2549 matches found
CVE-2022-26112 Pinot query endpoint and the realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support
In 0.10.0 or older versions of Apache Pinot, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support. In order to avoid this, we disabled the groovy function support by default from Pinot release 0.11.0. See...
CVE-2022-26112 Pinot query endpoint and the realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support
In 0.10.0 or older versions of Apache Pinot, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support. In order to avoid this, we disabled the groovy function support by default from Pinot release 0.11.0. See...
7 Ways Good Data Security Practices Drive Data Governance
As more organizations continue with digital transformation plans, their ability to be good stewards of the data for which they are responsible becomes more difficult. They are generating more data, more data types, in more repositories, in more and different architectures. Every day, organization...
5 Steps for Dealing With Unknown Environments in InsightVM
Trying to deal with a large network can be difficult. All too often, engineers and admins don't know the full scope of their environment and have trouble defining the actual subnets and the systems that exist on those subnets. They know of a couple /24 subnets here or there, but it's very possibl...
The vulnerability of the Command Line Interface (CLI) of the deployment and application management automation tool in Docker-enabled environments allows a attacker to obtain arbitrary credentials.
The vulnerability of the Command Line Interface CLI of the deployment and application management tool in Docker-enabled environments is related to insufficient protection of registration data. Exploiting this vulnerability can allow an attacker, operating remotely, to obtain arbitrary user...
Use After Free in vim/vim
...
Moderate: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.3.12 security updates and bug fixes
Red Hat Advanced Cluster Management for Kubernetes 2.3.12 General Availability release images, which provide security updates and bug fixes. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a...
CVE-2022-37953
An HTTP response splitting vulnerability exists in the AM Gateway Challenge-Response dialog of WorkstationST v07.09.15 and could allow an attacker to compromise a victim's browser/session. WorkstationST is only deployed in specific, controlled environments rendering attack complexity significantl...
CVE-2022-37952
A reflected cross-site scripting XSS vulnerability exists in the iHistorian Data Display of WorkstationST v07.09.15 could allow an attacker to compromise a victim's browser. WorkstationST is only deployed in specific, controlled environments rendering attack complexity significantly higher than i...
CVE-2022-37953 WorkstationST - Response Splitting in AM Gateway Challenge-Response
An HTTP response splitting vulnerability exists in the AM Gateway Challenge-Response dialog of WorkstationST v07.09.15 and could allow an attacker to compromise a victim's browser/session. WorkstationST is only deployed in specific, controlled environments rendering attack complexity significantl...
PT-2022-23204 · Blue Prism · Blue Prism Enterprise
Name of the Vulnerable Software and Affected Versions: Blue Prism Enterprise versions 6.0 through 7.01 Description: An issue allows an authenticated user to reverse engineer the software and circumvent access controls for the setValidationInfo administrative function in a misconfigured environmen...
MagicWeb: NOBELIUM’s post-compromise trick to authenticate as anyone
Updated August 26, 2022: Added instructions to enable collection of AD FS event logs in order to search for Event ID 501, and added a new resource for AD FS audit logging in Microsoft Sentinel. Microsoft security researchers have discovered a post-compromise capability we’re calling MagicWeb, whi...
Enable Security Teams to Leverage Machine Learning Technologies
As on-premises and cloud-hosted data repositories get larger, they are outstripping the ability of traditional data-crunching methods to efficiently analyze the information. As a result, more enterprises have turned to data science and machine learning platforms to create business value. The...
RTLS Systems Found Vulnerable to MiTM Attacks and Location Tampering
Researchers have disclosed multiple vulnerabilities impacting Ultra-wideband UWB Real-time Locating Systems RTLS, enabling threat actors to launch adversary-in-the-middle AitM attacks and tamper with location data. "The zero-days found specifically pose a security risk for workers in industrial...
Siklu MultiHaul TG Series 安全漏洞
The Siklu MultiHaul TG Series is a series of wireless transmission devices from Siklu designed to provide a reliable high-speed data transmission solution, especially for fixed wireless access and connectivity needs in dense urban environments. A security vulnerability exists in the Siklu MultiHa...
Siklu MultiHaul TG Series 安全漏洞
The Siklu MultiHaul TG Series is a series of wireless transmission devices from Siklu designed to provide reliable, high-speed data transmission solutions, especially for fixed wireless access and connectivity needs in dense urban environments. A security vulnerability exists in the Siklu MultiHa...
CVE-2022-37061
All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are vulnerable to Remote Command Injection. This can be exploited to inject and execute arbitrary shell commands as the root user through the id HTTP POST parameter in the res.php endpoint. A successful exploit could allow th...
Three Keys to Turning Data-centric Security Theory into Practice
Most cybersecurity professionals agree that as more organizations move data and applications to cloud-hosted environments, traditional measures focusing on protecting IT infrastructures are not up to the task. In fact, according to Crowd Research Partners, 84 percent of organizations say...
vulhub
This is an offensive tool repository for testing and demonstrating vulnerabilities in various software and systems. The repository is maintained by Vulhub, a community-driven project that aims to provide a comprehensive collection of vulnerable environments for testing and learning purposes. The...
