33 matches found
CVE-2024-54002
Dependency-Track suffers a timing-based user enumeration flaw in /api/v1/user/login for usernames known to the system (LDAP/OpenID Connect users are unaffected). This CVE identifies that a longer response time reveals valid usernames, with the issue fixed in Dependency-Track 4.12.2. Affected prod...
CVE-2024-52293
Craft CMS prior to 4.12.2 and 5.4.3 is vulnerable due to missing normalizePath in FileHelper::absolutePath, enabling potential Remote Code Execution via Twig SSTI. This is a sequel to CVE-2023-40035. The issue is fixed in Craft 4.12.2 and 5.4.3. Affected versions should upgrade to the specified f...
Arbitrary Code Injection
Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Arbitrary Code Injection via the absolutePath function, due to missing path normalization, by executing a twig SSTI template. Remediation Upgrade craftcms/cms to version 4.12.2, 5.4.3 or...
RHBA-2023:0568 Red Hat Bug Fix Advisory: OpenShift Container Platform 4.12.2 packages update
Bulletin has no description...
PT-2024-12819 · Easyemail · Easyemail
Name of the Vulnerable Software and Affected Versions: EasyEmail versions prior to 4.12.2 Description: A Cross Site Scripting XSS issue allows a local attacker to execute arbitrary code via the user input parameters. The researcher claims this issue is present in all versions prior to and later...
Wordpress plugin Cloudflare security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...
Moderate: Red Hat Bug Fix Advisory: OpenShift Container Platform 4.12.2 packages update
Red Hat OpenShift Container Platform release 4.12.2 is now available with updates to packages and images that fix several bugs. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This...
Shadow: TOCTOU Race
Background Shadow contains utilities to deal with user accounts Description A TOCTOU race condition was discovered in shadow. A local attacker with write privileges in a directory removed or copied by usermod/userdel could potentially exploit this flaw when the administrator invokes...
Mcafee McAfee Advanced Threat Defense 信息泄露漏洞
McAfee Advanced Threat Defense ATD is a set of threat detection and defense solutions from the U.S. company McAfee McAfee, providing malware analysis, sharing threat intelligence and isolating compromised systems. An information disclosure vulnerability exists in the web interface of McAfee...
PT-2021-12644 · Mcafee · Mcafee Advanced Threat Defense
Name of the Vulnerable Software and Affected Versions: McAfee Advanced Threat Defense ATD versions prior to 4.12.2 Description: The issue allows remote authenticated users to view sensitive unencrypted information via a carefully crafted HTTP request parameter in the web interface. The risk is...
Samba DoS Vulnerability (CVE-2020-10704)
Samba is prone to a denial of service vulnerability. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Samba DoS Vulnerability (CVE-2020-10700)
Samba is prone to a denial of service vulnerability. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
