6 Tips for Limiting Damage from Third-Party Attacks

Enterprise VulnerabilitiesFrom DHS/US-CERT's National Vulnerability Database CVE-2020-1946PUBLISHED: 2021-03-25

In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA version 3.4.5, users should only use update channels or 3r...

CVE-2021-29156PUBLISHED: 2021-03-25

ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol. For example, an unauthenticated attacker can perform character-by-character retrieval of password hashes, or retrieve a session token or a private key.

CVE-2021-26715PUBLISHED: 2021-03-25

The OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Server Side Request Forgery (SSRF) vulnerability. The vulnerability arises due to unsafe usage of the logo_uri parameter in the Dynamic Client Registration request. An unauthenticated attacker can make a HTTP reque...

CVE-2021-20679PUBLISHED: 2021-03-25

Fuji Xerox multifunction devices and printers (DocuCentre-VII C7773/C6673/C5573/C4473/C3373/C3372/C2273, DocuCentre-VII C7788/C6688/C5588, ApeosPort-VII C7773/C6673/C5573/C4473/C3373/C3372 C2273, ApeosPort-VII C7788/C6688/C5588, ApeosPort C7070/C6570/C5570/C4570/C3570/C3070/C7070G/C6570G/C5570G/C457...

CVE-2020-7852PUBLISHED: 2021-03-24

DaviewIndy has a Heap-based overflow vulnerability, triggered when the user opens a malformed ex. ..

Support the originator by clicking the read the rest link below.