Torchbox Wagtail Security Breach

Torchbox Wagtail is an open source content management system CMS from Torchbox UK. A security vulnerability exists in Torchbox Wagtail versions prior to 6.0.5 and prior to 6.1.2, which stems from an improperly applied permission check in the wagtail.contrib.settings module, which can be exploited...

Vulnerability fixed in Apache ActiveMQ

Apache Software Foundation has fixed a vulnerability in Apache ActiveMQ. A malicious party could exploit the vulnerability to gain access to the API layer and thus access sensitive data in the application using MQ, or potentially execute arbitrary code execute with privileges of the application...

Apache ActiveMQ's default configuration doesn't secure the API web context

In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context where the Jolokia JMX REST API and the Message REST API are located. It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker using Jolokia J...

CVE-2024-32114

In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context where the Jolokia JMX REST API and the Message REST API are located. It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker using Jolokia J...

CVE-2024-32114

In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context where the Jolokia JMX REST API and the Message REST API are located. It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker using Jolokia J...

CVE-2024-32114

Apache ActiveMQ 6.x is affected by CVE-2024-32114 due to an insecure default configuration that leaves the API web context (Jolokia JMX REST API and Message REST API) unauthenticated. This allows an attacker to access these layers without credentials and, per the advisory, potentially interact wi...

CVE-2024-32114 Apache ActiveMQ: Jolokia and REST API were not secured with default configuration

In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context where the Jolokia JMX REST API and the Message REST API are located. It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker using Jolokia J...

CVE-2024-32114 Apache ActiveMQ: Jolokia and REST API were not secured with default configuration

In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context where the Jolokia JMX REST API and the Message REST API are located. It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker using Jolokia J...

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to cross-site scripting (CVE-2023-28517)

Summary IBM Sterling Partner Engagement Manager has addressed a reflected cross-site scripting vulnerability. Vulnerability Details CVEID:CVE-2023-28517 DESCRIPTION: IBM Sterling Partner Engagement Manager is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary...

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to low confidentiality impacts due to Java SE (CVE-2023-22045)

Summary IBM Sterling Partner Engagement Manager uses Java SE. Vulnerability Details CVEID:CVE-2023-22045 DESCRIPTION: An unspecified vulnerability in Java SE related to the VM component could allow a remote attacker to cause low confidentiality impacts. CVSS Base score: 3.7 CVSS Temporal Score:...

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to denial of service due to Apache Commons FileUpload (CVE-2023-24998)

Summary IBM Sterling Partner Engagement Manager uses Apache Commons FileUpload. This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details CVEID:CVE-2023-24998 DESCRIPTION: Apache Commons FileUpload and Tomcat are vulnerable to a denial of service, caused by no...

Spring Framework server Web DoS Vulnerability

In Spring Framework versions 6.0.15 and 6.1.2, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition. Specifically, an application is vulnerable when all of the following are true: Typically, Spring Boot applications need the...

Spring Framework Security Vulnerabilities

Spring Framework is the U.S. Spring team of a set of open source Java, JavaEE application framework. The framework helps developers build high-quality applications. A security vulnerability exists in Spring Framework versions 6.0.15 and 6.1.2, which stems from the possibility that a user may be...

CVE-2023-45585

An insertion of sensitive information into log file vulnerability CWE-532 in FortiSIEM version 7.0.0, version 6.7.6 and below, version 6.6.3 and below, version 6.5.1 and below, version 6.4.2 and below, version 6.3.3 and below, version 6.2.1 and below, version 6.1.2 and below, version 5.4.0, versi...

CVE-2023-45585

An insertion of sensitive information into log file vulnerability CWE-532 in FortiSIEM version 7.0.0, version 6.7.6 and below, version 6.6.3 and below, version 6.5.1 and below, version 6.4.2 and below, version 6.3.3 and below, version 6.2.1 and below, version 6.1.2 and below, version 5.4.0, versi...

CVE-2023-43045

IBM Sterling Partner Engagement Manager (Essentials Edition: 6.1.2, 6.2.0, 6.2.2; Standard Edition: 6.1.2, 6.2.0, 6.2.2) is affected by CVE-2023-43045, a remote-authentication bypass that could let an attacker perform unauthorized actions. Root cause is improper authentication. IBM’s security bul...

IBM Sterling Partner Engagement Manager 访问控制错误漏洞

IBM Sterling Partner Engagement Manager is an automated management tool from International Business Machines IBM. An authentication error vulnerability exists in IBM Sterling Partner Engagement Manager versions 6.1.2, 6.2.0, and 6.2.2, which stems from the program improperly authenticating a remo...

WordPress Highcompress Image Compressor Plugin <= 6.1.2 is vulnerable to Broken Access Control

Software Highcompress Image Compressor Type Plugin Vulnerable versions = 6.1.2 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-40209 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 99c36206c314 Credits Abdi Pranat...

PT-2023-26031 · Apache · Apache Roller

Name of the Vulnerable Software and Affected Versions: Apache Roller versions prior to 6.1.2 Description: Insufficient input validation and sanitation in Weblog Category name, Website About, and File Upload features allows an authenticated user to perform an XSS attack. Recommendations: If you do...

CVE-2023-37415 Apache Airflow Apache Hive Provider: Improper Input Validation in Hive Provider with proxy_user

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Apache Hive Provider. Patching on top of CVE-2023-35797 Before 6.1.2 the proxyuser option can also inject semicolon. This issue affects Apache Airflow Apache Hive Provider: before 6.1.2. It is recommended updatin...