EUVD-2023-37415

Malicious code in bioql PyPI...

CVE-2023-49565

The cbismanager Podman container is vulnerable to remote command execution via the /api/plugins endpoint. Improper sanitization of the HTTP Headers X-FILENAME, X-PAGE, and X-FIELD allows for command injection. These headers are directly utilized within the subprocess.Popen Python function without...

CVE-2023-49565 Remote Code Execution

The cbismanager Podman container is vulnerable to remote command execution via the /api/plugins endpoint. Improper sanitization of the HTTP Headers X-FILENAME, X-PAGE, and X-FIELD allows for command injection. These headers are directly utilized within the subprocess.Popen Python function without...

CVE-2023-49564 Authentication Bypass

The CBIS/NCS Manager API is vulnerable to an authentication bypass. By sending a specially crafted HTTP header, an unauthenticated user can gain unauthorized access to API functions. This flaw allows attackers to reach restricted or sensitive endpoints of the HTTP API without providing any valid...

PT-2025-38296

Name of the Vulnerable Software and Affected Versions CBIS/NCS Manager affected versions not specified Description The CBIS/NCS Manager API is susceptible to an authentication bypass. An unauthenticated user can gain unauthorized access to API functions by sending a specially crafted HTTP header...

CVE-2023-33247

Talend Data Catalog remote harvesting server before 8.0-20230413 contains a /upgrade endpoint that allows an unauthenticated WAR file to be deployed on the server. A mitigation is that the remote harvesting server should be behind a firewall that only allows access to the Talend Data Catalog serv...

DRUPAL-CONTRIB-2025-028

This module enables users to log in using a short access code instead of providing a username/password combination. The module doesn't sufficiently protect against brute force attacks to guess a user's access code. This vulnerability is mitigated by the fact that access code based logins are off ...

OMRON NJ/NX series vulnerable to insufficient verification of data authenticity

Overview Machine Automation Controller NJ/NX series provided by OMRON Corporation contain an issue with insufficient verification of data authenticity CWE-345. OMRON Corporation reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. Impact If a user program in the...

Debian DSA-5544-1 : zookeeper - security update

The remote Debian 11 / 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5544 advisory. Damien Diederen discovered that SASL quorum peer authentication within Zookeeper, a service for maintaining configuration information, was insufficiently enforced in...

DEBIAN-CVE-2023-44981

Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. If SASL Quorum Peer authentication is enabled in ZooKeeper quorum.auth.enableSasl=true, the authorization is done by verifying that the instance part in SASL authentication ID is listed in zoo.cfg server list. The...

DoS via SAML configuration in Guardian/CMC before 22.6.2

Summary An authenticated administrator can upload a SAML configuration file with the wrong format, with the application not checking the correct file format. Every subsequent application request will return an error. Impact The whole application in rendered unusable until a console intervention...

CVE-2023-33247

Talend Data Catalog remote harvesting server before 8.0-20230413 contains a /upgrade endpoint that allows an unauthenticated WAR file to be deployed on the server. A mitigation is that the remote harvesting server should be behind a firewall that only allows access to the Talend Data Catalog serv...

CVE-2023-33247

Talend Data Catalog remote harvesting server before 8.0-20230413 contains a /upgrade endpoint that allows an unauthenticated WAR file to be deployed on the server. A mitigation is that the remote harvesting server should be behind a firewall that only allows access to the Talend Data Catalog serv...

Command Injection in Zingbox Inspector

A security vulnerability exists in the Zingbox Inspector that could allow an attacker to supply an invalid software update image to the Zingbox Inspector that could result in command injection. Ref: CVE-2019-15020 The vulnerability allows for an attacker in a position to intercept a software upda...

SSH Service Exposed in Zingbox Inspector

The SSH service is enabled on the Zingbox Inspector, exposing SSH to the local network. When combined with PAN-SA-2019-0027, this can allow an attacker to authenticate to the service using hardcoded credentials. Ref: CVE-2019-15017 The vulnerability allows for users to authenticate to the softwar...

Insecure Firmware Validation in Zingbox Inspector

A security vulnerability exists in the Zingbox Inspector that could allow an attacker to supply an invalid software update image to the Zingbox Inspector. Ref: CVE-2019-15019 The vulnerability allows for an attacker in a position to intercept a software update package to deliver a tampered softwa...

High-Severity Flaws Patched in Schneider Electric Products

Schneider Electric has released fixes for a slew of vulnerabilities that can be exploited remotely in two of its industrial control system products. The two flaws, which exist in Schneider Electric’s power management system, PowerLogic PM5560, and its programmable logic controller, Modicon M221,...

KLA10870 Multiple vulnerabilities in Microsoft Windows

Multiple serious vulnerabilities have been found in Windows. Malicious users can exploit these vulnerabilities to cause denial of service. execute arbitrary code, obtain sensitive information or gain privileges. Below is a complete list of vulnerabilities 1. An improper memory objects handling ca...

TIBCO Security Advisory: December 14, 2010 - TIBCOActiveMatrix®

TIBCO ActiveMatrix® vulnerability Original release date: Dec 14,2010 Last revised: -- CVE-2010-4495 Source: TIBCO Software Inc. TIBCO ActiveMatrix vulnerability Original release date: Dec 14, 2010 Last revised: -- Source: TIBCO Software Inc. Systems Affected TIBCO ActiveMatrix Service Grid versio...

iDefense Security Advisory 07.28.08: Hewlett-Packard OVIS Probe Builder Arbitrary Process Termination Vulnerability

iDefense Security Advisory 07.28.08 http://labs.idefense.com/intelligence/vulnerabilities/ Jul 28, 2008 I. BACKGROUND Hewlett-Packard's Internet Services provides end-user emulation of major business applications and a single integrated view of the Internet infrastructure. For more information,...