Lucene search

K

BD Pyxis™ MedStation™ ES Server Security Vulnerabilities

nvd
nvd

CVE-2024-29954

A vulnerability in a password management API in Brocade Fabric OS versions before v9.2.1, v9.2.0b, v9.1.1d, and v8.2.3e prints sensitive information in log files. This could allow an authenticated user to view the server passwords for protocols such as scp and sftp. Detail. When the...

5.9CVSS

EPSS

2024-06-26 12:15 AM
2
cve
cve

CVE-2024-29954

A vulnerability in a password management API in Brocade Fabric OS versions before v9.2.1, v9.2.0b, v9.1.1d, and v8.2.3e prints sensitive information in log files. This could allow an authenticated user to view the server passwords for protocols such as scp and sftp. Detail. When the...

5.9CVSS

5.7AI Score

EPSS

2024-06-26 12:15 AM
22
ibm
ibm

Security Bulletin: IBM HTTP Server (powered by Apache) for IBM i is vulnerable to a denial of service attack using HTTP/2 protocol. [CVE-2024-27316]

Summary IBM HTTP Server (powered by Apache) used by IBM i is vulnerable to a denial of service attack due to no limit of continuation fames in HTTP/2 protocol as described in the vulnerability details section. This bulletin identifies the steps to take to address the vulnerability as described in.....

7.5CVSS

7.1AI Score

0.005EPSS

2024-06-25 11:52 PM
2
cvelist
cvelist

CVE-2024-29954 password management API prints sensitive information in log files

A vulnerability in a password management API in Brocade Fabric OS versions before v9.2.1, v9.2.0b, v9.1.1d, and v8.2.3e prints sensitive information in log files. This could allow an authenticated user to view the server passwords for protocols such as scp and sftp. Detail. When the...

5.9CVSS

EPSS

2024-06-25 11:42 PM
3
ibm
ibm

Security Bulletin: IBM Virtualization Engine TS7700 is susceptible to multiple vulnerabilities in WebSphere Application Server Liberty

Summary IBM Virtualization Engine TS7700 is vulnerable to two potential denial of service conditions (CVE-2023-44487, CVE-2024-25026) and two instances of weaker than expected security (CVE-2023-50312, CVE-2023-46158) due to WebSphere Application Server Liberty. WebSphere Application Server...

9.8CVSS

7.8AI Score

0.732EPSS

2024-06-25 10:19 PM
2
nvd
nvd

CVE-2024-30931

Stored Cross Site Scripting vulnerability in Emby Media Server Emby Media Server 4.8.3.0 allows a remote attacker to escalate privileges via the notifications.html...

EPSS

2024-06-25 10:15 PM
2
cve
cve

CVE-2024-30931

Stored Cross Site Scripting vulnerability in Emby Media Server Emby Media Server 4.8.3.0 allows a remote attacker to escalate privileges via the notifications.html...

6.3AI Score

EPSS

2024-06-25 10:15 PM
2
nvd
nvd

CVE-2024-5016

In WhatsUp Gold versions released before 2023.1.3, Distributed Edition installations can be exploited by using a deserialization tool to achieve a Remote Code Execution as SYSTEM. The vulnerability exists in the main message processing routines NmDistributed.DistributedServiceBehavior.OnMessage...

7.2CVSS

EPSS

2024-06-25 09:16 PM
3
cve
cve

CVE-2024-5016

In WhatsUp Gold versions released before 2023.1.3, Distributed Edition installations can be exploited by using a deserialization tool to achieve a Remote Code Execution as SYSTEM. The vulnerability exists in the main message processing routines NmDistributed.DistributedServiceBehavior.OnMessage...

7.2CVSS

7.2AI Score

EPSS

2024-06-25 09:16 PM
2
cve
cve

CVE-2024-5014

In WhatsUp Gold versions released before 2023.1.3, a Server Side Request Forgery vulnerability exists in the GetASPReport feature. This allows any authenticated user to retrieve ASP reports from an HTML...

7.1CVSS

6.8AI Score

EPSS

2024-06-25 09:16 PM
2
nvd
nvd

CVE-2024-5014

In WhatsUp Gold versions released before 2023.1.3, a Server Side Request Forgery vulnerability exists in the GetASPReport feature. This allows any authenticated user to retrieve ASP reports from an HTML...

7.1CVSS

EPSS

2024-06-25 09:16 PM
1
cvelist
cvelist

CVE-2024-5016 WhatsUp Gold OnMessage Deserialization of Untrusted Data Remote Code Execution Vulnerability

In WhatsUp Gold versions released before 2023.1.3, Distributed Edition installations can be exploited by using a deserialization tool to achieve a Remote Code Execution as SYSTEM. The vulnerability exists in the main message processing routines NmDistributed.DistributedServiceBehavior.OnMessage...

