CVE-2022-22391

IBM Aspera High-Speed Transfer 4.3.1 and earlier could allow an authenticated user to obtain information from non sensitive operating system files that they should not have access to. IBM X-Force ID: 222059...

CVE-2022-22391

IBM Aspera High-Speed Transfer 4.3.1 and earlier could allow an authenticated user to obtain information from non sensitive operating system files that they should not have access to. IBM X-Force ID: 222059...

Information disclosure

IBM Aspera High-Speed Transfer 4.3.1 and earlier could allow an authenticated user to obtain information from non sensitive operating system files that they should not have access to. IBM X-Force ID: 222059...

CVE-2022-22391

IBM Aspera High-Speed Transfer Server/Endpoint prior to 4.3.2 are vulnerable to information disclosure: an authenticated user could obtain information from non-sensitive OS files that should not be accessible. Affected products and versions include IBM Aspera High-Speed Transfer Server and Endpoi...

Threat Spotlight: "Haskers Gang" Introduces New ZingoStealer

Update 04/14/22: Following the initial publication of this blog, we observed a new post in the Haskers Gang Telegram channel announcing that ownership of the ZingoStealer project is being transferred to a new threat actor. We also observed the malware author offering to sell the source code for...

The vulnerability of the Mediation Engine component of the Oracle Communications Operations Monitor system allows a perpetrator to gain access to modify, add, or delete data.

The vulnerability of the Mediation Engine component of the Oracle Communications Operations Monitor visualization and monitoring system exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain read access to data o...

The vulnerability of the Python programming language interpreter’s FTP (File Transfer Protocol) client library allows attackers to perform SSRF attacks.

The vulnerability of the Python File Transfer Protocol client library is related to insufficient validation of data entered by users when the library is used in the PASV passive mode. Exploiting this vulnerability allows a malicious actor to configure a malicious FTP server, tricking the Python F...

IBM Aspera 信息泄露漏洞

IBM Aspera is a fast file transfer and streaming solution built on the IBM FASP protocol from IBM U.S.A. An information disclosure vulnerability exists in IBM Aspera High-Speed Transfer, which could be exploited by attackers to obtain information from non-sensitive operating system files to which...

PT-2022-15405 · Ibm · Ibm Aspera High-Speed Transfer

Name of the Vulnerable Software and Affected Versions: IBM Aspera High-Speed Transfer versions 4.3.1 and earlier Description: The issue allows an authenticated user to obtain information from non-sensitive operating system files that they should not have access to. Recommendations: For IBM Aspera...

Security Bulletin: OpenSSL vulnerability impacting Aspera High-Speed Transfer Server and Aspera High-Speed Transfer Endpoint 4.3.0 and earlier (CVE-2021-3712)

Summary The fix for OpenSSL vulnerability CVE-2021-3712 is delivered in Aspera High-Speed Transfer Server and Aspera High-Speed Transfer Endpoint 4.3.1 Vulnerability Details CVEID:CVE-2021-3712 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an...

curl: Requirement to use TLS not properly enforced for IMAP, POP3, and FTP protocols

A flaw was found in curl. This flaw lies in the --ssl-reqd option or related settings in libcurl. Users specify this flag to upgrade to TLS when communicating with either IMAP, POP3 or a FTP server. An attacker controlling such servers could return a crafted response which could lead to curl clie...

curl: Server responses received before STARTTLS processed after TLS handshake

A flaw was found in curl. The flaw lies in how curl handles cached or pipelined responses that it receives from either a IMAP, POP3, SMTP or FTP server before the TLS upgrade using STARTTLS. In such a scenario curl even after upgrading to TLS would trust these cached responses treating them as...

CVE-2022-22391

IBM Aspera High-Speed Transfer 4.3.1 and earlier could allow an authenticated user to obtain information from non sensitive operating system files that they should not have access to. IBM X-Force ID: 222059...

Samsung Smart Switch PC DLL hijacking vulnerability

Samsung Smart Switch PC is a Windows software from Samsung, a South Korean company, used for data transfer. A security vulnerability exists in previous versions of Samsung Smart Switch PC 4.2.220224, which can be exploited by attackers to execute arbitrary code...

The vulnerability in the implementation of the Hypertext Transfer Protocol (HTTP/1.1) of the Eclipse Jetty server container allows a attacker to send hidden HTTP requests (HTTP Request Smuggling attack).

The vulnerability of the Hypertext Transfer Protocol HTTP/1.1 implementation in Eclipse Jetty servers is related to deficiencies in handling the Transfer-Encoding and Content-Length headers. Exploiting this vulnerability allows a malicious actor to send hidden HTTP requests remotely a type of HTT...

CVE-2022-29051

Missing permission checks in Jenkins Publish Over FTP Plugin 1.16 and earlier allow attackers with Overall/Read permission to connect to an FTP server using attacker-specified credentials...

CVE-2022-29050

A cross-site request forgery CSRF vulnerability in Jenkins Publish Over FTP Plugin 1.16 and earlier allows attackers to connect to an FTP server using attacker-specified credentials...

tomcat: HTTP request smuggling when used with a reverse proxy

Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer...

PT-2022-19390 · Jenkins · Jenkins Publish Over Ftp Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Publish Over FTP Plugin versions 1.16 and earlier Description: A cross-site request forgery CSRF issue allows attackers to connect to an FTP server using attacker-specified credentials. Recommendations: For Jenkins Publish Over FTP...

The vulnerability of implementations of data transfer specifications in industrial networks using OPC UA .NET Standard and OPC UA .NET Legacy lies in the uncontrolled recursion involved. This allows attackers to trigger service failures.

The vulnerability of data transmission implementations in industrial networks using OPC UA .NET Standard and OPC UA .NET Legacy is related to uncontrolled recursion. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...