419 matches found
CVE-2024-2905
A security vulnerability has been discovered within rpm-ostree, pertaining to the /etc/shadow file in default builds having the world-readable bit enabled. This issue arises from the default permissions being set at a higher level than recommended, potentially exposing sensitive authentication da...
CVE-2024-2905
A security vulnerability has been discovered within rpm-ostree, pertaining to the /etc/shadow file in default builds having the world-readable bit enabled. This issue arises from the default permissions being set at a higher level than recommended, potentially exposing sensitive authentication da...
CVE-2024-2905
CVE-2024-2905 affects rpm-ostree where default builds expose a world-readable /etc/shadow. Multiple Nessus advisories (RHEL 9, AlmaLinux 9, Oracle Linux 9, MiracleLinux, Fedora) reference the issue and indicate patches/backports to a fixed rpm-ostree release (e.g., versions >= 2024.4-3 or rela...
The vulnerability of the Windows Telephony Server server allows attackers to increase their privileges.
The vulnerability of the Windows Telephony Server server for Windows operating systems is related to the use of unsafe mechanisms for processing authentication data in the operating system’s memory. Exploiting this vulnerability can allow an attacker to increase their privileges...
CVE-2024-2905
A security vulnerability has been discovered within rpm-ostree, pertaining to the /etc/shadow file in default builds having the world-readable bit enabled. This issue arises from the default permissions being set at a higher level than recommended, potentially exposing sensitive authentication da...
openEuler 安全漏洞
openEuler is an operating system from the Open Atomics Open Source Foundation. A security vulnerability exists in openEuler rpm-ostree, which stems from the default permissions being set at a higher level than recommended, potentially exposing sensitive authentication data to unauthorized access...
PT-2024-4622 · Microsoft · Windows
Name of the Vulnerable Software and Affected Versions: Microsoft Windows affected versions not specified Description: The issue is related to the use of insecure mechanisms for handling authentication data in the operating system's memory. It allows an attacker to elevate their privileges...
PT-2024-5018 · Unknown +2 · Rpm-Ostree +2
Name of the Vulnerable Software and Affected Versions: rpm-ostree affected versions not specified Description: A security issue has been found in rpm-ostree, related to the /etc/shadow file having the world-readable bit enabled in default builds. This is due to default permissions being set highe...
PT-2024-3911 · Unknown · Netcat Cms
Name of the Vulnerable Software and Affected Versions: Netcat CMS affected versions not specified Description: The issue is related to a cross-site request forgery CSRF vulnerability. It allows a remote attacker to exploit the vulnerability, potentially enabling them to set arbitrary authenticati...
The vulnerability of the Microsoft Message Queuing (MSMQ) queue service on Windows operating systems allows a hacker to execute arbitrary code.
The vulnerability of the Microsoft Message Queuing MSMQ queue service on Windows operating systems is related to the use of unsafe mechanisms for processing authentication data in the operating system’s memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...
Bosch Nexo cordless nutrunner security breach
Bosch Nexo Cordless nutrunner is a series of cordless tightening wrenches with integrated controls from Bosch Germany. A security vulnerability exists in Bosch Nexo cordless nutrunner. The vulnerability allows an authenticated, remote attacker to read or update arbitrary content in the...
CVE-2023-5879
Users’ product account authentication data was stored in clear text in The Genie Company Aladdin Connect Mobile Application Version 5.65 Build 2075 and below on Android Devices. This allows the attacker, with access to the android device, to potentially retrieve users' clear text authentication...
CVE-2023-5879
Users’ product account authentication data was stored in clear text in The Genie Company Aladdin Connect Mobile Application Version 5.65 Build 2075 and below on Android Devices. This allows the attacker, with access to the android device, to potentially retrieve users' clear text authentication...
CVE-2023-40610
Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2. Using the default examples database connection that allows access to both the examples schema and Apache Superset's metadata database, an attacker using a specially crafted CTE SQL stateme...
CVE-2023-40610 Apache Superset: Privilege escalation with default examples database
Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2. Using the default examples database connection that allows access to both the examples schema and Apache Superset's metadata database, an attacker using a specially crafted CTE SQL stateme...
Apache Superset 安全漏洞
Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. An authorization issue vulnerability exists in Apache Superset versions prior to 2.1.2 that stems from the presence of incorrect authorization checks. An attacker could exploit this vulnerability...
The vulnerability of the SerializationTypeConverter class in the Microsoft Exchange Server mail server allows attackers to perform spoofing attacks.
The vulnerability of the SerializationTypeConverter class in Microsoft Exchange Server lies in the deserialization mechanism’s flaws, resulting from insufficient protection of service data during NTLM authentication. Exploiting this vulnerability allows an attacker to perform spoofing attacks...
CVE-2023-20886
VMware Workspace ONE UEM console contains an open redirect vulnerability. A malicious actor may be able to redirect a victim to an attacker and retrieve their SAML response to login as the victim user...
Exim Security Vulnerabilities
Exim is an open source messaging agent MTA running on Unix systems that routes, forwards, and delivers mail. A security vulnerability exists in Exim that stems from Exim incorrectly processing user-supplied authentication data, resulting in memory corruption...
CERT-UA Reports: 11 Ukrainian Telecom Providers Hit by Cyberattacks
The Computer Emergency Response Team of Ukraine CERT-UA has revealed that threat actors "interfered" with at least 11 telecommunication service providers in the country between May and September 2023. The agency is tracking the activity under the name UAC-0165, stating the intrusions led to servi...