CVE-2024-43176

IBM OpenPages 9.0 could allow an authenticated user to obtain sensitive information such as configurations that should only be available to privileged users...

CVE-2024-43176

IBM OpenPages 9.0 could allow an authenticated user to obtain sensitive information such as configurations that should only be available to privileged users...

Security Bulletin: IBM OpenPages vulnerable to exposure of sensitive information through improper authorization controls on APIs. (CVE-2024-43176)

Summary A vulnerability caused by improper authorization checks could allow an authenticated user to obtain sensitive information such as configurations that should only be available to privileged users. Vulnerability Details CVEID:CVE-2024-43176 DESCRIPTION: IBM OpenPages could allow an...

CVE-2024-54676

CVE-2024-54676 affects Apache OpenMeetings (2.1.0 up to 8.0.0, multiple entries across feeds). The issue is deserialization of untrusted data in cluster mode due to clustering instructions not specifying OpenJPA white/blacklists. Affected users are advised to upgrade to OpenMeetings 8.0.0 and to ...

CVE-2024-54676 Apache OpenMeetings: Deserialisation of untrusted data in cluster mode

Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.1.0 before 8.0.0 Description: Default clustering instructions at https://openmeetings.apache.org/Clustering.html doesn't specify white/black lists for OpenJPA this leads to possible deserialisation of untrusted...

GoCD 代码问题漏洞

GoCD is an open source continuous delivery server from GoCD. A code issue vulnerability exists in GoCD versions prior to 24.5.0 that stems from allowing abuse of the ability to edit raw XML configurations, which triggers an XML External Entity XXE injection vulnerability...

CVE-2025-22275

iTerm2 3.5.6 through 3.5.10 before 3.5.11 sometimes allows remote attackers to obtain sensitive information from terminal commands by reading the /tmp/framer.txt file. This can occur for certain it2ssh and SSH Integration configurations, during remote logins to hosts that have a common Python...

PT-2025-1447 · Repute Infosystems · Armember Premium

Name of the Vulnerable Software and Affected Versions: Repute InfoSystems ARMember Premium versions prior to 5.9.2 Description: The issue is related to a missing authorization vulnerability in Repute InfoSystems ARMember Premium, which allows exploiting incorrectly configured access control...

CLSA-2024-1735311149 openssl: Fix of CVE-2024-2511

CVE-2024-2511: Fix an issue where some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions...

DEBIAN-CVE-2024-53197

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices A bogus device can provide a bNumConfigurations value that exceeds the initial value used in usbgetconfiguration for allocating dev-config. This can...

Securing Cloud Environments Against Potential Extortion Threats

Introduction With the growing reliance on cloud infrastructure, organizations must be vigilant against potential extortion threats targeting misconfigurations and weak access controls. Unfortunately, extortion threats are a huge problem. According to the Verizon 2024 Data Breach Investigations...

CVE-2024-54662

The Dante proxy server (versions 1.4.0 through 1.4.3 ) is affected by a vulnerability involving incorrect access control for specific sockd.conf configurations related to socksmethod . This deficiency in the authentication mechanism allows a malicious actor to circumvent existing security restric...

Apache Tomcat 11.0.0.M1 < 11.0.2 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 11.0.2. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat11.0.2security-11 advisory. - Time-of-check Time-of-use TOCTOU Race Condition vulnerability during JSP compilation in Apache Tomcat...

SUSE SLES12 Security Update : docker (SUSE-SU-2024:4319-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:4319-1 advisory. - Update docker-buildx to v0.19.2. See upstream changelog online at . Some notable changelogs from the last update: - Add a new toggle file...

CVE-2024-54662

Dante 1.4.0 through 1.4.3 fixed in 1.4.4 has incorrect access control for some sockd.conf configurations involving socksmethod...

CVE-2024-55951

Metabase is an open-source data analytics platform. For new sandboxing configurations created in 1.52.0 till 1.52.2.4, sandboxed users are able to see field filter values from other sandboxed users. This is fixed in 1.52.2.5. Users on 1.52.0 or 1.52.1 or 1.5.2 should upgrade to 1.52.2.5. There ar...

CVE-2024-55951

CVE-2024-55951 (Metabase) affects Metabase 1.52.x prior to 1.52.2.5, where sandboxed users could view field filter values from other sandboxed users. Root cause: sandbox isolation flaw in new sandboxing configurations created between 1.52.0 and 1.52.2.4. Impact: information disclosure within sand...

CVE-2024-55951: Exposure of Sensitive Information to an Unauthorized Actor

Metabase is an open-source data analytics platform. For new sandboxing configurations created in 1.52.0 till 1.52.2.4, sandboxed users are able to see field filter values from other sandboxed users. This is fixed in 1.52.2.5. Users on 1.52.0 or 1.52.1 or 1.5.2 should upgrade to 1.52.2.5. There ar...

PT-2024-36397

Name of the Vulnerable Software and Affected Versions Dante versions 1.4.0 through 1.4.3 Description The issue is related to incorrect access control for some sockd.conf configurations involving the socksmethod. This problem affects certain settings and can lead to unauthorized access...

CBL Mariner 2.0 Security Update: kernel (CVE-2024-50182)

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-50182 advisory. - In the Linux kernel, the following vulnerability has been resolved: secretmem: disable memfdsecret if arch...