EILMELDUNGEN LIVE News-Tinder DECK
GLOBAL9.3CVE-2026-18836 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended destinations and return the response to the attacker.(07.11.2026 um 04:34 Uhr)
•
GLOBAL9.9CVE-2026-17410 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.(07.11.2026 um 04:34 Uhr)
•
GLOBAL9.4CVE-2026-17409 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls are not applied consistently to all variations of a request, which could allow restricted operations to be reached.(07.11.2026 um 04:34 Uhr)
•
GLOBAL9.8CVE-2026-17408 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements in an OS command.(07.11.2026 um 04:34 Uhr)
•
GLOBAL8.5CVE-2026-17407 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before being used in a database query, which could allow SQL commands to run.(07.11.2026 um 04:34 Uhr)
•
GLOBAL8.5CVE-2026-17406 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Address checks can be bypassed, which could allow the server to reach destinations that should be blocked.(07.11.2026 um 04:34 Uhr)
•
GLOBAL8.8CVE-2026-17405 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. Access checks on keystore objects do not confirm that the requesting user is permitted to read them, which could expose keystore information.(07.11.2026 um 04:34 Uhr)
•
GLOBAL8.5CVE-2026-17404 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.(07.11.2026 um 04:34 Uhr)
•
GLOBAL9.0CVE-2026-17403 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.(07.11.2026 um 04:34 Uhr)
•
GLOBAL9.9CVE-2026-17402 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. User-supplied input is not properly neutralized before it is passed to the operating system, which could allow commands to run on the underlying host.(07.11.2026 um 04:34 Uhr)
•
Sicherheitslücken (CVE)CVE-2023-4338 | Broadcom RAID Controller Web Interface Remote Code Execution(11.11.2026 um 05:53 Uhr)
•
Sicherheitslücken (CVE)CVE-2026-118297 | Microsoft 365 Apps for Enterprise buffer overflow (Nessus ID 378498)(11.11.2026 um 06:12 Uhr)
•
Sicherheitslücken (CVE)CVE-2026-118298 | Microsoft Office heap-based overflow (Nessus ID 378498)(11.11.2026 um 06:12 Uhr)
•
YouTube Security VideosTesla: Bringing Megapack Online Faster(11.11.2026 um 04:45 Uhr)
•
Windows Tipps & SecurityGoogle verschärft die Anforderungen für Android Auto – diese Smartphones werden nicht mehr unterstützt(10.11.2026 um 14:57 Uhr)
•
Sicherheitslücken (CVE)CVE-2026-118299 | Microsoft Excel heap-based overflow (Nessus ID 378498)(11.11.2026 um 06:12 Uhr)
•
Sicherheitslücken (CVE)CVE-2026-118302 | Microsoft Office heap-based overflow (Nessus ID 378498)(11.11.2026 um 06:12 Uhr)
•
Sicherheitslücken (CVE)CVE-2023-4339 | Broadcom RAID Controller Web Interface permission(11.11.2026 um 05:53 Uhr)
•
Sicherheitslücken (CVE)CVE-2023-3160 | ESET NOD32 Antivirus File permission(11.11.2026 um 05:53 Uhr)
•
Sicherheitslücken (CVE)CVE-2023-2110 | Obsidian Desktop up to 1.2.7 App Scheme path traversal(11.11.2026 um 05:53 Uhr)
•
