PT-2024-12250 · Ibm · Ibm Security Access Manager

Name of the Vulnerable Software and Affected Versions: IBM Security Access Manager Docker versions 10.0.0.0 through 10.0.7.1 Description: The issue allows a local user to obtain root access due to improper access controls. Recommendations: For versions 10.0.0.0 through 10.0.7.1, update to a versi...

Quivr Code Issue Vulnerability

Quivr is an artificial intelligence application open-sourced by Quivr. A code issue vulnerability exists in Quivr version 0.0.236 that stems from the application not providing sufficient controls when crawling websites, allowing an attacker to access the application on the local network...

PT-2024-12716 · Ibm · Ibm Security Access Manager

Name of the Vulnerable Software and Affected Versions: IBM Security Access Manager Docker versions 10.0.0.0 through 10.0.7.1 Description: The issue could disclose sensitive information to a local user due to improper permission controls. Recommendations: For versions 10.0.0.0 through 10.0.7.1,...

Talya Informatics Travel APPS SQL Injection Vulnerability

Talya Informatics Travel APPS is a travel software from the Turkish company Talya Informatics. A SQL injection vulnerability exists in Talya Informatics Travel APPS prior to version v17.0.68, which stems from a vulnerability that allows an attacker to bypass authentication using misconfigured...

Talya Informatics Travel APPS Security Breach

Talya Informatics Travel APPS is a travel software from the Turkish company Talya Informatics. A security vulnerability exists in Talya Informatics Travel APPS prior to version v17.0.68, which stems from a vulnerability that allows an attacker to bypass user control key authorization using...

ROS-20240627-01

A vulnerability in the implementation of the CORS mechanism of Microsoft Edge and Google Chrome browsers is related to weaknesses in the access controls. Exploitation of the vulnerability could allow an attacker acting remotely to bypass existing security restrictions and disclose protected...

Denial Of Service (DoS)

silverstripe/framework is vulnerable to Denial Of Service DoS. The vulnerability is due to insufficient authentication controls in the dev/build system controller, which could allow unauthorized users to trigger the dev/build process and potentially causing resource exhaustion and disrupting...

Security Bulletin: IBM Security Verify Access is vulnerable to multiple Security Vulnerabilities

Summary The IBM Security Verify Access Appliance and IBM Security Verify Access Container has addressed multiple vulnerabilities in release 10.0.8.0. Vulnerability Details CVEID:CVE-2023-38371 DESCRIPTION: IBM Security Access Manager uses weaker than expected cryptographic algorithms that could...

Malicious code in Shade.WPF.Controls (NuGet)

--- -= Per source details. Do not edit below this line.=-...

CVE-2024-37742

Insecure Access Control in Safe Exam Browser SEB = 3.5.0 on Windows. The vulnerability allows an attacker to share clipboard data between the SEB kiosk mode and the underlying system, compromising exam integrity. By exploiting this flaw, an attacker can bypass exam controls and gain an unfair...

CVE-2024-38628

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uaudio: Fix race condition use of controls after free during gadget unbind. Hang on to the control IDs instead of pointers since those are correctly handled with locks...

AZL-58983 CVE-2024-38628 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uaudio: Fix race condition use of controls after free during gadget unbind. Hang on to the control IDs instead of pointers since those are correctly handled with locks...

CVE-2024-38628 usb: gadget: u_audio: Fix race condition use of controls after free during gadget unbind.

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uaudio: Fix race condition use of controls after free during gadget unbind. Hang on to the control IDs instead of pointers since those are correctly handled with locks...

CVE-2024-5455 The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.6 - Authenticated (Contributor+) Local File Inclusion

The Plus Addons for Elementor Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.5.4 via the 'magazinestyle' parameter within the Dynamic Smart Showcase widget. This makes it possible for authenticated attackers, with Contributor-level...

SUSE CVE-2024-36976

In the Linux kernel, the following vulnerability has been resolved: Revert "media: v4l2-ctrls: show all owned controls in logstatus" This reverts commit 9801b5b28c6929139d6fceeee8d739cc67bb2739. This patch introduced a potential deadlock scenario: Wed May 8 10:02:06 2024 Possible unsafe locking...

CVE-2024-5503

CVE-2024-5503 refers to a Local File Inclusion flaw in the WP Blog Post Layouts plugin for WordPress, affecting all versions up to 1.1.3. The vulnerability allows authenticated users with Contributor+ rights to include and execute arbitrary PHP files on the server, potentially bypassing access co...

CVE-2024-5503 WP Blog Post Layouts <= 1.1.3 - Authenticated (Contributor+) Local File Inlcusion

The WP Blog Post Layouts plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.3. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary PHP files on the server, allowing the...

CVE-2022-48716 ASoC: codecs: wcd938x: fix incorrect used of portid

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: wcd938x: fix incorrect used of portid Mixer controls have the channel id in mixer-reg, which is not same as port id. port id should be derived from chaninfo array. So fix this. Without this, its possible that we cou...

Authorization Bypass

ezsystems/ez-support-tools is vulnerable to Authorization Bypass. The vulnerability is due to insufficient access controls, allowing any authenticated backend user, regardless of their assigned permissions, to view sensitive system information such as phpinfo output...

CVE-2024-4098

The Shariff Wrapper plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.6.13 via the shariff3uufetchsharecounts function. This allows unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code i...