CVE-2024-54136

ClipBucket V5 provides open source video hosting with PHP. ClipBucket-v5 Version 5.5.1 Revision 199 and below is vulnerable to PHP Deserialization vulnerability. The vulnerability exists in upload/upload.php where the user supplied input via collection get parameter is directly provided to...

CVE-2024-54135 Untrusted Deserialization in ClipBucket-v5 Version 2.0 to 5.5.1 Revision 199

ClipBucket V5 provides open source video hosting with PHP. ClipBucket-v5 Version 2.0 to Version 5.5.1 Revision 199 are vulnerable to PHP Deserialization vulnerability. The vulnerability exists in upload/photoupload.php within the decodekey function. User inputs were supplied to this function...

CVE-2024-54136

Summary: ClipBucket-v5 (versions up to 5.5.1 Revision 199) is affected by a PHP deserialization vulnerability in upload/upload.php where user input via the collection parameter is passed to unserialize, enabling crafted PHP serialized objects and gadget chains. Impact (as stated): allows arbitrar...

Security Bulletin: Mutiple vulnerabilites in Python affect IBM Robotic Process Automation

Summary Mutiple vulnerabilites in Python affect IBM Robotic Process Automation. Python is used by IBM Robotic Process Automation as part of Watson NLP. This bulletin identifies the fixes required to resolve the vulnerabilities. Vulnerability Details CVEID:CVE-2019-11236 DESCRIPTION: Python urllib...

Oracle Linux 7 : java-1.8.0-openjdk (ELSA-2024-8116)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-8116 advisory. - Fixes CVE-2024-21208 CVE-2024-21210 CVE-2024-21217 CVE-2024-21235 - 1001-orabug36904359-CVE-2024-21131-fix.patch -...

Oracle Linux 7 : java-11-openjdk (ELSA-2024-8120)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-8120 advisory. - Fixes CVE-2024-21208 CVE-2024-21210 CVE-2024-21217 CVE-2024-21235 - 1001-orabug36904359-CVE-2024-21138-fix.patch -...

Security Bulletin: Apache uimaj-core.jar security vulnerability CVE-2017-15691

Summary Apache uimaj-core.jar security vulnerability CVE-2017-15691 in FileNet Content Manager FNCM Content Search Services CSS/Enterprise Content Management Text Search ECMTS. CSS/ECMTS is affected and is potentially vulnerable. Vulnerability Details CVEID:CVE-2017-15691 DESCRIPTION: Apache uima...

Security Bulletin: IBM QRadar Pre-Validation App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that might be identified and exploited with automated tools. IBM has addressed the vulnerabilities. This product is only used by IBM QRadar SIEM app developers and external business partners and is not relevant for users...

CVE-2024-52528 Auth Token can be passed dummy or wrong the middleware response is 200 OK

Budget Control Gateway acts as an entry point for incoming requests and routes them to the appropriate microservices for Budget Control. Budget Control Gateway does not properly validate auth tokens, which allows attackers to bypass intended restrictions. This vulnerability is fixed in 1.5.2...

CVE-2024-47915

VaeMendis - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor...

CVE-2024-47915 VaeMendis - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

VaeMendis - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor...

CVE-2024-47915 VaeMendis - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

VaeMendis - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor...

CVE-2024-47915

CVE-2024-47915 relates to VaeMendis Ubooquity vulnerability (reported in CVE records) where sensitive information can be exposed to unauthorized actors. Public details across sources indicate an information disclosure issue affecting VaeMendis Ubooquity, with a concrete product/version mentioned ...

CVE-2023-44255

An exposure of sensitive information to an unauthorized actor CWE-200 in Fortinet FortiManager before 7.4.2, FortiAnalyzer before 7.4.2 and FortiAnalyzer-BigData before 7.2.5 may allow a privileged attacker with administrative read permissions to read event logs of another adom via crafted HTTP o...

Security Bulletin: Vulnerabilities Addressed in IBM Tivoli Network Manager IP Edition (ITNM) version 4.2 Fix Pack 20 (4.2.0.20)

Summary Multiple vulnerabilities were addressed in ITNM version 4.2 Fix Pack 20 4.2.0.20 Vulnerability Details CVEID:CVE-2024-23944 DESCRIPTION: Apache ZooKeeper could allow a remote authenticated attacker to obtain sensitive information, caused by a flaw in persistent watchers handling. By...

The vulnerability of the microprogrammed software in the SIMATIC S7-200 SMART CPU family, related to uncontrolled resource consumption, allows a intruder to trigger malfunctions during maintenance operations.

The vulnerability of the microprogrammed software in the SIMATIC S7-200 SMART CPU family is related to incorrect processing of TCP packets. Exploiting this vulnerability can allow an attacker to cause malfunctions in the system remotely...

LevelOne WBR-6012 Web Application information disclosure vulnerability

Talos Vulnerability Report TALOS-2024-1986 LevelOne WBR-6012 Web Application information disclosure vulnerability October 30, 2024 CVE Number CVE-2024-33626 SUMMARY The LevelOne WBR-6012 router contains a vulnerability within its web application that allows unauthenticated disclosure of sensitive...

Security Bulletin: security vulnerabilities are addressed with IBM Business Automation Insights iFix for September 2024.

Summary Security vulnerabilities are addressed with IBM Business Automation Insights 24.0.0-IF001 Vulnerability Details CVEID:CVE-2024-43799 DESCRIPTION: pillarjs send is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this...

CVE-2024-44081

In Jitsi Meet before 2.0.9779, the functionality to share a video file was implemented in an insecure way, resulting in clients loading videos from an arbitrary URL if a message from another participant contains a URL encoded in the expected format...

Fortinet FortiClient stores the SSLVPN password in cleartext (FG-IR-22-246) (macOS)

The version of FortiClient installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-22-246 advisory. - An exposure of sensitive information to an unauthorized actor vulnerabiltiy CWE-200 in FortiClient for Mac versions 7.0.0...