor port TCP 6443 cause denial of service. This issue affects RKE2: from 1.24.0 before 1.24.17+rke2r1, from v1.25.0 before v1.25.13+rke2r1, from v1.26.0...

CVE-2023-32186: Allocation of Resources Without Limits or Throttling

A Allocation of Resources Without Limits or Throttling vulnerability in SUSE RKE2 allows attackers with access to K3s servers apiserver/supervisor port TCP 6443 cause denial of service. This issue affects RKE2: from 1.24.0 before 1.24.17+rke2r1, from v1.25.0 before v1.25.13+rke2r1, from v1.26.0...

CVE-2023-32187

An Allocation of Resources Without Limits or Throttling vulnerability in SUSE k3s allows attackers with access to K3s servers' apiserver/supervisor port TCP 6443 cause denial of service. This issue affects k3s: from v1.24.0 before v1.24.17+k3s1, from v1.25.0 before v1.25.13+k3s1, from v1.26.0...

CVE-2023-32187

An Allocation of Resources Without Limits or Throttling vulnerability in SUSE k3s allows attackers with access to K3s servers' apiserver/supervisor port TCP 6443 cause denial of service. This issue affects k3s: from v1.24.0 before v1.24.17+k3s1, from v1.25.0 before v1.25.13+k3s1, from v1.26.0...

CVE-2023-32187: Allocation of Resources Without Limits or Throttling

An Allocation of Resources Without Limits or Throttling vulnerability in SUSE k3s allows attackers with access to K3s servers' apiserver/supervisor port TCP 6443 cause denial of service. This issue affects k3s: from v1.24.0 before v1.24.17+k3s1, from v1.25.0 before v1.25.13+k3s1, from v1.26.0...

RKE2 supervisor port is vulnerable to unauthenticated remote denial-of-service (DoS) attack via TLS SAN stuffing attack

Impact An issue was found in RKE2 where an attacker with network access to RKE2 servers' supervisor port TCP 9345 can force the TLS server to add entries to the certificate's Subject Alternative Name SAN list, through a stuffing attack, until the certificate grows so large that it exceeds the...

PT-2023-23656

Name of the Vulnerable Software and Affected Versions k3s versions 1.24.0 through 1.24.17 k3s versions 1.25.0 through 1.25.13 k3s versions 1.26.0 through 1.26.8 k3s versions 1.27.0 through 1.27.5 k3s versions 1.28.0 through 1.28.1 Description An Allocation of Resources Without Limits or Throttlin...

PT-2023-23655

Name of the Vulnerable Software and Affected Versions SUSE RKE2 versions 1.24.0 through 1.24.17+rke2r1 SUSE RKE2 versions 1.25.0 through 1.25.13+rke2r1 SUSE RKE2 versions 1.26.0 through 1.26.8+rke2r1 SUSE RKE2 versions 1.27.0 through 1.27.5+rke2r1 SUSE RKE2 versions 1.28.0 through 1.28.1+rke2r1...

The vulnerability of the CE_A protocol implementation in the data collection and transmission device CE805M allows a hacker to modify the equipment settings.

The vulnerability of the CEA protocol implementation in the data collection and transmission device CE805M is related to an undocumented user account called SUPERVISOR. Exploiting this vulnerability could allow a malicious actor to remotely alter the equipment’s settings...

PT-2023-3935 · Cisco · Cisco Broadworks

Name of the Vulnerable Software and Affected Versions: Cisco BroadWorks affected versions not specified Description: A vulnerability in the privilege management functionality could allow an authenticated, local attacker to elevate privileges to root on an affected system. This issue is due to...

CVE-2023-3527

A CSV injection vulnerability was found in the Avaya Call Management System CMS Supervisor web application which allows a user with administrative privileges to input crafted data which, when exported to a CSV file, may attempt arbitrary command execution on the system used to open the file by a...

PT-2023-25199

Name of the Vulnerable Software and Affected Versions Avaya Call Management System CMS Supervisor affected versions not specified Description A CSV injection issue was found in the Avaya Call Management System CMS Supervisor web application, allowing a user with administrative privileges to input...

CVE-2023-3527: Improper Neutralization of Formula Elements in a CSV File

A CSV injection vulnerability was found in the Avaya Call Management System CMS Supervisor web application which allows a user with administrative privileges to input crafted data which, when exported to a CSV file, may attempt arbitrary command execution on the system used to open the file by a...

Cisco UCS-IMC Supervisor 2.2.0.0 Authentication Bypass

Exploit Title: Cisco UCS-IMC Supervisor 2.2.0.0 - Authentication Bypass + Cisco IMC Supervisor - 2.2.1.0 + Date: 08/21/2019 + Affected Component: /app/ui/ClientServlet?apiName=GetUserInfo + Vendor:...

Cisco UCS-IMC Supervisor 2.2.0.0 - Authentication Bypass Vulnerability

Exploit Title: Cisco UCS-IMC Supervisor 2.2.0.0 - Authentication Bypass + Cisco IMC Supervisor - 2.2.1.0 + Affected Component: /app/ui/ClientServlet?apiName=GetUserInfo + Vendor:...

Cisco UCS-IMC Supervisor 2.2.0.0 - Authentication Bypass

Exploit Title: Cisco UCS-IMC Supervisor 2.2.0.0 - Authentication Bypass + Cisco IMC Supervisor - 2.2.1.0 + Date: 08/21/2019 + Affected Component: /app/ui/ClientServlet?apiName=GetUserInfo + Vendor:...

USN-6230-1 postgresql-9.5 vulnerability

Alexander Lakhin discovered that PostgreSQL incorrectly handled certain CREATE privileges. An authenticated user could possibly use this issue to execute arbitrary code as the bootstrap supervisor...

USN-6230-1: PostgreSQL vulnerability

Alexander Lakhin discovered that PostgreSQL incorrectly handled certain CREATE privileges. An authenticated user could possibly use this issue to execute arbitrary code as the bootstrap supervisor...

Zyxel Chained Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'socket' require 'digest/md5' class MetasploitModule 'Zyxel chained RCE using LFI and weak password derivation algorithm', 'Description' = %q This module exploit...