3087 matches found
Session fixation
Serv-U server responds with valid CSRFToken when the request contains only Session...
CVE-2021-35242
CVE-2021-35242 affects SolarWinds Serv-U: the vulnerability arises because the Serv-U server responds with a valid CSRF token even when a request contains only a Session, enabling CSRF-like abuse. The public records show CVSS data indicating network attack vector with high impact on confidentiali...
CVE-2021-35245
CVE-2021-35245 affects SolarWinds Serv-U: when a user has admin rights in the Serv-U Console, they can move, create, and delete files accessible on the Serv-U host machine. The Nessus plugin for SolarWinds Serv-U 15.2.4
CVE-2021-35245 Broken Access Control Vulnerability for SolarWinds Serv-U
When a user has admin rights in Serv-U Console, the user can move, create and delete any files are able to be accessed on the Serv-U host machine...
SolarWinds Serv-U File Server 安全漏洞
Solarwinds SolarWinds Serv-U File Server is a file transfer server from SolarWinds USA. A security vulnerability exists in the SolarWinds Serv-U File Server that allows a user with administrator privileges in the Serv-U console to move, create, and delete any file that is accessible on the Serv-U...
SolarWinds Serv-U FTP Server 服务器 跨站请求伪造漏洞
SolarWinds Serv-U FTP Server is a suite of FTP and MFT file transfer software from SolarWinds, Inc. in the United States. A security vulnerability exists in Serv-U Server that stems from the Serv-U Server responding with a valid CSRFToken when a request contains only a Session...
PT-2021-20865 · Unknown · Serv-U Console
Name of the Vulnerable Software and Affected Versions: Serv-U Console affected versions not specified Description: The issue allows a user with admin rights in Serv-U Console to move, create, and delete any files accessible on the Serv-U host machine. Recommendations: At the moment, there is no...
CVE-2021-35245: Improper Access Control
When a user has admin rights in Serv-U Console, the user can move, create and delete any files are able to be accessed on the Serv-U host machine...
CVE-2021-35242: Cross-Site Request Forgery (CSRF)
Serv-U server responds with valid CSRFToken when the request contains only Session...
Auerswald COMpact 8.0B Backdoors
Advisory: Auerswald COMpact Multiple Backdoors RedTeam Pentesting discovered several backdoors in the firmware for the Auerswald COMpact 5500R PBX. These backdoors allow attackers who are able to access the web-based management application full administrative access to the device. Details =======...
SolarWinds Serv-U Remote Code Execution (CVE-2021-35211)
A remote code execution vulnerability exists in SolarWinds Serv-U. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...
CVE-2021-35245
When a user has admin rights in Serv-U Console, the user can move, create and delete any files are able to be accessed on the Serv-U host machine...
A week in security (Nov 8 – Nov 14)
Last week on Malwarebytes Labs Multiple video games break after domain name snafu How to remove adware on an Android phone Smart TV adverts put a wrinkle in your programming Are cybercriminals turning away from the US and targeting Europe instead? Patch now! Microsoft plugs actively exploited...
EulerOS 2.0 SP9 : uboot-tools (EulerOS-SA-2021-2701)
According to the versions of the uboot-tools packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In Das U-Boot through 2020.01, a double free has been found in the cmd/gpt.c dorenamegptparts function. Double freeing may result in a...
CVE-2021-31882
A vulnerability has been identified in Capital Embedded AR Classic 431-422 All versions, Capital Embedded AR Classic R20-11 All versions V2303. The DHCP client application does not validate the length of the Domain Name Server IP options 0x06 when processing DHCP ACK packets. This may lead to...
CVE-2021-31883
CVE-2021-31883 affects Siemens APOGEE MBC / TALON products (Nucleus RTOS) including APOGEE MBC (PPC/BACnet), APOGEE MEC, APOGEE PXC Compact/Modular, Desigo PXC variants, and Capital VSTAR with Ethernet options. Root cause: DHCP client processing fails to validate the length of Vendor option(s) in...
Threat actor DEV-0322 exploiting ZOHO ManageEngine ADSelfService Plus
Microsoft has detected exploits being used to compromise systems running the ZOHO ManageEngine ADSelfService Plus software versions vulnerable to CVE-2021-40539 in a targeted campaign. Microsoft Threat Intelligence Center MSTIC attributes this campaign with high confidence to DEV-0322, a group...
CVE-2021-31888: Improper Null Termination
A vulnerability has been identified in APOGEE MBC PPC BACnet All versions, APOGEE MBC PPC P2 Ethernet All versions, APOGEE MEC PPC BACnet All versions, APOGEE MEC PPC P2 Ethernet All versions, APOGEE PXC Compact BACnet All versions = V2.3 and = V2.3 and = V2.3 and = V2.3 and = V2.3 and = V2.3 and...
Hands-On IoT Hacking: Rapid7 at DefCon 29 IoT Village, Part 3
In our first post in this series, we covered the setup of Rapid7's hands-on exercise at Defcon 29's IoT Village. Last week, we discussed how to determine the UART status of the header we created and how to actually start hacking on the IoT device. The goal in this next phase of the IoT hacking...
