CVE-2024-39934

Robotmk before 2.0.1 allows a local user to escalate privileges e.g., to SYSTEM if automated Python environment setup is enabled, because the "shared holotree usage" feature allows any user to edit any Python environment...

PT-2025-47890

A sensitive information disclosure vulnerability exists in the error handling component of ATISoluciones CIGES Application version 2.15.6 and earlier. When certain unexpected conditions trigger unhandled exceptions, the application returns detailed error messages and stack traces to the client...

EUVD-2022-2593

Malicious code in bioql PyPI...

CVE-2023-24959

IBM InfoSphere Information Systems 11.7 could expose information about the host system and environment configuration. IBM X-Force ID: 246332...

Ensure That a User Has Its Own Home Directory

Each user must have its own home directory for storing user-related data. The owner of the home directory must be the user. If the owner of the home directory is not the user, the user cannot read or write the home directory, or the user data stored in the home directory can be read or tampered...

GHSA-J59V-VGCR-HXVF GeoServer's Server Status shows sensitive environmental variables and Java properties

GeoServer's Server Status page and REST API at /geoserver/rest/about/status lists all environment variables and Java properties to any GeoServer user with administrative rights as part of those modules' status message. These variables/properties can also contain sensitive information, such as...

Ivanti Endpoint Manager Security Vulnerability

Ivanti Endpoint Manager EPM is a suite of endpoint security managers from Ivanti Corporation, USA. A security vulnerability exists in Ivanti Endpoint Manager versions 11.11, 11.10, and 11.9 and earlier, which stems from a vulnerability that allows a threat actor with knowledge of the identifier o...

CVE-2023-24959

IBM InfoSphere Information Systems 11.7 could expose information about the host system and environment configuration. IBM X-Force ID: 246332...

CVE-2023-24959

IBM InfoSphere Information Systems 11.7 could expose information about the host system and environment configuration. IBM X-Force ID: 246332...

CVE-2023-24959 IBM InfoSphere Information Server information disclosure

IBM InfoSphere Information Systems 11.7 could expose information about the host system and environment configuration. IBM X-Force ID: 246332...

SUSE CVE-2023-31414

Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw. An attacker with write access to Kibana yaml or env configuration could add a specific payload that will attempt to execute JavaScript code. This could lead to the attacker executing arbitrary commands on the host syste...

SUSE CVE-2018-8014

The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their...

Magento 2 Community Edition Insufficient Access Controls

Insufficient enforcement of user access controls in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could enable a low-privileged user to make unauthorized environment configuration changes...

PT-2021-23928 · Redash · Redash

Name of the Vulnerable Software and Affected Versions: Redash versions 10.0 and prior Description: Redash is a package for data visualization and sharing. The implementation of URL-loading data sources like JSON, CSV, or Excel in versions 10.0 and prior is vulnerable to advanced methods of Server...

Engel & Völkers Technology GmbH: Information disclosure via Spring Boot Actuators on gonext-stage.engelvoelkers.com

Summary: The Spring Boot Actuators are exposing critical information on gonext-stage.engelvoelkers.com such as the last 100 HTTP requests made to the server including cookies, paths, etc and the environment configuration. The endpoints are the following: - /trace - /env - /mappings - /configprops...

Authorization Bypass

magento/community-edition is vulnerable to authorization bypass. The vulnerability exists as a low-privileged user to make unauthorized environment configuration changes...

Design/Logic Flaw

Insufficient enforcement of user access controls in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could enable a low-privileged user to make unauthorized environment configuration changes...

CVE-2019-7904

CVE-2019-7904 affects Magento versions prior to 2.1.18, 2.2 prior to 2.2.9, and 2.3 prior to 2.3.2, where a low-privileged user could make unauthorized environment configuration changes due to insufficient enforcement of user access controls. Public references indicate a security update exists: M...

Magento Access Control Error Vulnerability

Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions. A security vulnerability exists in Magento versions 2.1.18 before 2.1, 2.2.9 before 2.2, and 2.3.2 before 2.3. Th...

The use of DVRF learn firmware analysis series a-vulnerability warning-the black bar safety net

With a variety of hardware devices vulnerabilities more and more people concern, as well as by a malicious attacker a large advantage. As a Security Researcher, Learning Analytics firmware vulnerability, a timely warning to patch vulnerabilities is becoming increasingly important. This series of...