ZZCMS Password Reset Vulnerability

ZZCMS is a content management system CMS by Zzcms team in China. A password reset vulnerability exists in zzcms version 201910. The vulnerability stems from The vulnerability stems from an improperly designed or implemented code development process for a web-based system or product. An attacker c...

Insecure Temporary File And Folder

openapi-generator-online uses insecure temporary file and folder. The usage of Files.createTempFile to create temporary files and folders allows auto-generated files to be read and modified by any user on the system...

OPENSUSE-SU-2021:0602-1 Security update for sudo

This update for sudo fixes the following issues: - L3: Tenable Scan reports sudo is vulnerable to CVE-2021-3156 bsc1183936 This update was imported from the SUSE:SLE-15:Update update project...

Path Traversal in Ansible

An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage to overwrite any file with...

Eaton Intelligent Power Manager Arbitrary File Deletion Vulnerability (CNVD-2021-31672)

Eaton Intelligent Power Manager IPM is an intelligent power manager from Eaton Corporation that supports remote monitoring and management of multiple devices in a network from an interface. An arbitrary file deletion vulnerability exists in Eaton Intelligent Power Manager versions prior to 1.69,...

EUVD-2021-15025

Remote Procedure Call Runtime Remote Code Execution Vulnerability...

EUVD-2021-15018

Remote Procedure Call Runtime Remote Code Execution Vulnerability...

Siemens Nucleus DNS (Update A)

1. EXECUTIVE SUMMARY CVSS v3 5.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: Nucleus Vulnerability: Use of Insufficiently Random Values 2. UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled ICSA-21-103-14 Siemens Nucleus...

Invigo Automatic Device Management Command Injection (CVE-2020-10583)

A command injection vulnerability exists in Invigo Automatic Device Management. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

Mark Text cross-site scripting vulnerability (CNVD-2021-27921)

Mark Text is a high-performance Markdown editor, built on Electron and running on Mac, Windows and Linux platforms, with a clean look and a focus on speed and usability. A cross-site scripting vulnerability exists in Mark Text in version 0.16.3 and earlier, which is related to the failure of the...

EPrints Scholix Remote Code Execution

A remote code execution vulnerability exists in EPrints Scholix. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

GE MU320E

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: GE Equipment: MU320E Vulnerabilities: Use of Hard-coded Password, Execution with Unnecessary Privileges, Inadequate Encryption Strength 2. RISK EVALUATION Successful exploitation of these...

CVE-2020-35519

An out-of-bounds OOB memory access flaw was found in x25bind in net/x25/afx25.c in the Linux kernel. A bounds check failure allows a local attacker with a user account on the system to gain access to out-of-bounds memory, leading to a system crash or a leak of internal kernel information. The...

SYS.2.3.A18

Es SOLLTEN mit speziell gehaerteten Kernels z. B. grsecurity, PaX geeignete Schutzmassnahmen wie Speicherschutz, Dateisystemabsicherung und rollenbasierte Zugriffskontrolle umgesetzt werden, die eine Ausnutzung von Schwachstellen und die Ausbreitung im Betriebssystem verhindern...

NewStart CGSL CORE 5.04 / MAIN 5.04 : shim Vulnerability (NS-SA-2021-0009)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has shim packages installed that are affected by a vulnerability: - A flaw was found in grub2, prior to version 2.06. An attacker may use the GRUB 2 flaw to hijack and tamper the GRUB verification process. This flaw also allows...

CVE-2021-21481

The MigrationService, which is part of SAP NetWeaver versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform an authorization check. This might allow an unauthorized attacker to access configuration objects, including such that grant administrative privileges. This could result in...

Siemens LOGO! 8 BM

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...

Security Bulletin: IBM Cloud Pak for Multicloud Management Monitoring returns potentially sensitive information in headers which could lead to further attacks against the system.

Summary IBM Cloud Pak for Multicloud Management Monitoring returns potentially sensitive information in headers which could lead to further attacks against the system. Vulnerability Details CVEID: CVE-2021-20341 DESCRIPTION: IBM Cloud Pak for Multicloud Management Monitoring returns potentially...

CVE-2021-21352

Anuko Time Tracker (PHP) before version 1.19.24.5415 uses time-based tokens in the password-reset feature, enabling brute-force guessing to change user passwords (including admin). The issue is addressed in 1.19.24.5415 (better tokens) and further limited in 1.19.24.5416 with a reduced brute-forc...

General Overview of Vulnerability Management

In a world where most companies take nearly six months to detect a data breach, establishing a comprehensive and continuous process for identifying, classifying, mitigating and preventing security vulnerabilities within an organization can help prevent current cybersecurity challenges...