CVE-2024-10315

CVE-2024-10315 concerns an insecure configuration in Gliffy Online. Multiple sources in the connected set confirm affected software as Gliffy Online with versions prior to 4.14.0-6. The root cause identified is an insecure configuration in these versions, as reported by Alpha Inferno PVT LTD. Acr...

CVE-2024-10315 Insecure Configuration in Gliffy Online

In Gliffy Online an insecure configuration was discovered in versions before 4.14.0-6. Reported by Alpha Inferno PVT LTD...

CVE-2024-10315 Insecure Configuration in Gliffy Online

In Gliffy Online an insecure configuration was discovered in versions before 4.14.0-6. Reported by Alpha Inferno PVT LTD...

PT-2024-16182 · Unknown · Gliffy Online

Name of the Vulnerable Software and Affected Versions: Gliffy Online versions prior to 4.14.0-6 Description: An insecure configuration was discovered in Gliffy Online. The issue was reported by Alpha Inferno PVT LTD. Recommendations: For versions prior to 4.14.0-6, update to version 4.14.0-6 or...

Perforce Gliffy 安全漏洞

Perforce Gliffy is a Perforce software for charting via HTML5 cloud-based applications. A security vulnerability exists in Perforce Gliffy versions prior to 4.14.0-6 that stems from an insecure configuration...

CLSA-2024-1729627812 Fix CVE(s): CVE-2024-8927

SECURITY UPDATE: insecure configuration vulnerability - debian/patches/CVE-2024-8927.patch: fix bypass of cgi.forceredirect configuration - CVE-2024-8927...

PT-2024-39895 · WordPress · Userpro

Name of the Vulnerable Software and Affected Versions: UserPro plugin for WordPress versions up to, and including, 3.6.0 Description: The issue is related to privilege escalation due to the insecure 'administrator' default value for the default user role option. This allows unauthenticated...

CVE-2024-45735

In Splunk Enterprise versions below 9.2.3 and 9.1.6, and Splunk Secure Gateway versions on Splunk Cloud Platform versions below 3.4.259, 3.6.17, and 3.7.0, a low-privileged user that does not hold the "admin" or "power" Splunk roles can see App Key Value Store KV Store deployment configuration an...

Cross Site Scripting(XSS)

CKEditor 5 is vulnerable to a Cross-Site Scripting XSS. The vulnerability is due to Insecure Editor Configuration and lack of Input Sanitization in the CKEditor 5 clipboard package, which allows an attacker to insert malicious content into the editor when the General HTML Support or HTML Embed...

Infinera Transcend Network Management System 安全漏洞

Infinera Transcend Network Management System Infinera TNMS is a powerful element, network, and service management system from Infinera USA. A security vulnerability exists in Infinera Transcend Network Management System version 19.10.3, which stems from an insecure default configuration of the...

CVE-2024-25659

Infinera TNMS (Transcend Network Management System) version 19.10.3 is affected by an insecure default configuration of the internal SFTP server on Linux, which can allow a remote attacker to access files and directories outside the SFTP user home directory. The CVE-2024-25659 entry notes a netwo...

CVE-2024-8258

Improper Control of Generation of Code 'Code Injection' in Electron Fuses in Logitech Options Plus version 1.60.496306 on macOS allows attackers to execute arbitrary code via insecure Electron Fuses configuration...

CVE-2024-8258 Insecure Electron Fuses in Logitech Options Plus Allowing Arbitrary Code Execution on macOS

Improper Control of Generation of Code 'Code Injection' in Electron Fuses in Logitech Options Plus version 1.60.496306 on macOS allows attackers to execute arbitrary code via insecure Electron Fuses configuration...

Xiaomi App Market 安全漏洞

Xiaomi App market is an application market software from Chinese company Xiaomi Xiaomi. A security vulnerability exists in Xiaomi App Market that stems from an insecure configuration and could allow an attacker to execute arbitrary code...

CVE-2024-41254

An issue was discovered in litestream v0.3.13. The usage of the ssh.InsecureIgnoreHostKey disables host key verification, possibly allowing attackers to obtain sensitive information via a man-in-the-middle attack...

SQL Injection

vanna-ai/vanna is vulnerable to SQL injection. The vulnerability is due to an exposed SQL query pgreadfile, which allows remote users to read arbitrary local files on the victim server, including sensitive files such as /etc/passwd. Note that this vulnerability is only exploitable due to an...

Privilege Escalation

Ant Media Server is vulnerable to Privilege Escalation. The vulnerability is caused by running Java Management Extensions JMX with authentication disabled on localhost on port 5599. This allows unprivileged users to connect locally and leverage MLet Bean within JMX to load a remote MBean from an...

Brocade SANnav versions before v2.3.0a do not correctly set permissions on files, including docker files. (CVE-2024-29964)

Brocade SANnav versions before v2.3.0a do not correctly set permissions on files, including docker files. An unprivileged attacker who gains access to the server can read sensitive information from these files...

CVE-2023-33806

Insecure default configurations in Hikvision Interactive Tablet DS-D5B86RB/B V2.3.0 build220119, allows attackers to execute arbitrary commands...

PT-2024-3291

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ versions 6.x prior to 6.1.2 Description The default configuration does not secure the API web context, leading to insecure resource initialization due to a lack of authentication. This allows remote attackers to use the Jolokia...