Atlassian Jira Service Management Data Center and Server 5.4.x < 5.4.28 / 5.12.x < 5.12.15 / 5.17.x < 5.17.4 / 10.0.x < 10.1.1 XSS (JSDSERVER-15689)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-15689 advisory. - DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It has be...

USN-7192-1: xfpt vulnerability

It was discovered that xfpt did not properly manage memory under certain circumstances. If a user were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause the application to crash or execute arbitrary code...

CVE-2024-21695

creationtimestamp| type| source ---|---|--- 2025-01-01 00:16:14+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lenbtzeme32i...

CVE-2020-9211

creationtimestamp| type| source ---|---|--- 2024-12-27 10:15:49+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lebqzmjtnv2o 2024-12-27 11:48:39+00:00| seen| https://t.me/cvedetector/13729...

Apache Hive and Spark: CookieSigner exposes the correct signature when message verification fails

Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps prevent malicious actors from modifying the cookie value, which can lead to security vulnerabilities and exploitation. Apache Hive’s servic...

BIT-NODE-MIN-2023-30590

The generateKeys API function returned from crypto.createDiffieHellman only generates missing or outdated keys, that is, it only generates a private key if none has been set yet, but the function is also needed to compute the corresponding public key after calling setPrivateKey. However, the...

CVE-2024-28146

CVE-2024-28146 affects Image Access Scan2Net software. The issue arises from hard-coded credentials used to (1) encrypt configuration files during backups, (2) decrypt firmware during updates, and (3) passwords that allow a direct connection to the device’s database server. Public records from mu...

CVE-2024-28140

CVE-2024-28140 describes a vulnerability in the Image Access Scan2Net scanner software where the device boots into kiosk mode and opens the Scan2Net interface in a browser window that runs with root privileges, with several other applications also running as root. The issue is evidenced by proces...

CVE-2024-8540

Insecure permissions in Ivanti Sentry before versions 9.20.2 and 10.0.2 or 10.1.0 allow a local authenticated attacker to modify sensitive application components...

CVE-2024-54198 Information Disclosure vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP

In certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote Function Call RFC request to restricted destinations, which can be used to expose credentials for a remote service. These credentials can then be further exploited to completely...

CVE-2024-12057

User credentials login & password are inserted into log files when a user tries to authenticate using a version of a Web client that is not compatible with that of the PcVue Web back end. By exploiting this vulnerability, an attacker could retrieve the credentials of a user by accessing the Log...

CVE-2024-54136 Untrusted Deserialization in ClipBucket-v5 Version 5.5.1 Revision 199 and Below

ClipBucket V5 provides open source video hosting with PHP. ClipBucket-v5 Version 5.5.1 Revision 199 and below is vulnerable to PHP Deserialization vulnerability. The vulnerability exists in upload/upload.php where the user supplied input via collection get parameter is directly provided to...

CVE-2024-10774

Unauthenticated CROWN APIs allow access to critical functions. This leads to the accessibility of large parts of the web application without authentication...

CVE-2024-10774 SICK InspectorP61x and SICK InspectorP62x have unauthenticated CROWN APIs

Unauthenticated CROWN APIs allow access to critical functions. This leads to the accessibility of large parts of the web application without authentication...

CVE-2024-10774

Affected products: SICK InspectorP61x and InspectorP62x (industrial 2D vision sensors). Root cause: unauthenticated CROWN APIs that expose critical functionality. Impact: enables access to large parts of the web application without authentication (potential confidentiality, integrity, and availab...

CVE-2024-12123 Unauthorized Modification of Ticket Requester

A hidden field manipulation vulnerability was identified in Issuetrak version 17.1 that could be triggered by an authenticated user. When an authenticated user submits a ticket, the request can be intercepted and subsequently modified by using a proxy. The ticket requester can be changed from the...

CVE-2024-53990 AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. When making any HTTP request, the automatically enabled and self-managed CookieStore aka cookie jar will silently replace explicitly defined Cookies with any that ha...

CVE-2024-11696

The application failed to account for exceptions thrown by the loadManifestFromFile method during add-on signature verification. This flaw, triggered by an invalid or unsupported extension manifest, could have caused runtime errors that disrupted the signature validation process. As a result, the...

CVE-2024-11696

The application failed to account for exceptions thrown by the loadManifestFromFile method during add-on signature verification. This flaw, triggered by an invalid or unsupported extension manifest, could have caused runtime errors that disrupted the signature validation process. As a result, the...

CVE-2024-11696

CVE-2024-11696 describes an Unhandled Exception in Add-on Signature Verification due to how loadManifestFromFile handles invalid/unsupported extension manifests, potentially bypassing enforcement of signature validation for unrelated Firefox/Thunderbird add-ons. Affected software and versions per...