CVE-2025-0060

CVE-2025-0060 relates to SAP BusinessObjects BI Platform. The provided documents describe a vulnerability where an authenticated user with restricted access can inject malicious JavaScript code, enabling reading of sensitive information from the server and exfiltration to an attacker. The attacke...

CVE-2024-10492

CVE-2024-10492 in Keycloak enables a high-privilege user to read a Vault file outside the expected context by leveraging a crafted Vault read file after gaining prior high access (e.g., via LDAP provider configuration). The issue phrasing across connected advisories confirms this path-traversal-l...

CVE-2024-10492

A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file that is not within the expected context. This attacker must have previous high access to the Keycloak server in order to perform resource creation, for example, an LDAP provider...

RHEL 7 : postgresql (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - postgresql: Memory disclosure in aggregate function calls CVE-2023-5868 - A flaw was found in PostgreSQL...

CVE-2023-38052

CVE-2023-38052 describes a BOLA vulnerability in the EasyAppointments API where GET, PUT, DELETE /admins/{adminId} endpoints permit a low-privileged user to fetch, modify, or delete a high-privileged admin, leading to unauthorized access and data manipulation. Multiple sources associate this with...

BIT-KIBANA-2024-23443

A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading a maliciously crafted osquery pack...

BIT-ELK-2024-23443

A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading a maliciously crafted osquery pack...

CVE-2024-23443

A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading a maliciously crafted osquery pack...

CVE-2024-23443

A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading a maliciously crafted osquery pack...

CVE-2024-23443

A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading a maliciously crafted osquery pack...

CVE-2024-23443

Summary (CVE-2024-23443) A high-privileged user who can create custom osquery packs could cause Kibana downtime by uploading a maliciously crafted osquery pack, impacting availability. The issue is described across multiple sources as affecting Kibana (versions around 7.x before 7.17.22 or 8.x be...

CVE-2024-23443

A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading a maliciously crafted osquery pack...

CVE-2024-29004

The SolarWinds Platform was determined to be affected by a stored cross-site scripting vulnerability affecting the web console. A high-privileged user and user interaction is required to exploit this vulnerability...

CVE-2024-29004

The SolarWinds Platform was determined to be affected by a stored cross-site scripting vulnerability affecting the web console. A high-privileged user and user interaction is required to exploit this vulnerability...

CVE-2024-29004 SolarWinds Platform Stored XSS Vulnerability

The SolarWinds Platform was determined to be affected by a stored cross-site scripting vulnerability affecting the web console. A high-privileged user and user interaction is required to exploit this vulnerability...

CVE-2024-29851

CVE-2024-29851 affects Veeam Backup Enterprise Manager. A high-privilege user could steal the NTLM hash of the Enterprise Manager service account (if not Local System). The issue is mitigated by upgrading to Veeam Backup Enterprise Manager 12.1.2.172, after which the vulnerabilities were fixed; d...

CVE-2024-29852

Veeam Backup Enterprise Manager (VBEM) is affected by CVE-2024-29852, where high-privilege users can read backup session logs. The issue is addressed in VBEM version 12.1.2.172 (bundled with Veeam Backup & Replication 12.1.2.172). VBEM is optional; environments without VBEM installed are not impa...

PT-2024-4022 · Ivanti · Ivanti Connect Secure

Name of the Vulnerable Software and Affected Versions: Ivanti Connect Secure versions 9.x through 9.x Ivanti Connect Secure versions 22.x through 22.x Description: The issue is related to a CRLF Injection vulnerability. This vulnerability can be exploited by a remote attacker using specially...

CVE-2024-29000

The SolarWinds Platform was determined to be affected by a reflected cross-site scripting vulnerability affecting the web console. A high-privileged user and user interaction is required to exploit this vulnerability...

CVE-2024-29000 SolarWinds Platform Reflected XSS Vulnerability

The SolarWinds Platform was determined to be affected by a reflected cross-site scripting vulnerability affecting the web console. A high-privileged user and user interaction is required to exploit this vulnerability...