CVE-2025-0060

CVE-2025-0060 relates to SAP BusinessObjects BI Platform. The provided documents describe a vulnerability where an authenticated user with restricted access can inject malicious JavaScript code, enabling reading of sensitive information from the server and exfiltration to an attacker. The attacke...

CVE-2024-10492

CVE-2024-10492 in Keycloak enables a high-privilege user to read a Vault file outside the expected context by leveraging a crafted Vault read file after gaining prior high access (e.g., via LDAP provider configuration). The issue phrasing across connected advisories confirms this path-traversal-l...

CVE-2024-10492

A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file that is not within the expected context. This attacker must have previous high access to the Keycloak server in order to perform resource creation, for example, an LDAP provider...

RHEL 7 : postgresql (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - postgresql: Memory disclosure in aggregate function calls CVE-2023-5868 - A flaw was found in PostgreSQL...

CVE-2024-5902: Improper Neutralization of Input During Web Page Generation

The User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the name parameter in all versions up to, and including, 1.0.15 due to insufficient input sanitization and output escaping. This makes it...

CVE-2023-38052

CVE-2023-38052 describes a BOLA vulnerability in the EasyAppointments API where GET, PUT, DELETE /admins/{adminId} endpoints permit a low-privileged user to fetch, modify, or delete a high-privileged admin, leading to unauthorized access and data manipulation. Multiple sources associate this with...

BIT-KIBANA-2024-23443

A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading a maliciously crafted osquery pack...

BIT-ELK-2024-23443

A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading a maliciously crafted osquery pack...

CVE-2024-23443

A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading a maliciously crafted osquery pack...

CVE-2024-23443

Summary (CVE-2024-23443) A high-privileged user who can create custom osquery packs could cause Kibana downtime by uploading a maliciously crafted osquery pack, impacting availability. The issue is described across multiple sources as affecting Kibana (versions around 7.x before 7.17.22 or 8.x be...

CVE-2024-23443

A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading a maliciously crafted osquery pack...

CVE-2024-23443

A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading a maliciously crafted osquery pack...

CVE-2024-23443

A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading a maliciously crafted osquery pack...

CVE-2024-28020: Incorrect User Management

A user/password reuse vulnerability exists in the FOXMAN-UN/UNEM application and server management. If exploited a malicious high-privileged user could use the passwords and login information through complex routines to extend access on the server and other services...

CVE-2024-29004

The SolarWinds Platform was determined to be affected by a stored cross-site scripting vulnerability affecting the web console. A high-privileged user and user interaction is required to exploit this vulnerability...

CVE-2024-29004

The SolarWinds Platform was determined to be affected by a stored cross-site scripting vulnerability affecting the web console. A high-privileged user and user interaction is required to exploit this vulnerability...

CVE-2024-29004 SolarWinds Platform Stored XSS Vulnerability

The SolarWinds Platform was determined to be affected by a stored cross-site scripting vulnerability affecting the web console. A high-privileged user and user interaction is required to exploit this vulnerability...

CVE-2024-29004: Improper Neutralization of Input During Web Page Generation

The SolarWinds Platform was determined to be affected by a stored cross-site scripting vulnerability affecting the web console. A high-privileged user and user interaction is required to exploit this vulnerability...

CVE-2023-38551: Improper Neutralization of CRLF Sequences

A CRLF Injection vulnerability in Ivanti Connect Secure 9.x, 22.x allows an authenticated high-privileged user to inject malicious code on a victim’s browser, thereby leading to cross-site scripting attack...

CVE-2024-29851

CVE-2024-29851 affects Veeam Backup Enterprise Manager. A high-privilege user could steal the NTLM hash of the Enterprise Manager service account (if not Local System). The issue is mitigated by upgrading to Veeam Backup Enterprise Manager 12.1.2.172, after which the vulnerabilities were fixed; d...