Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in VMware Tanzu Spring Framework [CVE-2023-20861, CVE-2023-20860]

Summary Multiple vulnerabilities in VMware Tanzu Spring Framework used by InfoSphere Information Server were addressed. CVE-2023-20861, CVE-2023-20860 Vulnerability Details CVEID:CVE-2023-20861 DESCRIPTION: VMware Tanzu Spring Framework is vulnerable to a denial of service. By sending a specially...

GHSA-3HWC-RQWP-V36Q Apache Solr can leak certain passwords due to System Property redaction logic inconsistencies

Insufficiently Protected Credentials vulnerability in Apache Solr. This issue affects Apache Solr from 6.0.0 through 8.11.2, from 9.0.0 before 9.3.0. One of the two endpoints that publishes the Solr process' Java system properties, /admin/info/properties, was only setup to hide system properties...

DEBIAN-CVE-2023-50291

Insufficiently Protected Credentials vulnerability in Apache Solr. This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.3.0. One of the two endpoints that publishes the Solr process' Java system properties, /admin/info/properties, was only setup to hide system properties...

PT-2024-13270 · Microsoft +1 · Outlook +1

Name of the Vulnerable Software and Affected Versions: Sametime affected versions not specified Description: The issue is related to a lack of clickjacking protection in the Outlook add-in. The application does not implement appropriate protections to safeguard users against clickjacking attacks...

Minimal Coming Soon – Coming Soon Page < 2.38 - Unauthenticated Maintenance Mode Bypass

Description The Minimal Coming Soon – Coming Soon Page plugin for WordPress is vulnerable to maintenance mode bypass and information disclosure in all versions up to, and including, 2.37. This is due to the plugin improperly validating the request path. This makes it possible for unauthenticated...

CVE-2024-24885

creationtimestamp| type| source ---|---|--- 2024-02-08 13:22:06+00:00| seen| https://t.me/ctinow/181362...

PT-2024-1632 · Apache · Apache Solr

Name of the Vulnerable Software and Affected Versions: Apache Solr versions 6.0.0 through 8.11.2 Apache Solr versions 9.0.0 through 9.2.x Description: The issue is related to insufficient protection of credentials in Apache Solr. One of the endpoints, "/admin/info/properties", was only set up to...

SUSE CVE-2024-24857

A race condition was found in the Linux kernel's net/bluetooth device driver in conninfomin,maxageset function. This can result in integrity overflow issue, possibly leading to bluetooth connection abnormality or denial of service...

PT-2024-40844 · Git +1 · Cras

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-double-free crash. Technical details include a crash state with functions such as handle at command and handle at command...

PT-2024-12387 · Qualcomm · Snapdragon +42

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to a Transient Denial of Service DOS in the Core when a DDR memory check is called while the DDR is not initialized. This suggests ...

PT-2024-13092 · Qualcomm · Snapdragon +117

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue involves memory corruption in video while parsing the Videoinfo, which occurs when the size of an atom is greater than the videoinfo size. The...

CVE-2024-1208

The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.2 via API. This makes it possible for unauthenticated attackers to obtain access to quiz questions...

CVE-2024-1209 LearnDash LMS <= 4.10.1 - Sensitive Information Exposure via assignments

The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.1 via direct file access due to insufficient protection of uploaded assignments. This makes it possible for unauthenticated attackers to obtain those uploads...

CVE-2024-1199

A vulnerability has been found in CodeAstro Employee Task Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file \employee-tasks-php\attendance-info.php. The manipulation of the argument atenid leads to denial of service. The...

CVE-2023-49118

OpenHarmony vulnerability CVE-2023-49118 affects v3.2.4 and earlier, where an out-of-bounds read in the Dsoftbus/OpenHarmony stack allows a local attacker to cause information leakage. The issue is documented across multiple feeds (NVD/Red Hat/EUVD) and is associated with OpenHarmony’s local-atta...

CVE-2023-50935

creationtimestamp| type| source ---|---|--- 2024-02-02 03:21:53+00:00| seen| https://t.me/ctinow/177892...

Remote code execution

Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution RCE vulnerability via the setNetworkCardInfo function...

PT-2024-19639 · Eyoucms · Eyoucms

Name of the Vulnerable Software and Affected Versions: eyoucms version 1.6.5 Description: A Cross Site Scripting XSS issue exists in the is water parameter, allowing a remote attacker to execute arbitrary code via a crafted URL. This enables the attacker to potentially steal user data or take...

PT-2024-14019 · Ibm · Ibm Powersc

Name of the Vulnerable Software and Affected Versions: IBM PowerSC versions 1.3 through 2.1 Description: The issue allows an authenticated user to impersonate another user on the system because sessions are not invalidated after logout. Recommendations: For IBM PowerSC versions 1.3 through 2.1,...

xorg-x11-server: heap buffer overflow in XISendDeviceHierarchyEvent

A flaw was found in X.Org server. In the XISendDeviceHierarchyEvent function, it is possible to exceed the allocated array length when certain new device IDs are added to the xXIHierarchyInfo struct. This can trigger a heap buffer overflow condition, which may lead to an application crash or remo...