CVE-2024-42493

CVE-2024-42493 affects Dorsett Controls InfoScan. The vulnerability is an exposure/leak of sensitive information via response headers and pre-login JavaScript in InfoScan versions prior to 1.38 (notably v1.32/v1.33/v1.35). Red Hat and ICS advisories corroborate exploitation risk and classify the ...

Dorsett Controls InfoScan

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 6.9 ATTENTION : Exploitable remotely/low attack complexity Vendor : Dorsett Controls Equipment : InfoScan Vulnerabilities : Exposure of Sensitive Information To An Unauthorized Actor, Path Traversal 2. RISK EVALUATION Successful exploitation of these...

Dorsett Controls InfoScan 信息泄露漏洞

Dorsett Controls InfoScan is an industrial information scanner from Dorsett Controls, USA. An information disclosure vulnerability exists in Dorsett Controls InfoScan versions 1.32, 1.33, and 1.35, which originates from an unprotected file containing passwords and API keys, resulting in an...

PT-2024-28421

Name of the Vulnerable Software and Affected Versions Dorsett Controls Central Server affected versions not specified Description The issue concerns a potential information leak due to an unprotected file containing passwords and API keys on the update server. Recommendations At the moment, there...

CVE-2024-39287: Exposure of Sensitive Information to an Unauthorized Actor

Dorsett Controls Central Server update server has potential information leaks with an unprotected file that contains passwords and API keys...

CVE-2024-42493: Exposure of Sensitive Information to an Unauthorized Actor

Dorsett Controls InfoScan is vulnerable due to a leak of possible sensitive information through the response headers and the rendered JavaScript prior to user login...

CVE-2024-41912

A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The firmware flaw does not properly implement access controls...

CVE-2024-41912

A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The firmware flaw does not properly implement access controls...

CVE-2024-41912

Poly Clariti Manager firmware builds up to 10.10.2.2 are affected by a flaw that fails to properly enforce access controls, potentially enabling unauthorized access. Affected product/versions: Poly Clariti Manager devices up to 10.10.2.2. Root cause: firmware-level access-control flaw (per multip...

CVE-2024-41912

A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The firmware flaw does not properly implement access controls...

Apple's New macOS Sequoia Tightens Gatekeeper Controls to Block Unauthorized Software

Apple on Tuesday announced an update to its next-generation macOS version that makes it a little more difficult for users to override Gatekeeper protections. Gatekeeper is a crucial line of defense built into macOS designed to ensure that only trusted apps run on the operating system. When an app...

CVE-2024-36132

Insufficient verification of authentication controls in EPMM prior to 12.1.0.1 allows a remote attacker to bypass authentication and access sensitive resources...

CVE-2024-36132

Ivanti Endpoint Manager for Mobile (EPMM) before 12.1.0.1 exposes an authentication-control verification weakness that allows a remote attacker to bypass authentication and access sensitive resources. Affected product/version: EPMM prior to 12.1.0.1. Root cause: insufficient verification of authe...

PT-2024-29322 · Unknown · Kashipara Responsive School Management System

Name of the Vulnerable Software and Affected Versions: Kashipara Responsive School Management System version 3.2.0 Description: An Incorrect Access Control issue was found in the /smsa/view class.php endpoint, allowing remote unauthenticated attackers to view class details. This could lead to...

The vulnerability of the log_ctrl() function in the Linux operating system’s video driver allows a hacker to cause a service failure.

The vulnerability of the logctrl function in the drivers/media/v4l2-core/v4l2-ctrls-core.c file, a video driver for the Linux operating system, is related to mutual locking of execution threads. Exploiting this vulnerability could allow an attacker to cause a service failure...

Vestaboard: Exploring Broken Access Controls and Privilege Escalation

The post Vestaboard: Exploring Broken Access Controls and Privilege Escalation appeared first on Rhino Security Labs...

CVE-2024-5709 WPBakery <= 7.7 - Authenticated (Author+) Local File Inclusion

The WPBakery Visual Composer plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.7 via the 'layoutname' parameter. This makes it possible for authenticated attackers, with Author-level access and above, and with post permissions granted by an...

CVE-2024-5709 WPBakery <= 7.7 - Authenticated (Author+) Local File Inclusion

The WPBakery Visual Composer plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.7 via the 'layoutname' parameter. This makes it possible for authenticated attackers, with Author-level access and above, and with post permissions granted by an...

CVE-2024-40530: Incorrect Authorization

A vulnerability in Pantera CRM versions 401.152 and 402.072 allows unauthorized attackers to bypass IP-based access controls by manipulating the X-Forwarded-For header...

Clariti Manager – Privilege Escalation Through Sudo

A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The firmware flaw does not properly implement access controls. The recommendation is to update an impacted device to firmware build 10.12.0.2100 or later. Customers will receive the latest build...