7.2CVSS

EPSS

2024-06-25 08:23 PM
cvelist
cvelist

CVE-2024-5015 WhatsUp Gold SessionControler Server-Side Request Forgery Information Disclosure Vulnerability

In WhatsUp Gold versions released before 2023.1.3, an authenticated SSRF vulnerability in Wug.UI.Areas.Wug.Controllers.SessionControler.Update allows a low privileged user to chain this SSRF with an Improper Access Control vulnerability. This can be used to escalate privileges to...

7.1CVSS

EPSS

2024-06-25 08:15 PM
1
cvelist
cvelist

CVE-2024-5014 WhatsUp Gold GetASPReport Server-Side Request Forgery Information Disclosure

In WhatsUp Gold versions released before 2023.1.3, a Server Side Request Forgery vulnerability exists in the GetASPReport feature. This allows any authenticated user to retrieve ASP reports from an HTML...

7.1CVSS

EPSS

2024-06-25 08:13 PM
1
redhatcve
redhatcve

CVE-2024-39362

In the Linux kernel, the following vulnerability has been resolved: i2c: acpi: Unbind mux adapters before delete There is an issue with ACPI overlay table removal specifically related to I2C multiplexers. Consider an ACPI SSDT Overlay that defines a PCA9548 I2C mux on an existing I2C bus. When...

7.1AI Score

EPSS

2024-06-25 07:50 PM
redhatcve
redhatcve

CVE-2024-39298

In the Linux kernel, the following vulnerability has been resolved: mm/memory-failure: fix handling of dissolved but not taken off from buddy pages When I did memory failure tests recently, below panic occurs: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x8cee00 flags:...

7.1AI Score

EPSS

2024-06-25 07:49 PM
redhatcve
redhatcve

CVE-2024-39371

In the Linux kernel, the following vulnerability has been resolved: io_uring: check for non-NULL file pointer in io_file_can_poll() In earlier kernels, it was possible to trigger a NULL pointer dereference off the forced async preparation path, if no file had been assigned. The trace leading to...

7.1AI Score

EPSS

2024-06-25 06:52 PM
githubexploit
githubexploit

Exploit for CVE-2024-33883

CVE-2024-33883 Insufficient Prototype Pollution...

7.1AI Score

0.0004EPSS

2024-06-25 06:40 PM
4
ibm
ibm

Security Bulletin: IBM WebSphere Application Server is vulnerable to cross-site scripting (CVE-2024-35153)

Summary IBM WebSphere Application Server is vulnerable to cross-site scripting in the administrative console. Vulnerability Details ** CVEID: CVE-2024-35153 DESCRIPTION: **IBM WebSphere Application Server is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed...

6.2AI Score

EPSS

2024-06-25 06:07 PM
ibm
ibm

Security Bulletin: This Power System update is being released to address CVE-2024-31916

Summary This affects the BMC's HTTPS-based Redfish interface. Note the BMC's web-based ASMI interface uses the Redfish interface. Vulnerability Details ** CVEID: CVE-2024-31916 DESCRIPTION: **IBM OpenBMC's BMCWeb HTTPS server component could disclose sensitive URI content to an unauthorized actor.....

6.7AI Score

EPSS

2024-06-25 05:37 PM
ibm
ibm

Security Bulletin: This Power System update is being released to address CVE-2023-45857

Summary This affects the BMC's ASMi web application. Vulnerability Details ** CVEID: CVE-2023-45857 DESCRIPTION: **Axios is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By inserting the X-XSRF-TOKEN header using the secret XSRF-TOKEN cookie value.....

6.5CVSS

5.9AI Score

0.001EPSS

2024-06-25 05:22 PM
osv
osv

DSpace Cross Site Scripting (XSS) via a deposited HTML/XML document

Impact In DSpace 7.0 through 7.6.1, when an HTML, XML or JavaScript Bitstream is downloaded, the user's browser may execute any embedded JavaScript. If that embedded JavaScript is malicious, there is a risk of an XSS attack. This attack may only be initialized by a user who already has Submitter...

5.6AI Score

EPSS

2024-06-25 05:07 PM
1
github
github

DSpace Cross Site Scripting (XSS) via a deposited HTML/XML document

Impact In DSpace 7.0 through 7.6.1, when an HTML, XML or JavaScript Bitstream is downloaded, the user's browser may execute any embedded JavaScript. If that embedded JavaScript is malicious, there is a risk of an XSS attack. This attack may only be initialized by a user who already has Submitter...

