Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-3331PUBLISHED: 2021-01-27WinSCP before 5.17.10 allows remote attackers to execute arbitrary programs when the URL handler encounters a crafted URL that loads session settings. (For example, this is exploitable in a default installation in which WinSCP is the handler for sftp:// URLs.)
CVE-2021-3326PUBLISHED: 2021-01-27The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service.
CVE-2021-22641PUBLISHED: 2021-01-27A heap-based buffer overflow issue has been identified in the way the application processes project files, allowing an attacker to craft a special project file that may allow arbitrary code execution on the Tellus Lite V-Simulator and V-Server Lite (versions prior to 4.0.10.0).
CVE-2021-22653PUBLISHED: 2021-01-27Multiple out-of-bounds write issues have been identified in the way the application processes project files, allowing an attacker to craft a special project file that may allow arbitrary code execution on the Tellus Lite V-Simulator and V-Server Lite (versions prior to 4.0.10.0).
CVE-2021-22655PUBLISHED: 2021-01-27Multiple out-of-bounds read issues have been identified in the way the application processes project files, allowing an attacker to craft a special project file that may allow arbitrary code execution on the Tellus Lite V-Simulator and V-Server Lite (versions prior to 4.0.10.0).
User Rank: Apprentice
6/29/2015 | 3:55:49 AM
We need to move to automation where evidence is gathered automatiacally and once for every aspect we need to report on, so we are not manually taking screenshots for PCI, SOX, HIPPA etc. Setup once, gather as needed and report non compliance for investigation, that way you will be as close to full compliance most of the time.
Compliance does not equal security