CVE-2023-26052 Saleor is vulnerable to unauthenticated information disclosure via Python exceptions

Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences. Some internal Python exceptions are not handled properly and thus are returned in API as error messages. Some messages might contain sensitive information like infrastructure details in unauthenticated...

CVE-2023-26052 Saleor is vulnerable to unauthenticated information disclosure via Python exceptions

Saleor is a headless, GraphQL commerce platform delivering personalized shopping experiences. Some internal Python exceptions are not handled properly and thus are returned in API as error messages. Some messages might contain sensitive information like infrastructure details in unauthenticated...

CVE-2023-26052

CVE-2023-26052 affects Saleor, a headless GraphQL commerce platform. The issue is unauthenticated information disclosure caused by internal Python exceptions not being properly handled, which can leak sensitive infrastructure details via API error messages. Affected versions were fixed in 3.1.48,...

SysUpdate Malware Strikes Again with Linux Version and New Evasion Tactics

The threat actor known as Lucky Mouse has developed a Linux version of a malware toolkit called SysUpdate, expanding on its ability to target devices running the operating system. The oldest version of the updated artifact dates back to July 2022, with the malware incorporating new features...

CVE-2023-22738 Improper Preservation of Permissions in vantage6

vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Assigning existing users to a different organizations is currently possible. It may lead to unintended access: if a user from organization A is accidentally assigned to organization B, they will retain...

CVE-2023-22738

CVE-2023-22738 affects vantage6, a privacy-preserving federated learning infrastructure. The issue is improper preservation of permissions when assigning existing users to different organizations, enabling possible access to resources they should not reach. The description consistently notes this...

CVE-2022-39228

CVE-2022-39228 affects vantage6, a privacy-preserving federated learning infrastructure. The issue is an information-disclosure bug where the system does not clearly reveal whether a username exists when credentials are entered, enabling a potential username enumeration risk. The vulnerability is...

CVE-2022-39228 Observable Response Discrepancy in vantage6

vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. vantage6 does not inform the user of wrong username/password combination if the username actually exists. This is an attempt to prevent bots from obtaining usernames. However, if a wrong password is...

Cisco Prime Infrastructure and Evolved Programmable Network Manager Stored Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network EPN Manager could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface on an affected device. This...

CVE-2023-20069

A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network EPN Manager could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface on an affected device. This...

File and Directory Permissions Vulnerability in Hitachi Automation Director, Hitachi Infrastructure Analytics Advisor, Hitachi Ops Center

Overview A File and Directory Permissions Vulnerability CVE-2020-36652 exists in Hitachi Automation Director, Hitachi Infrastructure Analytics Advisor, Hitachi Ops Center. Impact Regarding the impact of the vulnerability, please refer to the vendor advisory. Solution Please refer to the 'Vendor...

The vulnerability of the Aviatrix Controller software, a cloud infrastructure management tool, arises from the existence of interpretation conflicts, allowing an attacker to execute arbitrary code.

The vulnerability of the Aviatrix Controller software management platform for cloud infrastructure is related to the occurrence of interpretation conflicts. Exploiting this vulnerability allows a remote attacker to execute arbitrary code using a specially created file...

PT-2023-2108 · Cisco · Cisco Evolved Programmable Network (Epn) Manager +1

Name of the Vulnerable Software and Affected Versions: Cisco Prime Infrastructure affected versions not specified Cisco Evolved Programmable Network EPN Manager affected versions not specified Description: A vulnerability in the web-based management interface could allow an authenticated, remote...

Mitsubishi Electric MELSEC iQ-F Series (Update B)

1. EXECUTIVE SUMMARY CVSS v3 8.6 ATTENTION: Exploitable remotely/low attack complexity Vendor: Mitsubishi Electric Equipment: MELSEC iQ-F Series Vulnerabilities: Improper Input Validation 2. UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled ICSA-22-139-01...

CISA Red Team Shares Key Findings to Improve Monitoring and Hardening of Networks

Actions to take today to harden your local environment: 1. Establish a security baseline of normal network activity; tune network and host-based appliances to detect anomalous behavior. 2. Conduct regular assessments to ensure appropriate procedures are created and can be followed by security sta...

CVE-2020-36652

Incorrect Default Permissions vulnerability in Hitachi Automation Director on Linux, Hitachi Infrastructure Analytics Advisor on Linux Hitachi Infrastructure Analytics Advisor, Analytics probe server components, Hitachi Ops Center Automator on Linux, Hitachi Ops Center Analyzer on Linux Hitachi O...

Input validation

Improper Certificate Validation vulnerability in Hitachi Infrastructure Analytics Advisor on Linux Analytics probe component, Hitachi Ops Center Analyzer on Linux Analyzer probe component allows Man in the Middle Attack.This issue affects Hitachi Infrastructure Analytics Advisor: from 2.0.0-00...

CVE-2020-36652 File and Directory Permissions Vulnerability in Hitachi Automation Director, Hitachi Infrastructure Analytics Advisor, Hitachi Ops Center

Incorrect Default Permissions vulnerability in Hitachi Automation Director on Linux, Hitachi Infrastructure Analytics Advisor on Linux Hitachi Infrastructure Analytics Advisor, Analytics probe server components, Hitachi Ops Center Automator on Linux, Hitachi Ops Center Analyzer on Linux Hitachi O...

CVE-2020-36652

CVE-2020-36652 is an Incorrect Default Permissions issue affecting Hitachi Automation Director (Linux) versions 8.2.0-00 through 10.6.1-00, Hitachi Infrastructure Analytics Advisor (Linux) 2.0.0-00 through 4.0.0-00, Hitachi Ops Center Automator prior to 10.9.1-00, Hitachi Ops Center Analyzer prio...

CVE-2020-36652 File and Directory Permissions Vulnerability in Hitachi Automation Director, Hitachi Infrastructure Analytics Advisor, Hitachi Ops Center

Incorrect Default Permissions vulnerability in Hitachi Automation Director on Linux, Hitachi Infrastructure Analytics Advisor on Linux Hitachi Infrastructure Analytics Advisor, Analytics probe server components, Hitachi Ops Center Automator on Linux, Hitachi Ops Center Analyzer on Linux Hitachi O...