GLOBAL9.3CVE-2026-18836 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended destinations and return the response to the attacker.(07.11.2026 um 04:34 Uhr)
•
GLOBAL9.9CVE-2026-17410 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.(07.11.2026 um 04:34 Uhr)
•
GLOBAL9.4CVE-2026-17409 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls are not applied consistently to all variations of a request, which could allow restricted operations to be reached.(07.11.2026 um 04:34 Uhr)
•
GLOBAL9.8CVE-2026-17408 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements in an OS command.(07.11.2026 um 04:34 Uhr)
•
GLOBAL8.5CVE-2026-17407 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before being used in a database query, which could allow SQL commands to run.(07.11.2026 um 04:34 Uhr)
•
GLOBAL8.5CVE-2026-17406 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Address checks can be bypassed, which could allow the server to reach destinations that should be blocked.(07.11.2026 um 04:34 Uhr)
•
GLOBAL8.8CVE-2026-17405 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. Access checks on keystore objects do not confirm that the requesting user is permitted to read them, which could expose keystore information.(07.11.2026 um 04:34 Uhr)
•
GLOBAL8.5CVE-2026-17404 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.(07.11.2026 um 04:34 Uhr)
•
GLOBAL9.0CVE-2026-17403 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.(07.11.2026 um 04:34 Uhr)
•
GLOBAL9.9CVE-2026-17402 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. User-supplied input is not properly neutralized before it is passed to the operating system, which could allow commands to run on the underlying host.(07.11.2026 um 04:34 Uhr)
•
Sicherheitslücken (CVE)CVE-2023-4338 | Broadcom RAID Controller Web Interface Remote Code Execution(11.11.2026 um 05:53 Uhr)
•
Sicherheitslücken (CVE)CVE-2026-118297 | Microsoft 365 Apps for Enterprise buffer overflow (Nessus ID 378498)(11.11.2026 um 06:12 Uhr)
•
Sicherheitslücken (CVE)CVE-2026-118298 | Microsoft Office heap-based overflow (Nessus ID 378498)(11.11.2026 um 06:12 Uhr)
•
YouTube Security VideosTesla: Bringing Megapack Online Faster(11.11.2026 um 04:45 Uhr)
•
Windows Tipps & SecurityGoogle verschärft die Anforderungen für Android Auto – diese Smartphones werden nicht mehr unterstützt(10.11.2026 um 14:57 Uhr)
•
Sicherheitslücken (CVE)CVE-2026-118299 | Microsoft Excel heap-based overflow (Nessus ID 378498)(11.11.2026 um 06:12 Uhr)
•
Sicherheitslücken (CVE)CVE-2026-118302 | Microsoft Office heap-based overflow (Nessus ID 378498)(11.11.2026 um 06:12 Uhr)
•
Sicherheitslücken (CVE)CVE-2023-4339 | Broadcom RAID Controller Web Interface permission(11.11.2026 um 05:53 Uhr)
•
Sicherheitslücken (CVE)CVE-2023-3160 | ESET NOD32 Antivirus File permission(11.11.2026 um 05:53 Uhr)
•
Sicherheitslücken (CVE)CVE-2023-2110 | Obsidian Desktop up to 1.2.7 App Scheme path traversal(11.11.2026 um 05:53 Uhr)
•
Intelligence View
⚡ tsecurity.de Intelligence

