Vulnerabilities fixed in SAP products

SAP has fixed vulnerabilities in several products, including NetWeaver, Business Objects, HANA and SAP GUI. A malicious party can exploit the vulnerabilities to launch attacks that can lead to the following categories of damage: - Cross-Site Scripting XSS. - Denial-of-Service DoS. - Manipulation ...

Vulnerabilities fixed in Aruba Networks ArubaOS

Aruba Networks fixed vulnerabilities in ArubaOS A malicious party could exploit the vulnerabilities to launch attacks that could lead to the following categories of damage: - Denial-of-Service DoS - Manipulation of data - Remote code execution Administrator/Root privileges - Access to system data...

Unrestricted File Upload

cockpit-hq/cockpit is vulnerable to Unrestricted File Upload. The vulnerability is due to an improper file upload checks within the /media/api POST endpoint which can be exploited to compromise the system's integrity, allowing unauthorized access or data manipulation...

MariaDB 11.0.0 < 11.0.6

The version of MariaDB installed on the remote host is prior to 11.0.6. It is, therefore, affected by a vulnerability as referenced in the 11.0.6 advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Client: mysqldump. Supported versions that are affected are 8.0.36 and...

MariaDB 11.1.0 < 11.1.5

The version of MariaDB installed on the remote host is prior to 11.1.5. It is, therefore, affected by a vulnerability as referenced in the 11.1.5 advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Client: mysqldump. Supported versions that are affected are 8.0.36 and...

T-Soft E-Commerce 安全漏洞

T-Soft E-Commerce is an e-commerce software from T-Soft. A security vulnerability exists in T-Soft E-Commerce 4. An attacker exploited the vulnerability to access and manipulate the database via specially crafted requests...

Vulnerabilities fixed in Siemens products

Siemens has fixed vulnerabilities in several products including. Parasolid, Ruggedcom, SIMATIC, SICAM and Tecnomatix. The vulnerabilities potentially enable a malicious person to launch attacks execute attacks that could result in the following categories of damage: Denial-of-Service DoS...

F5 BIG-IP SQL注入漏洞

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. An OData injection vulnerability exists in F5 BIG-IP Next Central Manager, which can be exploited to send crafted SQL statemen...

CVE-2024-23551

Database scanning using username and password stores the credentials in plaintext or encoded format within files at the endpoint. This has been identified as a significant security risk. This will lead to exposure of sensitive information for unauthorized access, potentially leading to severe...

CVE-2024-23551

HCL BigFix Compliance (9.x–11.x) is affected by CVE-2024-23551 due to database scanning using a username/password that stores credentials in plaintext or encoded form on the endpoint. This can lead to unauthorized access and data exposure. Prior to a confirmed patch (not provided in the documents...

Delta Electronics DIAEnergie SQL注入漏洞

Delta Electronics DIAEnergie is an industrial energy management system from Delta Electronics, Taiwan, China. Delta Electronics DIAEnergie GetDIACloudList suffers from a SQL injection vulnerability that can be exploited by an attacker to view, add, modify, or delete information in the back-end...

mysql: Server: DML unspecified vulnerability (CPU Apr 2024)

A flaw was found in the MySQL Server product of Oracle MySQL component: Server: DML. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability ...

mysql: Server: DML unspecified vulnerability (CPU Apr 2024)

A flaw was found in the MySQL Server product of Oracle MySQL component: Server: DML. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability ...

PT-2024-25179 · Digincube · Mdgiftproduct

Name of the Vulnerable Software and Affected Versions: Digincube mdgiftproduct versions prior to 1.4.1 Description: The issue allows an attacker to run arbitrary SQL commands via the MdGiftRule::addGiftToCart method. This enables the execution of unauthorized database queries, potentially leading...

Sensitive information disclosure and manipulation due to missing authorization

...

Sensitive information disclosure and manipulation due to missing authorization

...

CVE-2023-48684: Missing Authorization

Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent Linux, macOS, Windows before build 37758, Acronis Cyber Protect 17 Linux, macOS, Windows before build 41186...

CVE-2023-37397 IBM Aspera Faspex data manipulation

IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to obtain or modify sensitive information due to improper encryption of certain data. IBM X-Force ID: 259672...

CVE-2023-37397 IBM Aspera Faspex data manipulation

IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to obtain or modify sensitive information due to improper encryption of certain data. IBM X-Force ID: 259672...

Vulnerabilities fixed in Solarwinds Platform

Solarwinds has fixed vulnerabilities in Solarwinds Platform. A malicious party can exploit the vulnerabilities to launch attacks execute attacks that can result in the following categories of damage: Cross-Site Scripting XSS. Manipulation of data Circumvention of security measure Remote code...