regreSSHion: Remote Unauthenticated Code Execution Vulnerability in OpenSSH server

The Qualys Threat Research Unit TRU has discovered a Remote Unauthenticated Code Execution RCE vulnerability in OpenSSH’s server sshd in glibc-based Linux systems. CVE assigned to this vulnerability is CVE-2024-6387. The vulnerability, which is a signal handler race condition in OpenSSHs server...

The vulnerability of the Net::CIDR::Lite interpreter for the Perl programming language arises from errors in handling extra null characters at the beginning of an IP address string. This allows a malicious actor to bypass access controls.

The vulnerability of the Net::CIDR::Lite interpreter for the Perl programming language is related to errors in handling extra zero characters at the beginning of an IP address. Exploiting this vulnerability can allow a remote attacker to bypass access controls...

CVE-2023-30998

IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to obtain root access due to improper access controls. IBM X-Force ID: 254649...

CVE-2023-30998

IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to obtain root access due to improper access controls. IBM X-Force ID: 254649...

CVE-2023-30997 IBM Security Access Manager Docker privilege escalation

IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to obtain root access due to improper access controls. IBM X-Force ID: 254638...

CVE-2023-30997

IBM Security Access Manager (Docker) versions 10.0.0.0 through 10.0.7.1 are affected by CVE-2023-30997, a local privilege escalation due to improper access controls that could allow a local user to obtain root access. The issue is documented with a high impact (C/H/I/H/A/H) and local attack vecto...

CVE-2023-30997 IBM Security Access Manager Docker privilege escalation

IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to obtain root access due to improper access controls. IBM X-Force ID: 254638...

CVE-2023-30998

CVE-2023-30998 affects IBM Security Verify Access Docker (versions 10.0.0.0–10.0.7.1). Root cause: improper access controls allowing a local user to obtain root. Impact: local privilege escalation on affected containers. Remediation: upgrade to 10.0.8.0 or later (IBM guidance; docker pull icr.io/...

CVE-2023-30998 IBM Security Access Manager Docker privilege escalation

IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to obtain root access due to improper access controls. IBM X-Force ID: 254649...

Talya Informatics Travel APPS SQL Injection Vulnerability

Talya Informatics Travel APPS is a travel software from the Turkish company Talya Informatics. A SQL injection vulnerability exists in Talya Informatics Travel APPS prior to version v17.0.68, which stems from a vulnerability that allows an attacker to bypass authentication using misconfigured...

ROS-20240627-01

A vulnerability in the implementation of the CORS mechanism of Microsoft Edge and Google Chrome browsers is related to weaknesses in the access controls. Exploitation of the vulnerability could allow an attacker acting remotely to bypass existing security restrictions and disclose protected...

Talya Informatics Travel APPS Security Breach

Talya Informatics Travel APPS is a travel software from the Turkish company Talya Informatics. A security vulnerability exists in Talya Informatics Travel APPS prior to version v17.0.68, which stems from a vulnerability that allows an attacker to bypass user control key authorization using...

Security Bulletin: IBM Security Verify Access is vulnerable to multiple Security Vulnerabilities

Summary The IBM Security Verify Access Appliance and IBM Security Verify Access Container has addressed multiple vulnerabilities in release 10.0.8.0. Vulnerability Details CVEID:CVE-2023-38371 DESCRIPTION: IBM Security Access Manager uses weaker than expected cryptographic algorithms that could...

CVE-2024-5455 The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.6 - Authenticated (Contributor+) Local File Inclusion

The Plus Addons for Elementor Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.5.4 via the 'magazinestyle' parameter within the Dynamic Smart Showcase widget. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2024-5503

CVE-2024-5503 refers to a Local File Inclusion flaw in the WP Blog Post Layouts plugin for WordPress, affecting all versions up to 1.1.3. The vulnerability allows authenticated users with Contributor+ rights to include and execute arbitrary PHP files on the server, potentially bypassing access co...

CVE-2024-5503 WP Blog Post Layouts <= 1.1.3 - Authenticated (Contributor+) Local File Inlcusion

The WP Blog Post Layouts plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.3. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary PHP files on the server, allowing the...

Authorization Bypass

ezsystems/ez-support-tools is vulnerable to Authorization Bypass. The vulnerability is due to insufficient access controls, allowing any authenticated backend user, regardless of their assigned permissions, to view sensitive system information such as phpinfo output...

CVE-2024-4098

The Shariff Wrapper plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.6.13 via the shariff3uufetchsharecounts function. This allows unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code i...

CVE-2024-4098 Shariff Wrapper <= 4.6.13 - Unauthenticated Local File Inclusion

The Shariff Wrapper plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.6.13 via the shariff3uufetchsharecounts function. This allows unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code i...

The vulnerability of Kubernets Rancher cluster management software lies in the lack of access restrictions on protected information. This allows attackers to expose the protected data and gain administrative control over the Kubernetes cluster.

The vulnerability of Kubernets Rancher cluster management software is related to the lack of restrictions on access to protected information. Exploiting this vulnerability allows a malicious actor to disclose protected data and gain administrative control over the Kubernetes cluster...