NI VeriStand IFileTransferServer Exposed Dangerous Method Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of NI VeriStand. Authentication is not required to exploit this vulnerability. The specific flaw exists within the IFileTransferServer component. The issue results from an exposed dangerous...

CVE-2024-6922: Automation Anywhere Automation 360 Server-Side Request Forgery

Automation 360 Robotic Process Automation suite v21-v32 is vulnerable to unauthenticated Server-Side Request Forgery SSRF. SSRF occurs when the server can be induced to perform arbitrary requests on behalf of an attacker. An attacker with unauthenticated access to the Automation 360 Control Room...

Ongoing Cyberattack Targets Exposed Selenium Grid Services for Crypto Mining

Cybersecurity researchers are sounding the alarm over an ongoing campaign that's leveraging internet-exposed Selenium Grid services for illicit cryptocurrency mining. Cloud security firm Wiz is tracking the activity under the name SeleniumGreed. The campaign, which is targeting older versions of...

CVE-2024-41668

The cBioPortal for Cancer Genomics provides visualization, analysis, and download of large-scale cancer genomics data sets. When running a publicly exposed proxy endpoint without authentication, cBioPortal could allow someone to perform a Server Side Request Forgery SSRF attack. Logged in users...

Mexico’s Largest ERP Provider ClickBalance Exposes 769 Million Records

ClickBalance ERP providers cloud database exposed 769 million records, including API keys and email addresses. Learn how this…...

SUSE CVE-2024-40647

sentry-sdk is the official Python SDK for Sentry.io. A bug in Sentry's Python SDK 2.8.0 allows the environment variables to be passed to subprocesses despite the env= setting. In Python's subprocess calls, all environment variables are passed to subprocesses by default. However, if you specifical...

SolarWinds Access Rights Manager ChangeHumster Exposed Dangerous Method Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of SolarWinds Access Rights Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ChangeHumster class. The issue results from an exposed dangerous...

PT-2024-40950 · Deno · Deno

Name of the Vulnerable Software and Affected Versions: Deno affected versions not specified Description: The issue arises from the exposure of Deno.core.ops.op panic to the JS runtime in the base core, which can trigger a manual panic in the thread containing the runtime when called...

PT-2024-40948 · Deno · Deno

Name of the Vulnerable Software and Affected Versions: Deno affected versions not specified Description: The issue arises from the exposure of Deno.core.ops.op panic to the JS runtime in the base core, which can trigger a manual panic in the thread containing the runtime. This breaks sandboxing,...

SolarWinds Access Rights Manager EndUpdate Exposed Dangerous Method Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Access Rights Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the EndUpdate method. The issue results from an exposed dangerous metho...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File when utilizing multiple Eureka server service URLs with basic auth and encountering an issue with fetching the service registry. An attacker can gain access to credentials by examining th...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File when utilizing multiple Eureka server service URLs with basic auth and encountering an issue with fetching the service registry. An attacker can gain access to credentials by examining th...

The vulnerability of the database management module of the Apache Linkis connectivity, management, and orchestration application allows a hacker to disclose protected information.

The vulnerability of the database management module of the Apache Linkis connectivity, management, and orchestration software relates to the use of files and directories accessible from external parties. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information...

PT-2024-5575 · Pimcore · Pimcore Admin Classic Bundle

Name of the Vulnerable Software and Affected Versions: Pimcore Admin Classic Bundle versions prior to 1.3.10 Pimcore Admin Classic Bundle versions prior to 1.4.6 Pimcore Admin Classic Bundle versions prior to 1.5.2 Description: Navigating to "/admin/index/statistics" with a logged in Pimcore user...

PT-2024-37367 · WordPress · Wp-Cart-For-Digital-Products

Name of the Vulnerable Software and Affected Versions: wp-cart-for-digital-products versions prior to 8.5.5 Description: The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitised and escaped before being outputted back in the page. This could be...

Unspecified Vulnerability in JetBrains TeamCity

JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. The tool provides continuous unit testing, code quality analysis and build problem analysis reports and other features. JetBrains TeamCity suffers from a security...

MAL-2024-7366 Malicious code in @zitterorg/rem-optio (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 12251ace5b8c1069cc484f512bbd1e31fe2cc3cfb90fa2bfd47b5d2687d2274b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7093 Malicious code in auth0-authz-extension (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9ddc031877d6efc19470df3d757e067cb9fd38974fd69be4140e854f2ca69840 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

JetBrains TeamCity 安全漏洞

JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. The tool provides continuous unit testing, code quality analysis and build problem analysis reports and other features. JetBrains TeamCity suffers from a security...

CVE-2024-35137

Summary of CVE-2024-35137 : IBM Security Access Manager Docker versions 10.0.0.0–10.0.7.1 have an information-disclosure weakness where sensitive configuration information is exposed, enabling a local user to potentially elevate privileges. The issue is corroborated by multiple sources (IBM X-For...