PT-2024-17503 · Google · Vertex Gemini Api

Name of the Vulnerable Software and Affected Versions: Vertex Gemini API affected versions not specified Description: A security issue exists in the Vertex Gemini API for customers using VPC-SC. By utilizing a custom crafted file URI for image input, data exfiltration is possible due to requests...

PT-2024-9529 · Unknown +1 · Wmsrepair Service +1

Name of the Vulnerable Software and Affected Versions: WmsRepair Service affected versions not specified Description: The issue is related to insufficient access restrictions in the WmsRepair Service, which can be exploited to elevate privileges. This allows an attacker to affect the system...

Ivanti Connect Secure 安全漏洞

Ivanti Connect Secure is a secure remote network connection tool from Ivanti Corporation, USA. A security vulnerability exists in Ivanti Connect Secure versions prior to 22.7R2.4 that stems from insufficient server-side controls in Secure Application Manager. An attacker can exploit the...

Schneider Electric PowerChute Serial Shutdown

GENERAL SECURITY RECOMMENDATIONS We strongly recommend the following industry cybersecurity best practices. https://www.se.com/us/en/download/document/7EN52-0390/ Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network. Install...

Schneider Electric Harmony HMI and Pro-Face HMI Products

GENERAL SECURITY RECOMMENDATIONS We strongly recommend the following industry cybersecurity best practices. https://www.se.com/us/en/download/document/7EN52-0390/ Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network. Install...

CVE-2023-51360

Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through 4.2.0...

CVE-2023-51359

Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through 4.2.0...

CVE-2023-49756

Missing Authorization vulnerability in Themewinter Eventin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eventin: from n/a through 3.3.52...

CVE-2023-47822

Missing Authorization vulnerability in Sonaar Music MP3 Audio Player for Music, Radio & Podcast by Sonaar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through 4.10...

Seven Bolt-Ons to Make Your Entra ID More Secure for Critical Sessions

Identity security is all the rage right now, and rightfully so. Securing identities that access an organization's resources is a sound security model. But IDs have their limits, and there are many use cases when a business should add other layers of security to a strong identity. And this is what...

Unauthorized Access

org.keycloak, keycloak-quarkus-server is vulnerable to Unauthorized Access. The vulnerability is due to improper access controls, allowing a high-privileged user to read sensitive information from a Vault file outside the expected context...

PT-2024-35761 · Unknown · Favorites-Web

Name of the Vulnerable Software and Affected Versions: Favorites-web version 1.3.0 Description: The issue is related to a directory traversal vulnerability in the SecurityFilter.java file. This vulnerability could potentially allow unauthorized access. Recommendations: For Favorites-web version...

Proactively Managing High-Risk Vulnerabilities with TruRisk Mitigate™

In late 2024, organizations faced over 65 million detections from three critical vulnerabilities—CVE-2013-2900, CVE-2024-38122, and CVE-2024-30078—underscoring the urgent need for proactive vulnerability management. Adding to these challenges, the Qualys Threat Research Unit TRU uncovered five...

CVE-2024-11952

The Classic Addons – WPBakery Page Builder plugin for WordPress is vulnerable to Limited Local PHP File Inclusion in all versions up to, and including, 3.0 via the 'style' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, and permissions grant...

Dell 3000cn Permissions, Privileges, and Access Controls (CVE-2006-2112)

Fuji Xerox Printing Systems FXPS print engine, as used in products including 1 Dell 3000cn through 5110cn and 2 Fuji Xerox DocuPrint firmware before 20060628 and Network Option Card firmware before 5.13, allows remote attackers to use the FTP printing interface as a proxy FTP bounce by using...

The vulnerability of the implementation of the mTLS protocol in the Keycloak software for managing identity and access control allows a perpetrator to circumvent security restrictions and gain unauthorized access to protected information.

The vulnerability of the mTLS protocol implementation in the Keycloak identity and access management software is related to a certificate authentication error. Exploiting this vulnerability could allow an attacker to circumvent security restrictions and gain unauthorized access to protected...

Meinberg NTP Permissions, Privileges, and Access Controls (CVE-2016-3989)

The NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS- LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M300, LANTIME M200, LANTIME M100, SyncFire 1100, and LCES devices with firmware before 6.20.004 allows remote authenticated users to obtain root...

Cisco Nexus 3000 and 5000 Permissions, Privileges, and Access Controls (CVE-2011-2581)

The ACL implementation in Cisco NX-OS 5.02 and 5.03 before 5.03N21 on Nexus 5000 series switches, and NX-OS before 5.03U12a on Nexus 3000 series switches, does not properly handle comments in conjunction with deny statements, which allows remote attackers to bypass intended access restrictions in...

Cisco Application Policy Infrastructure Permissions, Privileges, and Access Controls (CVE-2015-4235)

Cisco Application Policy Infrastructure Controller APIC devices with software before 1.03o and 1.1 before 1.11j and Nexus 9000 ACI devices with software before 11.04o and 11.1 before 11.11j do not properly restrict access to the APIC filesystem, which allows remote authenticated users to obtain...

Imperva Defends Against LLM Hacking

In the evolving landscape of cybersecurity, the advent of large language models LLMs has introduced a new frontier of challenges and opportunities. Research has shown advanced LLMs, such as GPT-4, now possess the ability to autonomously execute sophisticated cyberattacks, including blind database...