CVE-2024-21736 Missing Authorization check in SAP S/4HANA Finance (Advanced Payment Management)

SAP S/4HANA Finance for Advanced Payment Management - versions SAPSCORE 128, S4CORE 107, does not perform necessary authorization checks. A function import could be triggered allowing the attacker to create in-house bank accounts leading to low impact on the confidentiality of the application...

CVE-2023-38652

creationtimestamp| type| source ---|---|--- 2024-01-08 16:32:23+00:00| seen| https://t.me/ctinow/164466 2024-01-11 08:16:26+00:00| seen| https://t.me/ctinow/166342 2024-01-25 13:46:24+00:00| seen| https://t.me/ctinow/173438...

CVE-2023-38651

creationtimestamp| type| source ---|---|--- 2024-01-08 16:32:22+00:00| seen| https://t.me/ctinow/164465 2024-01-11 08:16:27+00:00| seen| https://t.me/ctinow/166343 2024-01-25 13:46:25+00:00| seen| https://t.me/ctinow/173439...

CVE-2023-29052

Users were able to define disclaimer texts for an upsell shop dialog that would contain script code that was not sanitized correctly. Attackers could lure victims to user accounts with malicious script code and make them execute it in the context of a trusted domain. We added sanitization for thi...

CVE-2023-41710

User-defined script code could be stored for a upsell related shop URL. This code was not correctly sanitized when adding it to DOM. Attackers could lure victims to user accounts with malicious script code and make them execute it in the context of a trusted domain. We added sanitization for this...

CVE-2023-41710

User-defined script code could be stored for a upsell related shop URL. This code was not correctly sanitized when adding it to DOM. Attackers could lure victims to user accounts with malicious script code and make them execute it in the context of a trusted domain. We added sanitization for this...

CVE-2023-29052

Users were able to define disclaimer texts for an upsell shop dialog that would contain script code that was not sanitized correctly. Attackers could lure victims to user accounts with malicious script code and make them execute it in the context of a trusted domain. We added sanitization for thi...

CVE-2024-0293

creationtimestamp| type| source ---|---|--- 2024-01-08 04:21:26+00:00| seen| https://t.me/ctinow/164199 2024-01-11 19:31:53+00:00| seen| https://t.me/ctinow/166754 2024-01-25 08:41:28+00:00| published-proof-of-concept| https://t.me/ctinow/173325...

PT-2024-1560 · Sap · Sap S/4Hana Finance For Advanced Payment Management

Name of the Vulnerable Software and Affected Versions: SAP S/4HANA Finance for Advanced Payment Management - versions SAPSCORE 128, S4CORE 107 Description: The issue is related to improper authorization checks in the SAP S/4HANA Finance for Advanced Payment Management. This could allow an attacke...

PT-2024-1495 · Bosch · Nexo-Os

Name of the Vulnerable Software and Affected Versions: NEXO-OS affected versions not specified Description: The issue allows a remote attacker to authenticate to the web application with high privileges through multiple hidden hard-coded accounts. This can enable the attacker to gain unauthorized...

Design/Logic Flaw

Insecure Permissions vulnerability in fit2cloud Cloud Explorer Lite version 1.4.1, allow local attackers to escalate privileges and obtain sensitive information via the cloud accounts parameter...

CVE-2023-50612

Insecure Permissions vulnerability in fit2cloud Cloud Explorer Lite version 1.4.1, allow local attackers to escalate privileges and obtain sensitive information via the cloud accounts parameter...

CVE-2023-50612

Insecure Permissions vulnerability in fit2cloud Cloud Explorer Lite version 1.4.1, allow local attackers to escalate privileges and obtain sensitive information via the cloud accounts parameter...

fit2cloud Cloud Explorer Lite Security Vulnerability

fit2cloud Cloud Explorer Lite is an open source lightweight cloud management platform. A security vulnerability exists in fit2cloud Cloud Explorer Lite version 1.4.1. A local attacker exploited the vulnerability to elevate privileges and obtain sensitive information via the cloud accounts paramet...

CVE-2023-52124

creationtimestamp| type| source ---|---|--- 2024-01-05 13:31:38+00:00| seen| https://t.me/ctinow/163516 2024-01-24 13:41:27+00:00| seen| https://t.me/ctinow/172760...

CVE-2023-52178

creationtimestamp| type| source ---|---|--- 2024-01-05 09:21:51+00:00| seen| https://t.me/ctinow/163437 2024-01-24 09:41:37+00:00| seen| https://t.me/ctinow/172616...

PT-2024-13947 · Fit2Cloud · Fit2Cloud Cloud Explorer Lite

Name of the Vulnerable Software and Affected Versions: fit2cloud Cloud Explorer Lite version 1.4.1 Description: The issue allows local attackers to escalate privileges and obtain sensitive information via the cloud accounts parameter. This is due to an Insecure Permissions vulnerability...

PT-2024-31918 · WordPress · Wordpress

Name of the Vulnerable Software and Affected Versions: WordPress affected versions not specified Description: A phishing scam is targeting WordPress websites, exploiting a fictitious vulnerability. The scam involves sending emails warning of a supposed vulnerability called "CVE-2024-46188 Patch"...

CVE-2023-50753

creationtimestamp| type| source ---|---|--- 2024-01-04 15:21:48+00:00| seen| https://t.me/ctinow/163047 2024-01-05 01:34:04+00:00| seen| https://t.me/cibsecurity/74416 2024-01-10 08:16:15+00:00| seen| https://t.me/ctinow/165598...

CVE-2024-0224

creationtimestamp| type| source ---|---|--- 2024-01-04 03:31:47+00:00| seen| https://t.me/ctinow/162749 2024-01-05 01:31:45+00:00| seen| https://t.me/cibsecurity/74388 2024-01-06 00:31:30+00:00| seen| https://t.me/ctinow/163779 2024-01-23 23:56:52+00:00| seen| https://t.me/ctinow/172416...