Vulnerabilities

A vulnerability has been identified in SINEC NMS (All versions), User Management Component (UMC) (All versions

A vulnerability has been identified in SINEC NMS (All versions

Observable Timing Discrepancy vulnerability in Apache Shiro.<br /> <br /> This issue affects Apache Shiro: from 1.*, 2.* before 2.0.7.<br /> <br /> Users are recommended to upgrade to version 2.0.7 or later, which fixes the issue.<br /> <br /> Prior to Shiro 2.0.7, code paths for non-existent vs. existing users are different enough,<br /> that a brute-force attack may be able to tell, by timing the requests only, determine if<br /> the request failed because of a non-existent user vs. wrong password.<br /> <br /> The most likely attack vector is a local attack only.<br /> Shiro security model  https://shiro.apache.org/security-model.html#username_enumeration  discusses this as well.<br /> <br /> Typically, brute force attack can be mitigated at the infrastructure level.

Affected Products and Versions<br /> * Apache Druid<br /> * Affected Versions: 0.17.0 through 35.x (all versions prior to 36.0.0)<br /> * Prerequisites: * druid-basic-security extension enabled<br /> * LDAP authenticator configured<br /> * Underlying LDAP server permits anonymous bind                                                                                                                                                   <br /> <br /> <br /> <br /> <br /> <br /> <br /> Vulnerability Description<br /> <br /> An authentication bypass vulnerability exists in Apache Druid when using the druid-basic-security extension with LDAP authentication. If the underlying LDAP server is configured to allow anonymous<br /> binds, an attacker can bypass authentication by providing an existing username with an empty password. This allows unauthorized access to otherwise restricted Druid resources without valid credentials.<br /> <br /> The vulnerability stems from improper validation of LDAP authentication responses when anonymous binds are permitted, effectively treating anonymous bind success as valid user authentication. <br /> <br /> Impact<br /> <br /> A remote, unauthenticated attacker can:<br /> * Gain unauthorized access to the Apache Druid cluster<br /> * Access sensitive data stored in Druid datasources<br /> * Execute queries and potentially manipulate data<br /> * Access administrative interfaces if the bypassed account has elevated privileges<br /> * Completely compromise the confidentiality, integrity, and availability of the Druid deployment                                                                                                                                                                                    <br /> <br /> <br /> Mitigation<br />  <br /> Immediate Mitigation (No Druid Upgrade Required):                                                                                                                                                   <br /> * Disable anonymous bind on your LDAP server. This prevents the vulnerability from being exploitable and is the recommended immediate action.<br /> <br /> <br /> <br /> Resolution<br /> * Upgrade Apache Druid to version 36.0.0 or later, which includes fixes to properly reject anonymous LDAP bind attempts.

Improper Neutralization of Data within XPath Expressions (&amp;#39;XPath Injection&amp;#39;) vulnerability in Apache HertzBeat.<br /> <br /> This issue affects Apache HertzBeat: from 1.7.1 before 1.8.0.<br /> <br /> Users are recommended to upgrade to version 1.8.0, which fixes the issue.

A vulnerability has been identified in Simcenter Femap (All versions

A vulnerability has been identified in NX (All versions

A vulnerability has been identified in Simcenter Femap (All versions

A vulnerability has been identified in Simcenter Femap (All versions

A vulnerability has been identified in Simcenter Femap (All versions

A vulnerability has been identified in Simcenter Femap (All versions

A vulnerability has been identified in Simcenter Femap (All versions