Ivanti Connect Secure and Policy Secure Command Injection Vulnerability

Ivanti Connect Secure ICS, formerly known as Pulse Connect Secure and Ivanti Policy Secure contain a command injection vulnerability in the web components of these products, which can allow an authenticated administrator to send crafted requests to execute code on affected appliances. This...

Vulnerabilities fixed in IBM DB2

IBM has fixed vulnerabilities in several DB2 products such as DB2, DB2 for Cloud Pak and Web Query for i. A malicious party could exploit the exploit the vulnerabilities to grant himself locally elevated privileges assigned arbitrary code and thus execute arbitrary code with potentially privilege...

Malicious code in paytm-common-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 17a3cc5106fdbcfdb7b5fcf3fc077142981c268b775e90e73b33fb15d200bb80 The OpenSSF Package Analysis project identified 'paytm-common-components' @ 9.0.1 npm as malicious. It is considered malicious because: - The...

MAL-2024-32 Malicious code in paytm-common-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 17a3cc5106fdbcfdb7b5fcf3fc077142981c268b775e90e73b33fb15d200bb80 The OpenSSF Package Analysis project identified 'paytm-common-components' @ 9.0.1 npm as malicious. It is considered malicious because: - The...

The vulnerability of the UMC software product management components, including Opcenter Quality, SIMATIC PCS neo, SINUMERIK Integrate RunMyHMI/Automotive, Totally Integrated Automation Portal (TIA Portal), allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the UMC software product management components, including Opcenter Quality, SIMATIC PCS neo, SINUMERIK Integrate RunMyHMI/Automotive, Totally Integrated Automation Portal TIA Portal, is related to the use of an unauthorized intermediate policy file. Exploiting this...

PT-2024-18986 · View · View

Name of the Vulnerable Software and Affected Versions: view component versions prior to 3.9.0 and 2.83.0 Description: The view component framework for Ruby on Rails has a cross-site scripting issue that can impact anyone rendering a component directly from a controller with the view component gem...

Security Bulletin: IBM Security QRadar Analyst Workflow app for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that might be identified and exploited with automated tools. IBM has addressed the vulnerabilities. Vulnerability Details CVEID:CVE-2023-29827 DESCRIPTION: Node.js ejs module could allow a remote authenticated attacker t...

MAL-2024-24 Malicious code in airslate-core-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c21f5962b915c0b031edeb72b4f1d9025ac43bfbbf6be787ea90cba1e1e8fedc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in airslate-core-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c21f5962b915c0b031edeb72b4f1d9025ac43bfbbf6be787ea90cba1e1e8fedc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mw-common-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ab85f947099773c7e6dd5b4c3abd115db9beee7e407c87916ef282f8992ac845 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-50711

vmm-sys-util is a collection of modules that provides helpers and utilities used by multiple rust-vmm components. Starting in version 0.5.0 and prior to version 0.12.0, an issue in the FamStructWrapper::deserialize implementation provided by the crate for vmmsysutil::fam::FamStructWrapper can lea...

Malicious code in @serenity-web/components-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8c85633dc6373fe7b73c4d82c80a69e7b0997938dc620a25e7c74df66cf91257 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CLSA-2023-1703611617 Fix CVE(s): CVE-2023-45539

SECURITY UPDATE: Accepting '' as part of the URI component might allow remote attackers to obtain sensitive information or have unspecified other impact - debian/patches/CVE-2023-45539.patch: h1: do not accept '' as part of the URI component; h2: reject more chars from the :path pseudo header -...

CLSA-2023-1703183093 haproxy: Fix of CVE-2023-45539

CVE-2023-45539: do not accept '' as part of the URI component...

CLSA-2023-1703181305 haproxy: Fix of CVE-2023-45539

CVE-2023-45539: h1: do not accept '' as part of the URI component; h2: reject more chars from the :path pseudo header...

Sql injection

SQL Injection vulnerability in components/tablemanager/html/editadmintable.php in CuppaCMS V1.0 allows attackers to run arbitrary SQL commands via the table parameter...

CLSA-2023-1703008559 Fix CVE(s): CVE-2023-45539

SECURITY UPDATE: Accepting '' as part of the URI component might allow remote attackers to obtain sensitive information or have unspecified other impact - debian/patches/CVE-2023-45539.patch: h1: do not accept '' as part of the URI component; h2: reject more chars from the :path pseudo header -...

CVE-2023-48488 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting DOM-based XSS vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the...

Ubuntu 22.04 LTS / 23.04 / 23.10 : Budgie Extras vulnerabilities (USN-6556-1)

The remote Ubuntu 22.04 LTS / 23.04 / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6556-1 advisory. It was discovered that Budgie Extras incorrectly handled certain temporary file paths. An attacker could possibly use this issue to injec...

CVE-2023-49345

Temporary data passed between application components by Budgie Extras Takeabreak applet could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may pre-create and control this file to present false...