CVE-2021-25649 Avaya Utility Services Sensitive Information Disclosure Vulnerability

An information disclosure vulnerability was discovered in the directory and file management of Avaya Aura Utility Services. This vulnerability may potentially allow any local user to access system functionality and configuration information that should only be available to a privileged user...

CVE-2021-25649

CVE-2021-25649 affects Avaya Aura Utility Services (directory and file management) across all 7.x releases. The vulnerability is an information disclosure allowing any local user to access system functionality and configuration information that should be privileged, with CVSS3.1: AV:L/AC:L/PR:L/U...

PT-2021-16728 · Avaya · Avaya Aura Utility Services

Name of the Vulnerable Software and Affected Versions: Avaya Aura Utility Services versions 7.x Description: A privilege escalation issue was discovered in Avaya Aura Utility Services, potentially allowing a local user to execute specially crafted scripts as a privileged user. Recommendations: Fo...

CVE-2021-25651: Execution with Unnecessary Privileges

A privilege escalation vulnerability was discovered in Avaya Aura Utility Services that may potentially allow a local user to escalate privileges. Affects all 7.x versions of Avaya Aura Utility Services...

PT-2021-16729 · Avaya · Avaya Aura Utility Services

Name of the Vulnerable Software and Affected Versions: Avaya Aura Utility Services versions 7.x Description: A privilege escalation issue was discovered that may allow a local user to escalate privileges. Recommendations: For Avaya Aura Utility Services versions 7.x, at the moment, there is no...

CVE-2021-25649: Exposure of Sensitive Information to an Unauthorized Actor

An information disclosure vulnerability was discovered in the directory and file management of Avaya Aura Utility Services. This vulnerability may potentially allow any local user to access system functionality and configuration information that should only be available to a privileged user...

Avaya Aura Utility Services security vulnerabilities

Avaya Aura Utility Services is a group of tools and applications that support enterprise IP telephony from Avaya USA. A security vulnerability exists in Avaya Aura Utility Services that allows local users to escalate privileges. It affects all 7.x versions...

Avaya Aura Utility Services security vulnerabilities

Avaya Aura Utility Services is a group of tools and applications that support enterprise IP telephony from Avaya USA. A security vulnerability exists in Avaya Aura Utility Services that allows any local user to access system features and configuration information that should only be available to...

Avaya Aura Utility Services security vulnerabilities

Avaya Aura Utility Services is a group of tools and applications that support enterprise IP telephony from Avaya USA. A security vulnerability exists in Avaya Aura Utility Services that allows a local user to execute specially crafted scripts as a privileged user. It affects all 7.x versions...

PT-2021-16727 · Avaya · Avaya Aura Utility Services

Name of the Vulnerable Software and Affected Versions: Avaya Aura Utility Services versions 7.x Description: An information disclosure issue was found in the directory and file management of Avaya Aura Utility Services. This issue may allow any local user to access system functionality and...

CVE-2021-25650: Execution with Unnecessary Privileges

A privilege escalation vulnerability was discovered in Avaya Aura Utility Services that may potentially allow a local user to execute specially crafted scripts as a privileged user. Affects all 7.x versions of Avaya Aura Utility Services...

Pakistan-linked hackers targeted Indian power company with ReverseRat

A threat actor with suspected ties to Pakistan has been striking government and energy organizations in the South and Central Asia regions to deploy a remote access trojan on compromised Windows systems, according to new research. "Most of the organizations that exhibited signs of compromise were...

Utilities ‘Concerningly’ at Risk from Active Exploits

The amount of time that utility networks spend exposed to a known application exploit has spiked over the past two months — something analysts called out as a “concerning datapoint,” and an important reminder that ransomware isn’t the only threat utility networks need to secure against. A new...

elFinder Archive Command Injection

elFinder versions below 2.1.59 are vulnerable to a command injection vulnerability via its archive functionality. When creating a new zip archive, the name parameter is sanitized with the escapeshellarg php function and then passed to the zip utility. Despite the sanitization, supplying the -TmTT...

Irzip Reuse After Release Vulnerability

Irzip is a compression utility that excels at compressing large files. A post-release reuse vulnerability exists in the lzmadecompressbuf function in stream.c in Irzip version 0.631, which can be exploited by an attacker to cause a denial of service via specially crafted compressed files...

Circutor SGE-PLC1000 Licensing Issue Vulnerability

Circutor SGE-PLC1000 is a smart metering system device. The main function is to manage utility power through CIRWATT meters or other meters with PRIME technology.An authorization issue vulnerability exists in Circutor SGE-PLC1000 firmware version 0.9.2b, which can be exploited by attackers to pas...

Circutor SGE-PLC1000 OS Command Injection Vulnerability

Circutor SGE-PLC1000 is a smart metering system device. The primary function is to manage utility power through CIRWATT meters or other meters with PRIME technology.An operating system command injection vulnerability exists in firmware version 0.9.2b of the Circutor SGE-PLC1000, which can be...

CVE-2021-23024

On version 8.0.x before 8.0.0.1, and all 6.x and 7.x versions, the BIG-IQ Configuration utility has an authenticated remote command execution vulnerability in undisclosed pages. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2021-23024

On version 8.0.x before 8.0.0.1, and all 6.x and 7.x versions, the BIG-IQ Configuration utility has an authenticated remote command execution vulnerability in undisclosed pages. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

Design/Logic Flaw

On version 8.0.x before 8.0.0.1, and all 6.x and 7.x versions, the BIG-IQ Configuration utility has an authenticated remote command execution vulnerability in undisclosed pages. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...