Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-21394PUBLISHED: 2021-04-12
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party identif...
CVE-2021-22497PUBLISHED: 2021-04-12Advanced Authentication versions prior to 6.3 SP4 have a potential broken authentication due to improper session management issue.
CVE-2021-3163PUBLISHED: 2021-04-12A vulnerability in the HTML editor of Slab Quill 4.8.0 allows an attacker to execute arbitrary JavaScript by storing an XSS payload (a crafted onloadstart attribute of an IMG element) in a text field.
CVE-2019-15059PUBLISHED: 2021-04-12In Liberty lisPBX 2.0-4, configuration backup files can be retrieved remotely from /backup/lispbx-CONF-YYYY-MM-DD.tar or /backup/lispbx-CDR-YYYY-MM-DD.tar without authentication or authorization. These configuration files have all PBX information including extension numbers, contacts, and passwords.
CVE-2021-21524PUBLISHED: 2021-04-12
Dell SRM versions prior to 4.5.0.1 and Dell SMR versions prior to 4.5.0.1 contain an Untrusted Deserialization Vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability, leading to arbitrary privileged code execution on the vulnerable application. The severity is Cr...
0 Comments
Tweet This
User Rank: Ninja
6/9/2017 | 3:28:33 PM
Condolences, though, on your role as an investigator. It seems it must be hard being an investigator in software security if you are not the one defining who you take down. Like law enforcement, the judicial system, and financial industries, there are countless gray areas in InfoSec. How do you know who to arrest, who to prosecute, and who is better to let go in favor of bigger fish.
Cyber criminals come in all shapes and sizes, too. Some can be tracked and taken down with little resistance while others are part of a larger "army" who can be unforgiving once they know you have them in your sights.
But kudos again for giving back, and digging under the casing. With a focus on code, perhaps you'll be in better shape than as an investigator. Don't get me wrong, boy do we need InfoSec investigative work. But I don't envy those who do it.
Nice to see a personal story once in a while here on DR.