2.6CVSS

5.5AI Score

EPSS

2024-06-25 05:07 PM
3
ibm
ibm

Security Bulletin: IBM Cloud Transformation Advisor is vulnerable to cross-site scripting due to WebSphere Application Server Liberty

Summary There is a vulnerability in IBM WebSphere Application Server Liberty used by IBM Cloud Transformation Advisor (CVE-2024-27270). Vulnerability Details ** CVEID: CVE-2024-27270 DESCRIPTION: **IBM WebSphere Application Server Liberty 23.0.0.3 through 24.0.0.3 is vulnerable to cross-site...

4.7CVSS

6.4AI Score

0.0004EPSS

2024-06-25 04:18 PM
2
nvd
nvd

CVE-2024-5989

Due to an improper input validation, an unauthenticated threat actor can send a malicious message to invoke SQL injection into the program and cause a remote code execution condition on the Rockwell Automation ThinManager®...

EPSS

2024-06-25 04:15 PM
3
cve
cve

CVE-2024-5990

Due to an improper input validation, an unauthenticated threat actor can send a malicious message to a monitor thread within Rockwell Automation ThinServer™ and cause a denial-of-service condition on the affected...

7.2AI Score

EPSS

2024-06-25 04:15 PM
1
nvd
nvd

CVE-2024-5990

Due to an improper input validation, an unauthenticated threat actor can send a malicious message to a monitor thread within Rockwell Automation ThinServer™ and cause a denial-of-service condition on the affected...

EPSS

2024-06-25 04:15 PM
1
cve
cve

CVE-2024-5989

Due to an improper input validation, an unauthenticated threat actor can send a malicious message to invoke SQL injection into the program and cause a remote code execution condition on the Rockwell Automation ThinManager®...

9.1AI Score

EPSS

2024-06-25 04:15 PM
2
nvd
nvd

CVE-2024-0171

Dell PowerEdge Server BIOS contains an TOCTOU race condition vulnerability. A local low privileged attacker could potentially exploit this vulnerability to gain access to otherwise unauthorized...

5.3CVSS

EPSS

2024-06-25 04:15 PM
3
nvd
nvd

CVE-2024-5988

Due to an improper input validation, an unauthenticated threat actor can send a malicious message to invoke a local or remote executable and cause a remote code execution condition on the Rockwell Automation ThinManager®...

EPSS

2024-06-25 04:15 PM
1
cve
cve

CVE-2024-0171

Dell PowerEdge Server BIOS contains an TOCTOU race condition vulnerability. A local low privileged attacker could potentially exploit this vulnerability to gain access to otherwise unauthorized...

5.3CVSS

7AI Score

EPSS

2024-06-25 04:15 PM
1
cve
cve

CVE-2024-5988

Due to an improper input validation, an unauthenticated threat actor can send a malicious message to invoke a local or remote executable and cause a remote code execution condition on the Rockwell Automation ThinManager®...

7.5AI Score

EPSS

2024-06-25 04:15 PM
cvelist
cvelist

CVE-2024-5990 ThinManager® ThinServer™ Improper Input Validation Vulnerability

Due to an improper input validation, an unauthenticated threat actor can send a malicious message to a monitor thread within Rockwell Automation ThinServer™ and cause a denial-of-service condition on the affected...

EPSS

2024-06-25 04:11 PM
vulnrichment
vulnrichment

CVE-2024-5989 Rockwell Automation ThinManager® ThinServer™ Improper Input Validation Vulnerability

Due to an improper input validation, an unauthenticated threat actor can send a malicious message to invoke SQL injection into the program and cause a remote code execution condition on the Rockwell Automation ThinManager®...

8.8AI Score

EPSS

2024-06-25 04:01 PM
cvelist
cvelist

CVE-2024-5989 Rockwell Automation ThinManager® ThinServer™ Improper Input Validation Vulnerability

Due to an improper input validation, an unauthenticated threat actor can send a malicious message to invoke SQL injection into the program and cause a remote code execution condition on the Rockwell Automation ThinManager®...

EPSS

2024-06-25 04:01 PM
cvelist
cvelist

CVE-2024-5988 Rockwell Automation ThinManager® ThinServer™ Improper Input Validation Vulnerability

Due to an improper input validation, an unauthenticated threat actor can send a malicious message to invoke a local or remote executable and cause a remote code execution condition on the Rockwell Automation ThinManager®...

EPSS

2024-06-25 03:53 PM
2
ibm
ibm

Security Bulletin: IBM Sterling B2B Integrator Standard Edition does not correctly restrict frame objects

Summary IBM Sterling B2B Integrator Standard Edition does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with. Vulnerability Details ** CVEID:...

6.6AI Score

EPSS

2024-06-25 03:49 PM
2
ibm
ibm

Security Bulletin: Sterling B2B Integrator Standard Edition is vulnerable to cross-site scripting ( CVE-2023-42014).

