4006 matches found
CVE-2024-47922
CVE-2024-47922 pertains to Priority ERP (Priority Israel) with an information disclosure vulnerability in versions prior to 24.1. The root cause is exposure of sensitive information to unauthorized actors (CWE-200). Impact is information disclosure; no exploitation details are provided in the doc...
CVE-2024-11364 Rockwell Automation Third Party Vulnerability in Arena®
Another “uninitialized variable” code execution vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to craft a DOE file and force the software to access a variable prior to it being initialized. If exploited, a threat actor could leverage this vulnerability to...
CVE-2024-11364
CVE-2024-11364 concerns Rockwell Automation Arena Simulation. The issue is a vulnerability in the parsing of DOE files where an uninitialized variable/memory can be accessed, enabling arbitrary code execution. Exploitation requires some form of user interaction (e.g., opening a malicious DOE file...
CVE-2024-11364 Rockwell Automation Third Party Vulnerability in Arena®
Another “uninitialized variable” code execution vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to craft a DOE file and force the software to access a variable prior to it being initialized. If exploited, a threat actor could leverage this vulnerability to...
CVE-2024-12175
CVE-2024-12175 concerns Rockwell Automation Arena—specifically a use-after-free vulnerability in DOE file parsing that can allow code execution. The flaw occurs when the software processes a crafted DOE file, causing the program to operate on an already-used resource. Exploitation requires a legi...
CVE-2024-12175 Rockwell Automation Code Execution Vulnerability in Arena
Another “use after free” code execution vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to craft a DOE file and force the software to use a resource that was already used. If exploited, a threat actor could leverage this vulnerability to execute arbitrary...
CVE-2024-11157 Rockwell Automation Third Party Vulnerability in Arena
A third-party vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to write beyond the boundaries of allocated memory in a DOE file. If exploited, a threat actor could leverage this vulnerability to execute arbitrary code. To exploit this vulnerability, a...
BIT-ELASTICSEARCH-2024-12539 Elasticsearch Incorrect Authorization
An issue was discovered where improper authorization controls affected certain queries that could allow a malicious actor to circumvent Document Level Security in Elasticsearch and get access to documents that their roles would normally not allow...
APT29 Hackers Target High-Value Victims Using Rogue RDP Servers and PyRDP
The Russia-linked APT29 threat actor has been observed repurposing a legitimate red teaming attack methodology as part of cyber attacks leveraging malicious Remote Desktop Protocol RDP configuration files. The activity, which has targeted governments and armed forces, think tanks, academic...
CVE-2024-12670
CVE-2024-12670 describes a heap-based overflow in Autodesk Navisworks when parsing DWFX files. The issue allows a malicious DWFX to cause a crash, read sensitive data, or execute arbitrary code in the current process, with local access and user interaction required. Connected sources (NVD/Red Hat...
CVE-2024-12669 DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software
A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can be used to cause a Heap-based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process...
CVE-2024-11422 DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software
A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force an Out-of-Bounds Write vulnerability. A malicious actor can leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process...
PT-2024-9980
Name of the Vulnerable Software and Affected Versions: Autodesk Navisworks Freedom affected versions not specified Autodesk Navisworks Simulate affected versions not specified Autodesk Navisworks Manage affected versions not specified Description: The issue is related to a Heap-based Overflow...
Careto is back: what’s new after 10 years of silence?
During the first week of October, Kaspersky took part in the 34th Virus Bulletin International Conference, one of the longest-running cybersecurity events. There, our researchers delivered multiple presentations, and one of our talks focused on newly observed activities by the Careto threat actor...
CVE-2024-12564 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ODA CDE inWEB SDK before 2025.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability was discovered in Open Design Alliance CDE inWEB SDK before 2025.3. Installing CDE Server with default settings allows unauthorized users to visit prometheus metrics page. This can allow attackers to understand more things...
CVE-2024-54008
An authenticated Remote Code Execution RCE vulnerability exists in the AirWave CLI. Successful exploitation of this vulnerability could allow a remote authenticated threat actor to run arbitrary commands as a privileged user on the underlying host...
CVE-2024-54008
CVE-2024-54008 describes an authenticated Remote Code Execution (RCE) in the AirWave CLI, allowing a remote authenticated threat actor to execute arbitrary commands as a privileged user on the underlying host. Affected software is HPE Aruba Networking AirWave Management Platform. The available so...
CVE-2024-54008 Authenticated Remote Code Execution (RCE) in HPE Aruba Networking AirWave Management Platform
An authenticated Remote Code Execution RCE vulnerability exists in the AirWave CLI. Successful exploitation of this vulnerability could allow a remote authenticated threat actor to run arbitrary commands as a privileged user on the underlying host...
CVE-2024-11268
A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Read. A malicious actor can leverage this vulnerability to cause a crash or could lead to an arbitrary memory leak...
