Month: septiembre 2023

A vulnerability in the classic access control list (ACL) compression feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass the protection that is offered by a configured ACL on an affected device. This vulnerability is due to incorrect destination address range encoding in the compression module of an ACL that is applied to an interface of an affected device. An attacker could exploit this vulnerability by sending traffic through the affected device that More info: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-comp3acl-vGmp6BQ3?vs_f=Cisco%20Security%20Advisory&vs_cat=Security%20Intelligence&vs_type=RSS&vs_p=Cisco%20IOS%20XR%20Software%20Compression%20ACL%20Bypass%20Vulnerability&vs_k=1

Today’s volatile threat landscape has made every organization focused on staying a step ahead of attackers. According to Frost & Sullivan’s new Extended Detection and Response (XDR) 2023 report, VMware Carbon Black is more than helping enterprises keep ahead: we’re pushing the industry forward. In the latest Frost Radar Report, VMware Carbon Black emerges as … ContinuedThe post VMware Carbon Black Emerges as a Leader in Frost & Sullivan’s 2023 XDR Report More info: https://blogs.vmware.com/security/2023/09/vmware-carbon-black-emerges-as-a-leader-in-frost-sullivans-2023-xdr-report.html?utm_source=rss&utm_medium=rss&utm_campaign=vmware-carbon-black-emerges-as-a-leader-in-frost-sullivans-2023-xdr-report

Security Advisory Description CVE-2022-44611 Improper input validation in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege ... More info: https://my.f5.com/manage/s/article/K000136168?utm_source=f5support&utm_medium=RSS

Security Advisory Description sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters (CVE-2022-4254) Impact Low privileged malicious user could exploit the vulnerability to ... More info: https://my.f5.com/manage/s/article/K000136157?utm_source=f5support&utm_medium=RSS

Security Advisory Description A cleartext transmission of sensitive information vulnerability exists in curl. (CVE-2023-23914) Impact There is no impact; F5 products are not affected by this ... More info: https://my.f5.com/manage/s/article/K000136153?utm_source=f5support&utm_medium=RSS

Security Advisory Description This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available. Learn more about the ... More info: https://my.f5.com/manage/s/article/K000136109?utm_source=f5support&utm_medium=RSS

A vulnerability in the web-based management interface of Cisco HyperFlex HX Data Platform could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of the parameters in an HTTP request. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to redirect a user to a malicious website. Cisco has released software updates that More info: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hyperflex-redirect-UxLgqdUF?vs_f=Cisco%20Security%20Advisory&vs_cat=Security%20Intelligence&vs_type=RSS&vs_p=Cisco%20HyperFlex%20HX%20Data%20Platform%20Open%20Redirect%20Vulnerability&vs_k=1

Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to perform privilege escalation attacks to read or modify arbitrary files on the underlying operating system. To exploit these vulnerabilities, an attacker must have valid Administrator-level privileges on the affected device. For more information about these vulnerabilities, see the Details section of this advisory. Cisco has released software updates that address one of these More info: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-priv-esc-KJLp2Aw?vs_f=Cisco%20Security%20Advisory&vs_cat=Security%20Intelligence&vs_type=RSS&vs_p=Cisco%20Identity%20Services%20Engine%20Privilege%20Escalation%20Vulnerabilities&vs_k=1

A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or an authenticated, remote attacker to establish a clientless SSL VPN session with an unauthorized user. This vulnerability is due to improper separation of authentication, authorization, and More info: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ravpn-auth-8LyfCkeC?vs_f=Cisco%20Security%20Advisory&vs_cat=Security%20Intelligence&vs_type=RSS&vs_p=Cisco%20Adaptive%20Security%20Appliance%20Software%20and%20Firepower%20Threat%20Defense%20Software%20Remote%20Access%20VPN%20Unauthorized%20Access%20Vulnerability&vs_k=1

A vulnerability in the RADIUS message processing feature of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause the affected system to stop processing RADIUS packets. This vulnerability is due to improper handling of certain RADIUS accounting requests. An attacker could exploit this vulnerability by sending a crafted authentication request to a network access device (NAD) that uses Cisco ISE for authentication, authorization, and accounting (AAA). This More info: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-radius-dos-W7cNn7gt?vs_f=Cisco%20Security%20Advisory&vs_cat=Security%20Intelligence&vs_type=RSS&vs_p=Cisco%20Identity%20Services%20Engine%20RADIUS%20Denial%20of%20Service%20Vulnerability&vs_k=1