Archive
15 January 2021
Vulnerabilities first published on this day (UTC), newest first.
52 results · Feed
-
Unscored —
An issue was discovered in Malwarebytes before 4.0 on macOS. A malicious application was able to perform a privileged a…
-
Unscored —
Docker Desktop Community before 2.5.0.0 on macOS mishandles certificate checking, leading to local privilege escalation.
-
Critical 10.0
Pre-Auth Arbitrary File Upload
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, AttachmentUploadServlet also saves user controlled data (`request.getInputStream()`) to a user specified location (`request.getHeader("File-Name")`). This issue may lead to arbitrary fil…
-
High 8.6CVE-2021-21246 EPSS 49%
Pre-Auth Access token leak
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, the REST UserResource endpoint performs a security check to make sure that only administrators can list user details. However for the `/users/{id}` endpoint there are no security checks …
-
Critical 9.6
Post-Auth Unsafe Deserialization on BasePage (AJAX)
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, the application's BasePage registers an AJAX event listener (`AbstractPostAjaxBehavior`) in all pages other than the login page. This listener decodes and deserializes the `data` query p…
-
Critical 9.6
Post-Auth Unsafe Yaml deserialization
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is an issue involving YAML parsing which can lead to post-auth remote code execution. In order to parse and process YAML files, OneDev uses SnakeYaml which by default (when not usi…
-
Critical 9.6
Post-Auth Arbitrary Code execution via Groovy script injection
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability involving the build endpoint parameters. InputSpec is used to define parameters of a Build spec. It does so by using dynamically generated Groovy classe…
-
High 7.7
Post-Auth External Entity Expansion (XXE)
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability which may lead to arbitrary file read. When BuildSpec is provided in XML format, the spec is processed by XmlBuildSpecMigrator.migrate(buildSpecString);…
-
High 7.7CVE-2021-21251 EPSS 13%
ZipSlip Arbitrary File Upload
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3 there is a critical "zip slip" vulnerability. This issue may lead to arbitrary file write. The KubernetesResource REST endpoint untars user controlled data from the request body using Tar…
-
Critical 10.0CVE-2021-21242 EPSS 74%
Pre-Auth Unsafe Deserialization on AttachmentUploadServet
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability which can lead to pre-auth remote code execution. AttachmentUploadServlet deserializes untrusted data from the `Attachment-Support` header. This Servlet…
-
Critical 10.0CVE-2021-21243 EPSS 54%
Pre-Auth Unsafe Deserialization on KubernetesResource
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, a Kubernetes REST endpoint exposes two methods that deserialize untrusted data from the request body. These endpoints do not enforce any authentication or authorization checks. This issu…
-
Critical 10.0
Pre-Auth SSTI via Bean validation message tampering
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, There is a vulnerability that enabled pre-auth server side template injection via Bean validation message tampering. Full details in the reference GHSA. This issue was fixed in 4.0.3 by …
-
Unscored —
There is a vulnerability caused by insufficient input validation that allows for arbitrary command execution in a conta…
-
Unscored —
There is a vulnerability caused by unsafe Java deserialization that allows for arbitrary command execution in a contain…
-
Unscored —
Multiple authenticated remote command executions are possible in Airwave Glass before 1.3.3 via the glassadmin cli. The…
-
Unscored —
In Aruba AirWave Glass before 1.3.3, there is a Server-Side Request Forgery vulnerability through an unauthenticated en…
-
High 7.2
Git LFS can execute a Git binary from the current directory on Windows
Git LFS is a command line extension for managing large files with Git. On Windows, if Git LFS operates on a malicious repository with a git.bat or git.exe file in the current directory, that program would be executed, permitting the attacker to execute arbitr…
-
High 7.8
Junos OS: telnetd.real Local Privilege Escalation vulnerabilities in SUID binaries
A local privilege escalation vulnerability in telnetd.real of Juniper Networks Junos OS may allow a locally authenticated shell user to escalate privileges and execute arbitrary commands as root. telnetd.real is shipped with setuid permissions enabled and is …
-
High 7.4
Junos OS: Upon receipt of certain protocol packets with invalid payloads a self-propagating Denial of Service may occur.