Barracuda ESG Authentication Bypass Flaw Opens Path to Root

An authentication bypass and a command injection flaw can be chained for root access on Barracuda’s Email Security Gateway appliances. The post Barracuda ESG A…

IT Security Nachrichten SecurityWeek 1 Min. Lesezeit TA0001 · T1190
Beitrag
0
Seite
0
↗ Quelle (SecurityWeek)
Social ReaktionenReagiere als Erste:r — dein Feedback zählt!

An authentication bypass and a command injection flaw can be chained for root access on Barracuda’s Email Security Gateway appliances. The post Barracuda ESG Authentication Bypass Flaw Opens Path to Root appeared first on SecurityWeek. Weiterlesen: Barracuda ESG Authentication Bypass Flaw Opens Path to Root

🔍 CTI & Forensik

Cyber Threat Intelligence & Forensik

ATT&CK-Navigator · IoC-Radar · Exploit-Belege
MITRE ATT&CK Matrix Navigator
1 belegte Technik
T1190TA0001 · Initial Access
Exploit Public-Facing Application
Mitigation: M1042 Network Segmentation & WAF Rule Enforcement
Quelle: Kontext-Klassifikation des Artikeltextes · Konfidenz 86%
Öffentlich erreichbare Dienste mit OpenVAS scannen, WAF-Regeln schärfen, Patch-Fenster verkürzen.
OpenVAS (GVM)ModSecurityNuclei
Initial Access
CTI Threat Relationship Graph
Akteure · Techniken · Beziehungen
3 Knoten · 2 Relationen
CVE / Incident Threat Actor Software MITRE ATT&CK CWE Weakness IoC
Powered by tsecurity.de tsecurity.de Hub
🚀 Auf tsecurity.de entdecken
Intelligence Digest — kostenlos Täglich die wichtigsten Security-News · jederzeit abbestellbar
Community Rating & Social Proof
⭐ Leser-Wertung
–
Ø / 5.0
Noch keine Leser-Bewertungen
War diese Seite hilfreich?
0
Jetzt Bewertung abgeben
🟢 Niedrig (1-3.9) 🟡 Mittel (4.0-6.9) 🔴 Hoch (7.0-8.9) Kritisch (9.0-10.0)
Powered by tsecurity.de tsecurity.de Hub
🚀 Auf tsecurity.de entdecken

Verwandte Story-Cluster & Quellen (Vektor-KI)

30 Quellen
CVE-2026-116928 | Microsoft Windows up to Server 2025 Search out-of-bounds write (Nessus ID 378500)
29 weitere Quellen
VulDB Updatesvor 2 Std.CVE-2026-85844 | Microsoft Windows up to Server 2025 Kerberos improper authorization (Nessus ID 378500) VulDB Updatesvor 2 Std.CVE-2026-119958 | Microsoft Windows up to Server 2025 LDAP out-of-bounds write (Nessus ID 378500) VulDB Updatesvor 2 Std.CVE-2026-112967 | Microsoft Windows up to 11 26H2 buffer overflow (Nessus ID 378499) VulDB Updatesvor 2 Std.CVE-2026-116927 | Microsoft Office/Office Online Server Excel heap-based overflow (Nessus ID 378498) Windows Latestvor 6 Std.Windows 11 is now force-enabling Memory Integrity, a feature Microsoft admitted can hurt gaming performance, and here’s how to turn it off Google Alertvor 6 Std.Patchday: Windows Server-Updates (10. November 2026) - BornCity
+23
9 Quellen
CVE-2026-126567 | Semantic MediaWiki up to 7.4.0 ElasticStore native_result/score_set cross site scripting (EUVD-2026-123082)
8 weitere Quellen
VulDB Updatesvor 2 Std.CVE-2026-126566 | Semantic MediaWiki up to 7.4.0 EditProtectionUpdater userMayChangeProtection improper authorization (EUVD-2026-123081) VulDB Updatesvor 2 Std.CVE-2026-126565 | Semantic MediaWiki up to 7.4.0 ElasticStore api.php ConceptDescriptionInterpreter denial of service (EUVD-2026-123080) VulDB Updatesvor 2 Std.CVE-2026-126564 | Semantic MediaWiki 2.5.0/7.4.0 ValueFormatter getFormattedSubject cross site scripting (EUVD-2026-123079) VulDB Updatesvor 2 Std.CVE-2026-126563 | Semantic MediaWiki up to 7.4.0 TimeValueFormatter getCaptionFromFreeFormat cross site scripting (EUVD-2026-123078) VulDB Updatesvor 2 Std.CVE-2026-126561 | SemanticMediaWiki Semantic MediaWiki up to 7.4.0 TitleQuickPermissions Hook improper authorization (EUVD-2026-123076) VulDB Updatesvor 2 Std.CVE-2026-126562 | Semantic MediaWiki up to 7.4.0 ElasticStore ConceptDescriptionInterpreter api.php recursion (EUVD-2026-123077)
+2

Mehr aus dieser Kategorie

The Third Cloud Breaks Your Peering Model: Transitive Routing and the Hub Decision
11.11.2026
Android Security Patch Levels Explained: Check Your Phone’s Protection
10.11.2026
New GhostFrame Malware Lets Hackers Hijack VMware ESXi VMs and Steal Windows Credentials
11.11.2026
IT Security News Hourly Summary 2026-11-11 06h : 4 posts
11.11.2026
Blättern: Pfeiltasten [ ← ] [ → ] · Tasten j / k · mobil: Wischen
Zum Aktualisieren ziehen
TTS Reader • tsecurity.de Voice
Nächster Beitrag