2707 matches found
CVE-2024-28799: Invocation of Process Using Visible Sensitive Information
IBM QRadar Suite Software 1.10.12.0 through 1.10.23.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 displays sensitive data improperly to a local privileged user, in non default configurations, during back-end commands which may result in the unexpected disclosure of this information...
WordPress Waitlist Woocommerce ( Back in stock notifier ) Plugin <= 2.6 is vulnerable to Broken Access Control
Software Waitlist Woocommerce Back in stock notifier Type Plugin Vulnerable versions = 2.6 Fixed in 2.6.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-43134 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 01b4cf6b7218 Credits Abd...
[SECURITY] Fedora 40 Update: bind-dyndb-ldap-11.10-29.fc40
This package provides an LDAP back-end plug-in for BIND. It features support for dynamic updates and internal caching, to lift the load off of your LDAP server...
Security Bulletin: A vulnerability in Npgsql affects IBM Robotic Process Automation and may result in incorrect back end database access (CVE-2024-32655)
Summary A vulnerability in Npgsql affects IBM Robotic Process Automation and may result in incorrect back end database access. Ngpsql is used by IBM Robotic Process Automation for database access. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability...
CVE-2024-41053 scsi: ufs: core: Fix ufshcd_abort_one racing issue
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix ufshcdabortone racing issue When ufshcdabortone is racing with the completion ISR, the completed tag of the request's mqhctx pointer will be set to NULL by ISR. Return success when request is completed by ISR...
CVE-2024-40689
IBM InfoSphere Information Server 11.7 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database. IBM X-Force ID: 297719...
IBM InfoSphere Information Server SQL注入漏洞
IBM InfoSphere Information Server is a set of data integration platforms from International Business Machines IBM. The platform can be used to integrate data information obtained from various sources. IBM InfoSphere Information Server version 11.7 suffers from a SQL injection vulnerability that...
CVE-2024-40689: Improper Neutralization of Special Elements used in an SQL Command
IBM InfoSphere Information Server 11.7 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database. IBM X-Force ID: 297719...
CVE-2024-36111: Improper Restriction of Security Token Assignment
KubePi is a K8s panel. Starting in version 1.6.3 and prior to version 1.8.0, there is a defect in the KubePi JWT token verification. The JWT key in the default configuration file is empty. Although a random 32-bit string will be generated to overwrite the key in the configuration file when the ke...
Apache Superset SQL Injection Vulnerability (CNVD-2024-35190)
Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. Apache Superset suffers from a SQL injection vulnerability that can be exploited by an attacker to view, add, modify, or delete information in the back-end database...
hw: amd: INVD instruction may lead to a loss of SEV-ES guest machine memory integrity problem
A flaw was found in some of AMD CPU's due to improper or unexpected behavior of the INVD. This issue may allow an attacker with a malicious hypervisor to affect cache line write-back behavior of the CPU, potentially leading to a loss of guest virtual machine VM memory integrity...
CVE-2024-6326: Improper Privilege Management
An exposure of sensitive information vulnerability exists in the Rockwell Automation FactoryTalk® System Service. A malicious user could exploit this vulnerability by starting a back-up or restore process, which temporarily exposes private keys, passwords, pre-shared keys, and database folders wh...
Apache Superset 安全漏洞
Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. Apache Superset suffers from a SQL injection vulnerability that can be exploited by an attacker to view, add, modify, or delete information in the back-end database...
vaeThink Security Vulnerabilities
vaeThink is a software application. Based on ThinkPHP5 and Layui, while keeping the core concept of rapid development and simplicity, vaeThink provides basic development and encapsulation of functions necessary for general projects, helping users to quickly complete the basic functions when...
CVE-2024-39118
Mommy Heather Advanced Backups up to v3.5.3 allows attackers to write arbitrary files via restoring a crafted back up...
GHSA-VC7J-99JW-JRQM aimeos/ai-admin-graphql improper access control vulnerability allows an editor to modify admin account
aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.01 and prior to versions 2022.10.10, 2023.10.6, and 2024.04.6, an improper access control vulnerability allows an editor to modify and take over an admin account in the back end. Versions 2022.10.10,...
aimeos/ai-admin-graphql improper access control vulnerability allows an editor to modify admin account
aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.01 and prior to versions 2022.10.10, 2023.10.6, and 2024.04.6, an improper access control vulnerability allows an editor to modify and take over an admin account in the back end. Versions 2022.10.10,...
Malicious code in Be.Vlaanderen.Basisregіsters.RoadRegistrу.BackOffice.ZiрArchiveWrіters (NuGet)
--- -= Per source details. Do not edit below this line.=-...