CVE-2024-50618

A Use of Single-factor Authentication vulnerability in the Authentication component of CIPPlanner CIPAce before 9.17 allows attackers to bypass a protection mechanism. When the system is configured to allow login with internal accounts, an attacker can possibly obtain full authentication if the...

CVE-2024-50617

CIPPlanner CIPAce versions before 9.17 are vulnerable to an access control defect in the File Download and Get File handler components. An authenticated user can exploit this by modifying the file id parameter or providing a physical file path in the URL query string to retrieve unauthorized file...

ACE SECURITY WiP-90113 访问控制错误漏洞

ACE SECURITY WiP-90113 is a camera product developed by the Japanese company ACE SECURITY. ACE SECURITY WiP-90113 has a vulnerability related to access control. This vulnerability arises from the unprotected configuration of backup endpoints, which may allow unverified attackers to retrieve...

CVE-2020-37146: Missing Authentication for Critical Function

ACE Security WiP-90113 HD Camera contains a configuration disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive configuration files. Attackers can access the camera's configuration backup by sending a GET request to the /configbackup.bin endpoint, exposing credentia...

openSUSE 15 Security Update : logback (SUSE-SU-2026:0361-1)

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:0361-1 advisory. - CVE-2026-1225: ACE vulnerability in configuration file bsc1257094 Tenable has extracted the preceding description block directly from the SUSE security...

Security update for logback

This update for logback fixes the following issues: CVE-2026-1225: ACE vulnerability in configuration file bsc1257094 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the command liste...

SUSE-SU-2026:0361-1 Security update for logback

This update for logback fixes the following issues: - CVE-2026-1225: ACE vulnerability in configuration file bsc1257094...

CVE-2026-1225: Improper Input Validation

ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java applications, allows an attacker to instantiate classes already present on the class path by compromising an existing logback configuration file. The instantiation of a potentially...

CVE-2021-27022

A flaw was discovered in bolt-server and ace where running a task with sensitive parameters results in those sensitive parameters being logged when they should not be. This issue only affects SSH/WinRM nodes inventory service nodes...

PT-2026-3646

Name of the Vulnerable Software and Affected Versions logback-core versions prior to 1.5.25 Description A configuration file processing issue exists in QOS.CH logback-core, potentially allowing an attacker to instantiate classes already present on the system's class path by manipulating a logback...

Security Bulletin: Vulnerability in ACE affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in ACE has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information. Vulnerability...

CVE-2025-56130

OS Command Injection vulnerability in Ruijie RG-S1930 S1930SWITCH3.01B11P230 allowing attackers to execute arbitrary commands via a crafted POST request to the moduleupdate in file /usr/local/lua/devconfig/acesw.lua...

CVE-2025-56130

OS Command Injection vulnerability in Ruijie RG-S1930 S1930SWITCH3.01B11P230 allowing attackers to execute arbitrary commands via a crafted POST request to the moduleupdate in file /usr/local/lua/devconfig/acesw.lua...

CVE-2025-56130

OS Command Injection vulnerability in Ruijie RG-S1930 S1930SWITCH3.01B11P230 allowing attackers to execute arbitrary commands via a crafted POST request to the moduleupdate in file /usr/local/lua/devconfig/acesw.lua...

CVE-2025-56130

The Ruijie RG-S1930 network management switch, specifically version S1930SWITCH_3.0(1)B11P230 , is vulnerable to an OS Command Injection vulnerability. The root cause is the improper handling of a specially crafted POST request sent to the module_update function within the file /usr/local/lua/dev...

CVE-2025-56130

OS Command Injection vulnerability in Ruijie RG-S1930 S1930SWITCH3.01B11P230 allowing attackers to execute arbitrary commands via a crafted POST request to the moduleupdate in file /usr/local/lua/devconfig/acesw.lua...

WordPress Ace Post Type Builder plugin unauthorized custom taxonomy removal vulnerability

WordPress Ace Post Type Builder plugin is a plugin for creating and managing Custom Post Types CustomPostTypes,CPT, which helps users to extend the content structure in WordPress with support for advanced features such as custom fields, categories and tags. WordPress Ace Post Type Builder plugin...

CVE-2020-36874: Missing Authentication for Critical Function

ACE SECURITY WIP-90113 HD cameras contain an unauthenticated configuration disclosure vulnerability in the /web/cgi-bin/hi3510/backup.cgi endpoint. The endpoint permits remote download of a compressed configuration backup without requiring authentication or authorization. The exposed backup may...

ACE SECURITY WIP-90113 访问控制错误漏洞

ACE SECURITY WIP-90113 is a high-definition camera from ACE SECURITY, Japan. The ACE SECURITY WIP-90113 suffers from an Access Control Error vulnerability that originates in the /web/cgi-bin/hi3510/backup.cgi endpoint that can remotely download a compressed configuration backup without...

CVE-2025-13405

CVE-2025-13405 affects the WordPress plugin “Ace Post Type Builder” (versions up to and including 1.9). The vulnerability is caused by missing authorization validation in the cptb_delete_custom_taxonomy() function, enabling authenticated attackers with Subscriber-level access or higher to delete ...