IBM UrbanCode Deploy 加密问题漏洞

IBM UrbanCode Deploy UCD is a suite of application automation deployment tools from IBM. The tool is based on an application deployment automation management information model, and through remote agent technology to automate the deployment of complex applications in different environments, etc. I...

CVE-2021-45031

A vulnerability in MEPSAN's USC+ before version 3.0 has a weakness in login function which lets attackers to generate high privileged accounts passwords...

PT-2022-12294

Name of the Vulnerable Software and Affected Versions MEPSAN's USC+ versions prior to 3.0 Description A weakness in the login function of the affected software allows attackers to generate high-privileged account passwords. Recommendations For versions prior to 3.0, update to version 3.0 or later...

The vulnerability of the InnoDB component of the MySQL Database Server allows a attacker to compromise data integrity and cause service failures.

The vulnerability of the InnoDB component of the MySQL Database Server exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to compromise data integrity and cause service failures...

Security Advisory 0073

Security Advisory 0073 . CSAF PDF Date: March 29th, 2022 Version: 1.0 Revision | Date | Changes ---|---|--- 1.0 | March 29th, 2022 | Initial Release The CVE-ID tracking this issue: CVE-2021-28505 CVSSv3.1 Base Score: 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Common Weakness Enumeration:...

The vulnerability of microprogrammed power supply systems of APC Smart-UPS models series SMT, SMC, SCL, SMX, SRT, SRTL is related to deficiencies in authentication procedures, allowing attackers to arbitrarily alter the behavior of the UPS.

The vulnerability of microprogrammed power supply systems from APC Smart-UPS models series SMT, SMC, SCL, SMX, SRT, and SRTL is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow an attacker, operating remotely, to arbitrarily alter the behavior of the U...

CVE-2021-27428

GE UR IED firmware versions prior to version 8.1x supports upgrading firmware using UR Setup configuration tool – Enervista UR Setup. This UR Setup tool validates the authenticity and integrity of firmware file before uploading the UR IED. An illegitimate user could upgrade firmware without...

Code injection

GE UR IED firmware versions prior to version 8.1x supports upgrading firmware using UR Setup configuration tool – Enervista UR Setup. This UR Setup tool validates the authenticity and integrity of firmware file before uploading the UR IED. An illegitimate user could upgrade firmware without...

The vulnerability of the WinSock driver of the Microsoft Windows operating system, which allows a hacker to increase their privileges

The vulnerability of the WinSock driver in the Microsoft Windows operating system is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to enhance their privileges...

Weak Deserializer

org.apache.dubbo:dubbo and com.alibaba:dubbo are using weak deserializers. An attacker is able to provoke the library to use a weak deserializer to be used by tampering with the byte preamble flags, not following the server's instruction...

The vulnerability of the Win32k component of the Windows operating system, which allows a hacker to increase their privileges

The vulnerability of the Win32k component of the Windows operating system is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to enhance their privileges...

Vulnerabilities fixed in APC UPS systems

Vulnerabilities have been fixed in Uninterruptible Power Supply UPS systems from APC. APC is part of Schneider Electric. These UPS systems are widely used in situations where up-time is very important. The vulnerabilities with reference CVE-2022-22805 and CVE-2022-22806 allow a remote malicious...

The vulnerability of the embedded software of NETGEAR routers such as EX6100v2, EX6150v2, EX6250, EX6400, EX6400v2, EX6410, EX6420, EX7300, EX7300v2, EX7320, EX7700, LBR1020, LBR20, RBK352, RBK50, RBR350, RBR50, RBS350 lies in the lack of protection for service data. This allows attackers to disclose the protected information.

The vulnerability of the embedded software of NETGEAR routers such as EX6100v2, EX6150v2, EX6250, EX6400, EX6400v2, EX6410, EX6420, EX7300, EX7300v2, EX7320, EX7700, LBR1020, LBR20, RBK352, RBK50, RBR350, RBR50, and RBS350 lies in the lack of protection for service data. Exploiting this...

Microsoft Azure 'AutoWarp' Bug Could Have Let Attackers Access Customers' Accounts

Details have been disclosed about a now-addressed critical vulnerability in Microsoft's Azure Automation service that could have permitted unauthorized access to other Azure customer accounts and take over control. "This attack could mean full control over resources and data belonging to the...

CVE-2021-36171

The use of a cryptographically weak pseudo-random number generator in the password reset feature of FortiPortal before 6.0.6 may allow a remote unauthenticated attacker to predict parts of or the whole newly generated password within a given time frame...

The vulnerability of the JEA (Just Enough Administration) security technology implementation in the hybrid cloud platform of Dell EMC Integrated System for Microsoft Azure Stack Hub allows a malicious individual to increase their privileges.

The vulnerability of the JEA Just Enough Administration security technology implemented on the Dell EMC Integrated System for Microsoft Azure Stack Hub hybrid cloud platform is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to increase their...

Fortinet FortiPortal 安全特征问题漏洞

Fortinet FortiPortal is an advanced, feature-rich managed security analysis and management support tool for Fortinet's FortiGate, FortiWiFi, and FortiAP product lines, available as a virtual machine for use by MSPs. versions, a security feature issue vulnerability exists that stems from the use o...

The vulnerability of the httpd daemon in the microprogramming software of TP-Link’s TL-WR940N router allows a intruder to gain unauthorized access to protected information.

The vulnerability of the httpd daemon in the microprogramming-based router software from TP-Link’s TL-WR940N is related to deficiencies in access control. Exploiting this vulnerability could allow a hacker to gain unauthorized access to protected information...

CVE-2021-25011

The Maps Plugin using Google Maps for WordPress plugin before 1.8.1 does not have proper authorisation and CSRF in most of its AJAX actions, which could allow any authenticated users, such as subscriber to delete arbitrary posts and update the plugin's settings...

Security Assessor – Job Description and How to Become

Introduction It requires a ton of work to turn into a QSA and keep your affirmation. In truth, there is an enormous rundown of standards to meet to be thought of. What is a Cyber security control assessor? The Security Control Assessor SCA is a cybersecurity personnel that utilizes security testi...