Summary In Sterling B2B Integrator Standard Edition Console, the Content-Security-Policy header in the console for B2Bi is not set to the stictest available value. The Content-Security-Policy that is set by the server allows inline Javascript and "eval" functions in the browser. Allowing inline...

6.2AI Score

EPSS

2024-06-25 03:36 PM
2
wolfi
wolfi

GHSA-8R3F-844C-MC37 vulnerabilities

Vulnerabilities for packages: grpcurl, argo-workflows, cri-tools, metallb, timoni, cilium, aws-load-balancer-controller, calico, tekton-pipelines, nri-prometheus, smarter-device-manager, gitness, kubewatch, stakater-reloader, secrets-store-csi-driver, kubernetes-csi-external-snapshotter, nuclei,...

7.5AI Score

2024-06-25 03:33 PM
179
wolfi
wolfi

CVE-2023-44487 vulnerabilities

Vulnerabilities for packages: grpcurl, git-lfs, calico, nri-prometheus, gitness, kubewatch, cilium-envoy, stakater-reloader, secrets-store-csi-driver, gomplate, amass, hey, nginx-stable, dotnet, terraform-provider-azurerm, envoy-ratelimit, secrets-store-csi-driver-provider-gcp, kind,...

7.5CVSS

9AI Score

0.732EPSS

2024-06-25 03:33 PM
608
wolfi
wolfi

CVE-2024-6104 vulnerabilities

Vulnerabilities for packages: grafana-mimir, guac, crossplane-provider-azure, k3s, keda, zot, opentofu, flux, fulcio, gitlab-kas, scorecard, tekton-pipelines, flux-image-reflector-controller, terraform, ksops, gitlab-runner, opentelemetry-collector-contrib, prometheus, kubernetes-event-exporter,...

6CVSS

6.2AI Score

0.0004EPSS

2024-06-25 03:33 PM
2
wolfi
wolfi

CVE-2023-45289 vulnerabilities

Vulnerabilities for packages: grpcurl, nri-mssql, cri-tools, metallb, timoni, aws-load-balancer-controller, dive, vite, kubebuilder, nri-haproxy, calico, nri-prometheus, smarter-device-manager, gitness, kubewatch, stakater-reloader, q, kubernetes-csi-external-snapshotter, nuclei, kustomize,...

7.8AI Score

0.0004EPSS

2024-06-25 03:33 PM
191
wolfi
wolfi

CVE-2024-27304 vulnerabilities

Vulnerabilities for packages: kine, step-ca, kube-bench, trillian, k3s, argo-workflows, keda, vault, spicedb, amass, caddy, kots, src, ferretdb, telegraf,...

9.8CVSS

9.7AI Score

0.0004EPSS

2024-06-25 03:33 PM
127
wolfi
wolfi

GHSA-MRWW-27VC-GGHV vulnerabilities

Vulnerabilities for packages: kine, step-ca, kube-bench, trillian, k3s, argo-workflows, keda, vault, spicedb, amass, caddy, kots, src, ferretdb, telegraf,...

7.5AI Score

2024-06-25 03:33 PM
111
wolfi
wolfi

CVE-2024-29018 vulnerabilities

Vulnerabilities for packages: grype, zot, docker-compose, cadvisor, prometheus, ko, crossplane, loki, goreleaser, trivy, melange, kubescape, spire-server, telegraf, kaniko, ctop, aactl, syft, up, datadog-agent, buildkitd, kargo, dagger, wolfictl, tkn, buf,...

5.9CVSS

5.9AI Score

0.0004EPSS

2024-06-25 03:33 PM
156
wolfi
wolfi

CVE-2024-28219 vulnerabilities

Vulnerabilities for packages: py3-pillow, pytorch,...

6.7CVSS

7AI Score

0.0004EPSS

2024-06-25 03:33 PM
43
wolfi
wolfi

GHSA-M87M-MMVP-V9QM vulnerabilities

Vulnerabilities for packages:...

7.5AI Score

2024-06-25 03:33 PM
10
wolfi
wolfi

CVE-2024-20994 vulnerabilities

Vulnerabilities for packages:...

5.3CVSS

6.1AI Score

0.0004EPSS

2024-06-25 03:33 PM
7
wolfi
wolfi

CVE-2024-21047 vulnerabilities

Vulnerabilities for packages:...

4.9CVSS

6AI Score

0.0004EPSS

2024-06-25 03:33 PM
12
wolfi
wolfi

CVE-2024-21062 vulnerabilities

Vulnerabilities for packages:...

4.9CVSS

6AI Score

0.0004EPSS

2024-06-25 03:33 PM
11
Total number of security vulnerabilities435605