The vulnerability in the web client of IBM Datacap Navigator software for document collection and processing allows attackers to execute cross-site scripting attacks, cache poisoning attacks, or intercept sessions. This vulnerability is related to deficiencies in HTTP request processing.

The vulnerability of the IBM Datacap Navigator web client software for document collection and processing involves shortcomings in the processing of HTTP header requests. Exploiting this vulnerability allows a malicious actor to execute cross-site scripting attacks, cache poisoning attacks, or...

Alert: HotPage Adware Disguised as Ad Blocker Installs Malicious Kernel Driver

Cybersecurity researchers have shed light on an adware module that purports to block ads and malicious websites, while stealthily offloading a kernel driver component that grants attackers the ability to run arbitrary code with elevated permissions on Windows hosts. The malware, dubbed HotPage,...

GHSA-5V69-92VW-FMJH Apache StreamPark: maven build params could trigger remote command execution

In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and...

CVE-2024-29737 Apache StreamPark (incubating): maven build params could trigger remote command execution

In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and...

CVE-2024-29737

The Apache StreamPark development and management environment is vulnerable to command injection in its Project module due to insufficient validation of input parameters during Maven compilation. Specifically, the application fails to intercept or verify the backtick (``) character. An attacker wi...

CVE-2024-29737 Apache StreamPark (incubating): maven build params could trigger remote command execution

In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and...

The vulnerability of the mechanism for transmitting information about ICMP Redirects for TP-LINK TL-7DR5130 wireless router microprogramming systems allows a hacker to intercept traffic.

The vulnerability of the mechanism for transmitting information about ICMP Redirect for TP-LINK TL-7DR5130 wireless router microprogramming systems is related to insufficient verification of the source of the communication channel. Exploiting this vulnerability allows a malicious actor to interce...

The vulnerability of the ajaxterm module in the Webmin hosting control panel allows a hacker to intercept the console session.

The vulnerability of the ajaxterm module in the Webmin hosting control panel is related to incorrect handling of permissions or privileges. Exploiting this vulnerability could allow a malicious actor, operating remotely, to intercept the console session...

The vulnerability of the SCADA system “ENTEK,” which stems from the storage of critical information in an open manner, allows a intruder to gain unauthorized access to the protected information.

The vulnerability of the SCADA system “ENTEK” is related to the storage of critical information in an open manner. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information by intercepting traffic or obtaining configuration...

CVE-2023-41093

Use After Free vulnerability in Silicon Labs Bluetooth SDK on 32 bit, ARM may allow an attacker with precise timing capabilities to intercept a small number of packets intended for a recipient that has left the network.This issue affects Silabs Bluetooth SDK: through 8.0.0...

CVE-2023-41093

Use After Free vulnerability in Silicon Labs Bluetooth SDK on 32 bit, ARM may allow an attacker with precise timing capabilities to intercept a small number of packets intended for a recipient that has left the network.This issue affects Silabs Bluetooth SDK: through 8.0.0...

CVE-2023-41093 Loss of confidentiality due to potential race condition in Bluetooth controller Connection_Handle reuse

Use After Free vulnerability in Silicon Labs Bluetooth SDK on 32 bit, ARM may allow an attacker with precise timing capabilities to intercept a small number of packets intended for a recipient that has left the network.This issue affects Silabs Bluetooth SDK: through 8.0.0...

Silicon Labs Bluetooth SDK Security Vulnerability

Silicon Labs Bluetooth SDK is a Bluetooth low energy software development kit from Silicon Labs, Inc. A security vulnerability exists in Silicon Labs Bluetooth SDK 8.0.0 and prior versions, which stems from the presence of post-release reuse and could allow an attacker with precise timing to...

CVE-2023-41093: Use After Free

Use After Free vulnerability in Silicon Labs Bluetooth SDK on 32 bit, ARM may allow an attacker with precise timing capabilities to intercept a small number of packets intended for a recipient that has left the network.This issue affects Silabs Bluetooth SDK: through 8.0.0...

http-tiny: perl: insecure TLS cert default

A vulnerability was found in Tiny, where a Perl core module and standalone CPAN package, does not verify TLS certificates by default. Users need to explicitly enable certificate verification with the verifySSL=1 flag to ensure secure HTTPS connections. This oversight can potentially expose...

CVE-2024-37830

Summary: CVE-2024-37830 affects Outline up to v0.76.1. An issue allows an attacker to redirect a victim to a malicious site by intercepting and modifying the app’s state cookie. The vulnerability is described across Red Hat, NVD, CVE listings and partner advisories, with the recommended fix being...

CVE-2024-37830

An issue in Outline = v0.76.1 allows attackers to redirect a victim user to a malicious site via intercepting and changing the state cookie...

CVE-2024-37830

An issue in Outline = v0.76.1 allows attackers to redirect a victim user to a malicious site via intercepting and changing the state cookie...

Siemens SIPROTEC

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...

CVE-2024-39699

Directus has a Blind SSRF via redirects in file import. The vulnerability arises because redirects are allowed during URL-based imports and the response URL isn’t validated, enabling requests to internal IPs (e.g., 127.0.0.1) despite earlier fixes that only validated DNS/internal IPs. The issue i...