CVE-2024-39726 IBM Engineering Insights XML external entity injection

IBM Engineering Lifecycle Optimization - Engineering Insights 7.0.2 and 7.0.3 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

Security Bulletin: IBM Engineering Lifecycle Optimization - Engineering Insights is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data.

Summary IBM Engineering Lifecycle Optimization - Engineering Insights ENI is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. In XML parsers, when XML...

PT-2024-8880 · Ibm · Ibm Engineering Systems Design Rhapsody - Model Manager

Name of the Vulnerable Software and Affected Versions: IBM Engineering Systems Design Rhapsody - Model Manager versions 7.0.2 through 7.0.3 Description: The issue is caused by a race condition, allowing a remote attacker to bypass security restrictions. By sending a specially crafted request, an...

Security Bulletin: IBM Jazz Reporting Services is vulnerable to a to cross-site scripting (CVE-2020-4051)

Summary Cross-site scripting has been identified in dojo library shipped with IBM Jazz Reporting Services JRS. JRS has addressed the issues by releasing a fix Vulnerability Details CVEID:CVE-2020-4051 DESCRIPTION: Dijit is vulnerable to cross-site scripting, caused by improper validation of...

OESA-2024-2075 ffmpeg security update

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash. Security Fixes: A vulnerability was fou...

Security Bulletin: IBM Global Configuration Management - Vulnerable to archiving a global baseline by an authenticated user having improper access controls

Summary IBM Global Configuration Management is vulnerable to archiving a global baseline by an authenticated user having improper access controls/permissions. This bulletin contains information regarding the vulnerability and remediation actions. Vulnerability Details CVEID:CVE-2024-41773...

PT-2024-29557 · Ibm · Ibm Global Configuration Management

Name of the Vulnerable Software and Affected Versions: IBM Global Configuration Management versions 7.0.2 through 7.0.3 Description: The issue is related to improper access controls, allowing an authenticated user to archive a global baseline. This could potentially lead to privilege escalation d...

SUSE CVE-2024-7055

A vulnerability was found in FFmpeg up to 7.0.1. It has been classified as critical. This affects the function pnmdecodeframe in the library /libavcodec/pnmdec.c. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed t...

UBUNTU-CVE-2024-7055

A vulnerability was found in FFmpeg up to 7.0.1. It has been classified as critical. This affects the function pnmdecodeframe in the library /libavcodec/pnmdec.c. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed t...

CVE-2024-7055

A vulnerability was found in FFmpeg up to 7.0.1. It has been classified as critical. This affects the function pnmdecodeframe in the library /libavcodec/pnmdec.c. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed t...

WordPress Woocommerce OpenPos Plugin <= 7.0.1 is vulnerable to Broken Access Control

Software Woocommerce OpenPos Type Plugin Vulnerable versions = 7.0.1 Fixed in 7.0.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-37935 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID d6898ddc425e Credits Dave Jong Patchstack...

CVE-2024-37734

An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid parameter...

PT-2024-27726 · Openemr · Openemr

Name of the Vulnerable Software and Affected Versions: OpenEMR version 7.0.2 Description: An issue in OpenEMR allows a remote attacker to escalate privileges via a crafted POST request using the noteid parameter. Recommendations: For OpenEMR version 7.0.2, as a temporary workaround, consider...

CVE-2024-37734

CVE-2024-37734 affects OpenEMR 7.0.2; a remote attacker can escalate privileges by sending a crafted POST request that uses the noteid parameter. This vulnerability, rated CVSS v3.1 as 9.8 (CRITICAL) with network access, low complexity, and no privileges required, appears in multiple feeds; no of...

IBM Engineering Requirements Management DOORS Next Code Issue Vulnerability

IBM Engineering Requirements Management DOORS Next is a scalable solution from International Business Machines IBM. The solution helps you capture, track, analyze, and manage systems and advanced IT application development. A code issue vulnerability exists in IBM Engineering Requirements...

PT-2024-13223 · Ibm · Ibm Engineering Requirements Management Doors Next

Name of the Vulnerable Software and Affected Versions: IBM Engineering Requirements Management DOORS Next versions 7.0.2 through 7.0.3 Description: The issue is related to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this to expose sensitiv...

Security Bulletin: IBM Engineering Workflow Management (EWM) vulnerability CVE-2024-28793

Summary Vulnerability CVE-2024-28793 affects the Team Concert Git plugin of IBM Engineering Workflow Management EWM. Vulnerability Details CVEID:CVE-2024-28793 DESCRIPTION: IBM Engineering Workflow Management is vulnerable to stored cross-site scripting. Under certain configurations, this...

Security Bulletin: IBM Engineering Lifecycle Management is vulnerable to induce the application to perform server-side HTTP and HTTPS requests to arbitrary domains.(CVE-2021-20544)

Summary External service interaction arises when it is possible to induce an application to interact with an arbitrary external service, such as a web or mail server. The ability to trigger arbitrary external service interactions does not constitute a vulnerability in its own right, and in some...

Security Bulletin: The IBM® Engineering Lifecycle Management is impacted by vulnerabilties in Apache Xerces2

Summary Multiple vulnerabilities have been identified in Apache Xerces2, which is used in IBM Engineering Lifecycle Management - IBM Jazz. This bulletin contains information regarding vulnerabilities and remediation actions. Vulnerability Details CVEID:CVE-2022-23437 DESCRIPTION: Apache Xerces2...

CVE-2023-0582 Path Traversal in ForgeRock Access Managment

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in ForgeRock Access Management allows Authorization Bypass. This issue affects access management: before 7.3.0, before 7.2.1, before 7.1.4, through 7.0.2...