Indusoft Web Studio, And Intouch Edge Hmi (formerly Intouch Machine Edition) Security Vulnerabilities

PT-2021-02: Encryption bypass when downloading a firmware update in Diebold-Nixdorf RM3/CRS

PT-2021-02: Encryption bypass when downloading a firmware update in Diebold-Nixdorf RM3/CRS RM3/CRS dispenser firmware (all versions up to and including 41128 1002 RM3_CRS.BTR + 170329 2332 RM3_CRS.FRM) Severity: Severity level: High Encryption bypass when downloading a firmware update in...

PT-2021-01: Encryption bypass when downloading a firmware update in Diebold-Nixdorf CMDv5

PT-2021-01: Encryption bypass when downloading a firmware update in Diebold-Nixdorf CMDv5 CMDv5 dispenser firmware (all versions up to and including 141128 1002 CD5_ATM.BTR + 170329 2332 CD5_ATM.FRM) Severity: Severity level: High Encryption bypass when downloading a firmware update in...

Tuesday, July 2, 2024 Security Releases

Summary The Node.js project will release new versions of the 22.x, 20.x, 18.x releases lines on or shortly after, Tuesday, July 2, 2024 in order to address: 1 high severity issues. 2 medium severity issues. 3 low severity issues. Node.js fetch will be upgraded to undici v6.19.2 on Node.js 18.x...

CVE-2024-6419

A vulnerability classified as critical was found in SourceCodester Medicine Tracker System 1.0. This vulnerability affects unknown code of the file /classes/Master.php?f=save_medicine. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has....

CVE-2024-6419

A vulnerability classified as critical was found in SourceCodester Medicine Tracker System 1.0. This vulnerability affects unknown code of the file /classes/Master.php?f=save_medicine. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has....

CVE-2024-6419 SourceCodester Medicine Tracker System sql injection

A vulnerability classified as critical was found in SourceCodester Medicine Tracker System 1.0. This vulnerability affects unknown code of the file /classes/Master.php?f=save_medicine. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has....

CVE-2024-6418

A vulnerability classified as critical has been found in SourceCodester Medicine Tracker System 1.0. This affects an unknown part of the file /classes/Users.php?f=register_user. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The...

CVE-2024-6417

A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/ajax.php?action=delete_user. The manipulation of the argument id leads to sql injection. The attack may be launched...

CVE-2024-6418

A vulnerability classified as critical has been found in SourceCodester Medicine Tracker System 1.0. This affects an unknown part of the file /classes/Users.php?f=register_user. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The...

CVE-2024-6417

A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/ajax.php?action=delete_user. The manipulation of the argument id leads to sql injection. The attack may be launched...

CVE-2024-6418 SourceCodester Medicine Tracker System sql injection

A vulnerability classified as critical has been found in SourceCodester Medicine Tracker System 1.0. This affects an unknown part of the file /classes/Users.php?f=register_user. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The...

CVE-2024-6417 SourceCodester Simple Online Bidding System sql injection

A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/ajax.php?action=delete_user. The manipulation of the argument id leads to sql injection. The attack may be launched...

eightcap.com Cross Site Scripting vulnerability OBB-3939800

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently...

CVE-2024-6416

A vulnerability was found in SeaCMS 12.9. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /js/player/dmplayer/dmku/?ac=edit. The manipulation of the argument cid with the input (select(0)from(select(sleep(10)))v) leads to sql injection. The.....

CVE-2024-6416

A vulnerability was found in SeaCMS 12.9. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /js/player/dmplayer/dmku/?ac=edit. The manipulation of the argument cid with the input (select(0)from(select(sleep(10)))v) leads to sql injection. The.....

CVE-2024-6416 SeaCMS sql injection

A vulnerability was found in SeaCMS 12.9. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /js/player/dmplayer/dmku/?ac=edit. The manipulation of the argument cid with the input (select(0)from(select(sleep(10)))v) leads to sql injection. The.....

dvgiochi.com Cross Site Scripting vulnerability OBB-3939799

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently...

CVE-2024-34703

Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. Prior to versions 3.3.0 and 2.19.4, an attacker could present an ECDSA X.509 certificate using explicit encoding where the parameters....

CVE-2024-34703

Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. Prior to versions 3.3.0 and 2.19.4, an attacker could present an ECDSA X.509 certificate using explicit encoding where the parameters....

edenprojectcommunities.com Cross Site Scripting vulnerability OBB-3939797

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently...

CVE-2023-41419 vulnerabilities

Vulnerabilities for packages: kubeflow-jupyter-web-app,...

GHSA-X7M3-JPRG-WC5G vulnerabilities

Vulnerabilities for packages: kubeflow-jupyter-web-app,...

GHSA-84PR-M4JR-85G5 vulnerabilities

Vulnerabilities for packages: kubeflow-jupyter-web-app, py3-flask-cors,...

CVE-2024-34069 vulnerabilities

Vulnerabilities for packages: kubeflow-jupyter-web-app, py3-werkzeug, py3.10-tensorflow-core, superset,...

GHSA-2G68-C3QC-8985 vulnerabilities

Vulnerabilities for packages: kubeflow-jupyter-web-app, py3-werkzeug, py3.10-tensorflow-core, superset,...