A vulnerability in Juniper Networks Junos OS allows an attacker to cause a Denial of Service (DoS) to the device by sending certain crafted protocol packets from an adjacent device with invalid payloads to the device. These crafted packets, which should be di…
-
Medium 6.8
Junos Space: Shared secrets stored in recoverable format and directly exposed through the UI
The Junos Space Network Management Platform has been found to store shared secrets in a recoverable format that can be exposed through the UI. An attacker who is able to execute arbitrary code in the victim browser (for example via XSS) or access cached conte…
-
Medium 6.5
Junos OS: QFX Series: Traffic loop Denial of Service (DoS) upon receipt of specific IP multicast traffic
In an EVPN/VXLAN scenario, if an IRB interface with a virtual gateway address (VGA) is configured on a PE, a traffic loop may occur upon receipt of specific IP multicast traffic. The traffic loop will cause interface traffic to increase abnormally, ultimately…
-
Medium 6.7
Junos OS: Command injection vulnerability in 'request system software' CLI command
A command injection vulnerability in install package validation subsystem of Juniper Networks Junos OS that may allow a locally authenticated attacker with privileges to execute commands with root privilege. To validate a package in Junos before installation,…
-
High 7.8
Junos OS: Command injection vulnerability in license-check daemon
A command injection vulnerability in the license-check daemon of Juniper Networks Junos OS that may allow a locally authenticated attacker with low privileges to execute commands with root privilege. license-check is a daemon used to manage licenses in Junos …
-
High 7.4
Junos OS: EX Series and QFX Series: Memory leak issue processing specific DHCP packets
A vulnerability in processing of certain DHCP packets from adjacent clients on EX Series and QFX Series switches running Juniper Networks Junos OS with DHCP local/relay server configured may lead to exhaustion of DMA memory causing a Denial of Service (DoS). …
-
Medium 6.5
Junos OS: EX Series, QFX Series, SRX Branch Series, MX Series: Memory leak in packet forwarding engine due to 802.1X authenticator port interface flaps
On Juniper Networks Junos EX series, QFX Series, MX Series and SRX branch series devices, a memory leak occurs every time the 802.1X authenticator port interface flaps which can lead to other processes, such as the pfex process, responsible for packet forward…
-
Medium 5.0
Contrail Networking: Administrator credentials are exposed in a plaintext file
An Information Exposure vulnerability in Juniper Networks Contrail Networking allows a locally authenticated attacker able to read files to retrieve administrator credentials stored in plaintext thereby elevating their privileges over the system. This issue a…
-
Critical 10.0
Junos OS and Junos OS Evolved: Upon receipt of a specific BGP FlowSpec message network traffic may be disrupted.
An improper check for unusual or exceptional conditions in Juniper Networks Junos OS and Junos OS Evolved Routing Protocol Daemon (RPD) service allows an attacker to send a valid BGP FlowSpec message thereby causing an unexpected change in the route advertise…
-
Medium 6.5
Junos OS Evolved: Receipt of certain valid BGP update packets from BGP peers may cause RPD to core when using REGEX.
In Juniper Networks Junos OS Evolved an attacker sending certain valid BGP update packets may cause Junos OS Evolved to access an uninitialized pointer causing RPD to core leading to a Denial of Service (DoS). Continued receipt of these types of valid BGP upd…
-
Medium 6.8
Junos OS: Privilege escalation in J-Web due to arbitrary command and code execution via information disclosure from another users active session
An Information Exposure vulnerability in J-Web of Juniper Networks Junos OS allows an unauthenticated attacker to elevate their privileges over the target system through opportunistic use of an authenticated users session. This issue affects: Juniper Networks…
-
High 8.8
Junos OS and Junos OS Evolved: In bidirectional LSP configurations, on MPLS egress router RPD may core upon receipt of specific malformed RSVP packet.
An improper input validation vulnerability in the Routing Protocol Daemon (RPD) service of Juniper Networks Junos OS allows an attacker to send a malformed RSVP packet when bidirectional LSPs are in use, which when received by an egress router crashes the RPD…
-
High 7.5
NFX250, NFX350, QFX5K Series, EX2300 Series, EX3400 Series, EX4300 Multigigabit, EX4600 Series: Certain genuine traffic received by the Junos OS device will be discarded instead of forwarded.
An improper interpretation conflict of certain data between certain software components within the Juniper Networks Junos OS devices does not allow certain traffic to pass through the device upon receipt from an ingress interface filtering certain specific ty…
-
High 7.5
Junos OS: NFX Series, SRX Series: PFE may crash upon receipt of specific packet when SSL Proxy is configured.
A NULL Pointer Dereference vulnerability in Juniper Networks Junos OS allows an attacker to send a specific packet causing the packet forwarding engine (PFE) to crash and restart, resulting in a Denial of Service (DoS). By continuously sending these specific …
-
Medium 5.8
Junos OS: MX Series: Dynamic filter fails to match IPv6 prefix
When the "Intrusion Detection Service" (IDS) feature is configured on Juniper Networks MX series with a dynamic firewall filter using IPv6 source or destination prefix, it may incorrectly match the prefix as /32, causing the filter to block unexpected traffic…
-
High 8.6
Junos OS: EX and QFX5K Series: Storm Control does not work as expected when Redundant Trunk Group is configured
On Juniper Networks EX and QFX5K Series platforms configured with Redundant Trunk Group (RTG), Storm Control profile applied on the RTG interface might not take affect when it reaches the threshold condition. Storm Control enables the device to monitor traffi…
-
High 7.8
Junos OS: dexp Local Privilege Escalation vulnerabilities in SUID binaries
A sensitive information disclosure vulnerability in delta-export configuration utility (dexp) of Juniper Networks Junos OS may allow a locally authenticated shell user the ability to create and read database files generated by the dexp utility, including pass…
-
High 7.5
Junos OS: MX Series, EX9200 Series: Trio-based MPC memory leak when Integrated Routing and Bridging (IRB) interface is mapped to a VPLS instance or a Bridge-Domain
On Juniper Networks MX Series and EX9200 Series platforms with Trio-based MPC (Modular Port Concentrator) where Integrated Routing and Bridging (IRB) interface is configured and it is mapped to a VPLS instance or a Bridge-Domain, certain network events at Cus…
-
Unscored —
-
Unscored —
Directory traversal vulnerability in class-simple_job_board_resume_download_handler.php in the Simple Board Job plugin …
-
Unscored —
Cross-site scripting (XSS) vulnerability in models/list-table.php in the FV Flowplayer Video Player plugin before 7.4.3…
-
Medium 4.3
An issue has been discovered in GitLab affecting all versions starting from 12.4. The regex used for package names is w…