2912 matches found
bulwark
Инструмент управления активами и уязвимостями организации с интеграцией Jira, предназначенный для создания отчетов по безопасности приложений. Возможности Управление уязвимостями для нескольких клиентов Генерация отчетов по безопасности Интеграция с Jira Авторизация на основе ролей команд API-клю...
SecurityManageFramwork
SecurityManageFramwork-SeMF README на английском | 中文 Введение SEMF — это платформа управления безопасностью для корпоративной внутренней сети, которая включает функции управления активами, уязвимостями, учётными записями, базой знаний и автоматизацию сканирования безопасности. Может использовать...
ElectricEye
ElectricEye ElectricEye — это мультиоблачный, мультиSaaS CLI-инструмент на Python для управления активами, контроля безопасности и мониторинга поверхности атаки, поддерживающий сотни сервисов и оценок для укрепления ваших CSP и SaaS-сред, с привязкой элементов контроля к более чем 20 отраслевым,...
CVE-2020-4463
IBM Maximo Asset Management는 XXE 취약점CVE-2020-4463을 통한 정보 공개에 취약합니다. IBM Maximo Asset Management는 XML 데이터를 처리할 때 XML 외부 엔터티 주입XXE 공격에 취약합니다. 원격 공격자는 이 취약점을 악용하여 민감한 정보를 노출시키거나 메모리 리소스를 소비할 수 있습니다. 기본 점수: 8.2 벡터: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L 영향을 받는 핵심 구성 요소 IBM Maximo Asset Manageme...
IBM Maximo Asset Management Information Disclosure - XML External Entity Injection
IBM Maximo Asset Management is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. id: CVE-2020-4463 info: name: IBM Maximo Asset Management Information...
CVE-2026-18741
CVE-2026-18741 - Worksuite SaaS의 저장형 XSS 개요 CVE-2026-18741은 Worksuite SaaS 6.0.14 이전 버전에 영향을 미치는 저장형 XSS 취약점입니다. 이 문제는 자산 관리Asset Management 모듈에 위치해 있습니다. 사용자 제어 입력은 다음과 같은 필드를 통해 저장될 수 있습니다: 위치Location 설명Description 저장된 입력은 이후 영향을 받는 자산이 조회될 때 렌더링되어, 공격자가 제어하는 JavaScript가 해당 자산을 조회하는 사용자의 브라우저...
EUVD-2026-91937
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting them, allowing authenticated users with access to its asset-management feature Administrators by default, or Editors when a non-default Unlimited Elements fo...
CVE-2026-85015 Unlimited Elements For Elementor < 2.0.21 - Authenticated Arbitrary File Write via Path Traversal
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting them, allowing authenticated users with access to its asset-management feature Administrators by default, or Editors when a non-default Unlimited Elements fo...
CVE-2026-85015 Unlimited Elements For Elementor < 2.0.21 - Authenticated Arbitrary File Write via Path Traversal
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting them, allowing authenticated users with access to its asset-management feature Administrators by default, or Editors when a non-default Unlimited Elements fo...
CVE-2026-85015
The Unlimited Elements for Elementor WordPress plugin (versions before 2.0.21 ) is vulnerable to an authenticated arbitrary file write via path traversal. The flaw exists because the plugin fails to sanitize file paths within uploaded archives before extraction. This allows authenticated users wi...
CVE-2026-85015: Improper Limitation of a Pathname to a Restricted Directory
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting them, allowing authenticated users with access to its asset-management feature Administrators by default, or Editors when a non-default Unlimited Elements fo...
PT-2026-104523
Name of the Vulnerable Software and Affected Versions Unlimited Elements for Elementor WordPress plugin versions prior to 2.0.21 Description Insufficient sanitization of file paths within uploaded archives allows authenticated users with access to the asset-management feature to write arbitrary...
Security Bulletin: There are multiple security vulnerability in IBM Maximo Asset Management application
Summary There are multiple security vulnerability in IBM Maximo Asset Management application Vulnerability Details CVEID:CVE-2026-59901 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the Bzip2Decoder handler in...
CVE-2026-89089
A SQL injection vulnerability in OpenNMS Meridian and Horizon allows a low-privileged authenticated user (ROLE_USER ) to exploit the DATE_FORMAT parameter in two shipped JasperReports ("Maintenance contracts expired" and "Maintenance contracts strategy") via the reporting REST API (POST /rest/rep...
CVE-2026-89089 OpenNMS SQL injection in shipped Asset Management JasperReports via the DATE_FORMAT parameter (ROLE_USER)
A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user ROLEUSER can run the shipped, default-enabled online reports "Maintenance contracts expired" AssetManagementMaintExpired and...
CVE-2026-89089 OpenNMS SQL injection in shipped Asset Management JasperReports via the DATE_FORMAT parameter (ROLE_USER)
A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user ROLEUSER can run the shipped, default-enabled online reports "Maintenance contracts expired" AssetManagementMaintExpired and...
CVE-2026-86736
snipe-it before 8.7.0 contains an incorrect calculation vulnerability in checkout request handling that allows authenticated users to corrupt the assets.requestscounter through duplicate submissions and cancellations without active requests. Attackers can repeatedly call cancel endpoints without...
CVE-2026-84206 Snipe-IT before 8.7.0 Authorization Bypass via Bulk Restore
Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allowing users without delete rights to restore soft-deleted assets. Attackers with edit permissions can post asset identifiers to the bulk restore endpoint to undo administrator...
CVE-2026-84206
Snipe-IT before 8.7.0 contains an authorization bypass in the bulk asset restore endpoint , which is gated on the assets.edit permission instead of the intended assets.delete permission. This allows authenticated users with only edit rights to restore soft-deleted assets by posting asset identifi...