GHSA-JJG7-2V4V-X38H vulnerabilities

Vulnerabilities for packages: jwt-tool, kubeflow-pipelines-visualization-server, kubeflow-pipelines, kubeflow-jupyter-web-app, k8s-sidecar, confluent-docker-utils, py3.10-tensorflow-core, az, dask-gateway, kubeflow-katib, ggshield, py3-cassandra-medusa, py3-idna, kubeflow-volumes-web-app,...

CVE-2024-3651 vulnerabilities

Vulnerabilities for packages: jwt-tool, kubeflow-pipelines-visualization-server, kubeflow-pipelines, kubeflow-jupyter-web-app, k8s-sidecar, confluent-docker-utils, py3.10-tensorflow-core, az, dask-gateway, kubeflow-katib, ggshield, py3-cassandra-medusa, py3-idna, kubeflow-volumes-web-app,...

GHSA-H75V-3VVJ-5MFJ vulnerabilities

Vulnerabilities for packages: reflex, pytorch, kubeflow-jupyter-web-app, py3-jinja2, confluent-docker-utils, dask-gateway, superset,...

GHSA-G4MX-Q9VG-27P4 vulnerabilities

Vulnerabilities for packages: jwt-tool, kubeflow-jupyter-web-app, py3-tensorflow-serving-api, py3-urllib3,...

CVE-2024-34064 vulnerabilities

Vulnerabilities for packages: reflex, pytorch, kubeflow-jupyter-web-app, py3-jinja2, confluent-docker-utils, dask-gateway, superset,...

CVE-2023-45803 vulnerabilities

Vulnerabilities for packages: jwt-tool, kubeflow-jupyter-web-app, py3-tensorflow-serving-api, py3-urllib3,...

GHSA-9WX4-H78V-VM56 vulnerabilities

Vulnerabilities for packages: reflex, jwt-tool, kubeflow-pipelines, kubeflow-jupyter-web-app, k8s-sidecar, mlflow, patroni, confluent-docker-utils, py3.10-tensorflow-core, az, airflow, kubeflow-katib, ggshield, py3-cassandra-medusa, superset, kubeflow-volumes-web-app,...

CVE-2024-37891 vulnerabilities

Vulnerabilities for packages: reflex, kubeflow-pipelines, kubeflow-jupyter-web-app, k8s-sidecar, mlflow, py3-urllib3, confluent-docker-utils, az, dask-gateway, airflow, kubeflow-katib, ggshield, superset, kubeflow-volumes-web-app,...

CVE-2024-1681 vulnerabilities

Vulnerabilities for packages: kubeflow-jupyter-web-app, py3-flask-cors,...

CVE-2023-46136 vulnerabilities

Vulnerabilities for packages: kubeflow-jupyter-web-app, py3-tensorflow-serving-api, py3-werkzeug, airflow,...

CVE-2024-35195 vulnerabilities

Vulnerabilities for packages: reflex, jwt-tool, kubeflow-pipelines, kubeflow-jupyter-web-app, k8s-sidecar, mlflow, patroni, confluent-docker-utils, py3.10-tensorflow-core, az, airflow, kubeflow-katib, ggshield, py3-cassandra-medusa, superset, kubeflow-volumes-web-app,...

GHSA-HRFV-MQP8-Q5RW vulnerabilities

Vulnerabilities for packages: kubeflow-jupyter-web-app, py3-tensorflow-serving-api, py3-werkzeug, airflow,...

GHSA-34JH-P97F-MPXF vulnerabilities

Vulnerabilities for packages: reflex, kubeflow-pipelines, kubeflow-jupyter-web-app, k8s-sidecar, mlflow, py3-urllib3, confluent-docker-utils, az, dask-gateway, airflow, kubeflow-katib, ggshield, superset, kubeflow-volumes-web-app,...

GHSA-V845-JXX5-VC9F vulnerabilities

Vulnerabilities for packages: kubeflow-jupyter-web-app, k8s-sidecar, py3-urllib3, dask-gateway, kube-downscaler,...

CVE-2023-43804 vulnerabilities

Vulnerabilities for packages: kubeflow-jupyter-web-app, k8s-sidecar, py3-urllib3, dask-gateway, kube-downscaler,...

restaurantcateringsystems.com Cross Site Scripting vulnerability OBB-3939796

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently...

levelovoyageur.com Cross Site Scripting vulnerability OBB-3939794

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently...

hovawarte-vom-hechtmoor.de Cross Site Scripting vulnerability OBB-3939793

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently...

twww-webdesign.de Cross Site Scripting vulnerability OBB-3939792

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently...

CVE-2024-34703 Botan Vulnerable to Denial of Service Due to Overly Large Elliptic Curve Parameters

Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. Prior to versions 3.3.0 and 2.19.4, an attacker could present an ECDSA X.509 certificate using explicit encoding where the parameters....

it-sentry.com Cross Site Scripting vulnerability OBB-3939791

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently...

eltallerdelmodelista.com Cross Site Scripting vulnerability OBB-3939790

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently...

eltrade.com Cross Site Scripting vulnerability OBB-3939789

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently...

CVE-2024-28794

IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: ...

CVE-2023-50964

IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: ...