Security Bulletin: IBM Maximo Application Suite - Monitor Component is vulnerable to axios-1.7.2.tgz CVE-2024-39338

Summary IBM Maximo Application Suite - Monitor Component is vulnerable to axios-1.7.2.tgz CVE-2024-39338. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2024-39338 DESCRIPTION: Axios is vulnerable to server-side request forgery, caused b...

Security Bulletin: IBM Maximo Application Suite - AI Broker Component uses jsonpath-plus-9.0.0.tgz which is vulnerable to this CVE-2024-21534

Summary Security Bulletin: IBM Maximo Application Suite - AI Broker Component uses jsonpath-plus-9.0.0.tgz which is vulnerable to this CVE-2024-21534. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2024-21534 DESCRIPTION: Versions o...

Security Bulletin: IBM Maximo Application Suite - Predict Component component uses werkzeug-3.0.4-py3-none-any.whl which is vulnerable to this CVE-2024-49767 and CVE-2024-49766

Summary Security Bulletin: IBM Maximo Application Suite - Predict Component component uses werkzeug-3.0.4-py3-none-any.whl which is vulnerable to this CVE-2024-49767 and CVE-2024-49766. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details...

Security Bulletin: IBM Maximo Application Suite - Predict Component component uses cryptography-43.0.0-cp39-abi3-manylinux_2_28_x86_64.whl which is vulnerable to this CVE-2024-6119

Summary Security Bulletin: IBM Maximo Application Suite - Predict Component component uses cryptography-43.0.0-cp39-abi3-manylinux228x8664.whl which is vulnerable to this CVE-2024-6119. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details...

fastify-multipart 安全漏洞

fastify-multipart is a software package that supports parsing multiple content types. A security vulnerability exists in fastify-multipart versions 8.3.0 and earlier and versions 9.0.0 through 9.0.3 and earlier, which stems from the saveRequestFiles function not deleting temporary files that have...

Security Bulletin: IBM WebSphere Application Server Liberty is vulnerable to information disclosure which is vulnerable to this CVE-2023-50314

Summary Security Bulletin:IBM WebSphere Application Server Liberty is vulnerable to information disclosure which is vulnerable to this CVE-2023-50314. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2023-50314 DESCRIPTION: IBM...

Security Bulletin: IBM Maximo Application Suite - MVI Component uses jose4j-0.9.3.jar which is vulnerable to this CVE-2023-51775

Summary Security Bulletin: IBM Maximo Application Suite - MVI Component uses jose4j-0.9.3.jar which is vulnerable to this CVE-2023-51775 Vulnerability Details CVEID:CVE-2023-51775 DESCRIPTION: jose4j is vulnerable to a denial of service, caused by improper input validation. By sending a specially...

CVE-2024-0317

Cross-Site Scripting in FireEye EX, affecting version 9.0.3.936727. Exploitation of this vulnerability allows an attacker to send a specially crafted JavaScript payload via the 'type' and 'sfname' parameters to an authenticated user to retrieve their session details...

PT-2023-31951 · Unknown · Mdaemon Securitygateway

Name of the Vulnerable Software and Affected Versions: MDaemon SecurityGateway versions through 9.0.3 Description: The issue allows domain administrators to conduct attacks against global administrators via a crafted Message Content Filtering rule, which enables XSS. Recommendations: For MDaemon...

Grafana Labs Stored XSS (CVE-2022-31097)

According to its self-reported version number, the version of Grafana Labs running on the remote host is affected by a stored cross-site scripting vulnerability: - XSS vulnerability in the Unified Alerting feature of Grafana. After analysis, this stored XSS could be used to elevate privileges fro...

WordPress teachPress Plugin <= 9.0.2 is vulnerable to Cross Site Scripting (XSS)

Software teachPress Type Plugin Vulnerable versions = 9.0.2 Fixed in 9.0.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-36501 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID cec894d7c58b Credits Le Ngoc Anh Required...

MAL-2023-1125 Malicious code in bjss-atp-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7046ba13fe73d317a4a8d1b70db5fcb53d3b4e6c05b9682fa438e6dc855834ea The OpenSSF Package Analysis project identified 'bjss-atp-web' @ 9.0.3 npm as malicious. It is considered malicious because: - The package...

GHSA-C429-5P7V-VGJP hoek subject to prototype pollution via the clone function.

hoek versions prior to 8.5.1, and 9.x prior to 9.0.3 are vulnerable to prototype pollution in the clone function. If an object with the proto key is passed to clone the key is converted to a prototype. This issue has been patched in version 9.0.3, and backported to 8.5.1...

DEBIAN-CVE-2020-36604

hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function...

CVE-2020-36604

hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function...

CVE-2022-31107 Grafana account takeover via OAuth vulnerability

Grafana is an open-source platform for monitoring and observability. In versions 5.3 until 9.0.3, 8.5.9, 8.4.10, and 8.3.10, it is possible for a malicious user who has authorization to log into a Grafana instance via a configured OAuth IdP which provides a login name to take over the account of...

CVE-2021-28970

eMPS 9.0.1.923211 on the Central Management of FireEye EX 3500 devices allows remote authenticated users to conduct SQL injection attacks via the jobid parameter to the email search feature. According to the vendor, the issue is fixed in 9.0.3...

CVE-2021-28969

eMPS 9.0.1.923211 on FireEye EX 3500 devices allows remote authenticated users to conduct SQL injection attacks via the sortby parameter to the email search feature. According to the vendor, the issue is fixed in 9.0.3. NOTE: this is different from CVE-2020-25034 and affects newer versions of the...

Sql injection

eMPS 9.0.1.923211 on the Central Management of FireEye EX 3500 devices allows remote authenticated users to conduct SQL injection attacks via the jobid parameter to the email search feature. According to the vendor, the issue is fixed in 9.0.3...

Palo Alto Networks PAN-OS Memory Corruption Vulnerability

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks for its firewall appliances. A memory corruption vulnerability exists in Palo Alto Networks PAN-OS versions 8.1.9 and earlier and 9.0.3 and earlier. An attacker can exploit this vulnerability to corrupt arbitrary...