USN-5089-1 ca-certificates update

The ca-certificates package contained a CA certificate that will expire on 2021-09-30 and will cause connectivity issues. This update removes the “DST Root CA X3” CA...

CVE-2021-3616

A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow an unauthorized user to view device information, alter firmware content and device configuration. This vulnerability is the same as CNVD-2020-68651...

CVE-2021-3617

A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow command injection by setting a specially crafted network configuration. This vulnerability is the same as CNVD-2020-68652...

CVE-2021-3617

CVE-2021-3617 affects Lenovo Smart Camera X3, X5 and C2E. The connected documents describe a command-injection vulnerability triggered by setting a specially crafted network configuration, with roots traced to CNVD-2020-68652. The available sources reiterate the affected devices and the general i...

Lenovo Smart Camera 安全漏洞

Lenovo Smart Camera is a Lenovo Smart Home device from China's Lenovo Lenovo. A security vulnerability exists in the Lenovo Smart Camera X3, X5, and C2E that could allow unauthorized users to view device information, change firmware content, and device configuration...

Lenovo Smart Camera 命令注入漏洞

Lenovo Smart Camera is a Lenovo smart home device from the Chinese company Lenovo. A security vulnerability exists in the Lenovo Smart Camera X3, X5, and C2E, which stems from the ability to allow command injection by setting a specially crafted network configuration...

Lenovo Smart Camera 代码注入漏洞

Lenovo Smart Camera is a Lenovo smart home device from China's Lenovo Lenovo. A security vulnerability exists in the Lenovo Smart Camera X3, X5, and C2E that could allow code execution...

Metasploit Wrap-Up

Now I Control Your Resource Planning Servers Sage X3 is a resource planning product designed by Sage Group which is designed to help established businesses plan out their business operations. But what if you wanted to do more than just manage resources? What if you wanted to hijack the resource...

CVE-2020-7390

Sage X3 Stored XSS Vulnerability on ‘Edit’ Page of User Profile. An authenticated user can pass XSS strings the "First Name," "Last Name," and "Email Address" fields of this web application component. Updates are available for on-premises versions of Version 12 components shipped with Syracuse...

CVE-2020-7389

Sage X3 System CHAINE Variable Script Command Injection. An authenticated user with developer access can pass OS commands via this variable used by the web application. Note, this developer configuration should not be deployed in production...

CVE-2020-7389

Sage X3 System CHAINE Variable Script Command Injection. An authenticated user with developer access can pass OS commands via this variable used by the web application. Note, this developer configuration should not be deployed in production...

CVE-2020-7387

Sage X3 Installation Pathname Disclosure. A specially crafted packet can elicit a response from the AdxDSrv.exe component that reveals the installation directory of the product. Note that this vulnerability can be combined with CVE-2020-7388 to achieve full RCE. This issue was fixed in AdxAdmin...

CVE-2020-7387

Sage X3 Installation Pathname Disclosure. A specially crafted packet can elicit a response from the AdxDSrv.exe component that reveals the installation directory of the product. Note that this vulnerability can be combined with CVE-2020-7388 to achieve full RCE. This issue was fixed in AdxAdmin...

CVE-2020-7388

Sage X3 Unauthenticated Remote Command Execution RCE as SYSTEM in AdxDSrv.exe component. By editing the client side authentication request, an attacker can bypass credential validation. While exploiting this does require knowledge of the installation path, that information can be learned by...

CVE-2020-7388

Sage X3 Unauthenticated Remote Command Execution RCE as SYSTEM in AdxDSrv.exe component. By editing the client side authentication request, an attacker can bypass credential validation. While exploiting this does require knowledge of the installation path, that information can be learned by...

Command injection

Sage X3 System CHAINE Variable Script Command Injection. An authenticated user with developer access can pass OS commands via this variable used by the web application. Note, this developer configuration should not be deployed in production...

Cross site scripting

Sage X3 Stored XSS Vulnerability on ‘Edit’ Page of User Profile. An authenticated user can pass XSS strings the "First Name," "Last Name," and "Email Address" fields of this web application component. Updates are available for on-premises versions of Version 12 components shipped with Syracuse...

Design/Logic Flaw

Sage X3 Installation Pathname Disclosure. A specially crafted packet can elicit a response from the AdxDSrv.exe component that reveals the installation directory of the product. Note that this vulnerability can be combined with CVE-2020-7388 to achieve full RCE. This issue was fixed in AdxAdmin...

CVE-2020-7390 Sage X3 Syracuse Persistent XSS in Edit User page

Sage X3 Stored XSS Vulnerability on ‘Edit’ Page of User Profile. An authenticated user can pass XSS strings the "First Name," "Last Name," and "Email Address" fields of this web application component. Updates are available for on-premises versions of Version 12 components shipped with Syracuse...

CVE-2020-7390

Sage X3 Syracuse on-premises version 12 (components shipped with Syracuse 12.10.0 and later) is affected by CVE-2020-7390, a Stored XSS on the Edit User Profile page. An authenticated user can inject XSS strings via the First Name, Last Name, or Email Address fields. Remediation: updates are avai...