CVE-2024-37178 Cross-Site Scripting (XSS) vulnerabilities in SAP Financial Consolidation

SAP Financial Consolidation does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability. These endpoints are exposed over the network. The vulnerability can exploit resources beyond the vulnerable component. On successful exploitation, an attacker can...

PT-2024-4202 · Schneider Electric · Spacelogic As-B

Name of the Vulnerable Software and Affected Versions: Schneider Electric SpaceLogic AS-P and SpaceLogic AS-B affected versions not specified Description: A Time-of-check Time-of-use TOCTOU Race Condition issue exists, potentially allowing an attacker to escalate privileges by abusing a limited...

CVE-2024-27838

The issue was addressed by adding additional logic. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. A maliciously crafted webpage may be able to fingerprint the user...

CVE-2024-27833

An integer overflow was addressed with improved input validation. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, tvOS 17.5, visionOS 1.2. Processing maliciously crafted web content may lead to arbitrary code execution...

CVE-2024-27830

This issue was addressed through improved state management. This issue is fixed in Safari 17.5, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. A maliciously crafted webpage may be able to fingerprint the user...

CVE-2024-3850

Affected product: Uniview NVR301-04S2-P4. Vulnerability: reflected cross-site scripting (XSS) via the PATH of LAPI. Root cause: improper neutralization of input during web page generation (CWE-79), with XSS possible on pages under /LAPI/. Some sources note authentication is required; others indic...

CVE-2024-3850 Uniview NVR301-04S2-P4 Cross-site Scripting

Uniview NVR301-04S2-P4 is vulnerable to reflected cross-site scripting attack XSS. An attacker could send a user a URL that if clicked on could execute malicious JavaScript in their browser. This vulnerability also requires authentication before it can be exploited, so the scope and severity is...

CVE-2024-3850 Uniview NVR301-04S2-P4 Cross-site Scripting

Uniview NVR301-04S2-P4 is vulnerable to reflected cross-site scripting attack XSS. An attacker could send a user a URL that if clicked on could execute malicious JavaScript in their browser. This vulnerability also requires authentication before it can be exploited, so the scope and severity is...

The vulnerability of the Register method in the Telerik Report Server reporting framework allows a malicious actor to access limited functions.

The vulnerability of the Register method in the Telerik Report Server reporting framework relates to bypassing authentication processes through spoofing. Exploiting this vulnerability can allow unauthorized users to gain access to limited features of the system...

Fedora: Security Advisory for qt5-qtquickcontrols2 (FEDORA-2024-2e27372d4c)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CGA-G33M-R5QG-FWRW

Bulletin has no description...

CGA-HHPF-G3CH-F2JV

Bulletin has no description...

CGA-39WF-R7FW-W33X

Bulletin has no description...

typo3 Information Disclosure Security Note

Due to reports it has been validated that internal workspaces in Neos are accessible without authentication. Some users assumed this is a planned feature but it is not. A workspace preview should be an additional feature with respective security measures in place. Note that this only allows readi...

[SECURITY] Fedora 40 Update: qt5-qtquickcontrols2-5.15.14-1.fc40

The Qt Labs Controls module provides a set of controls that can be used to build complete interfaces in Qt Quick. Unlike Qt Quick Controls, these controls are optimized for embedded systems and so are preferred for hardware with limited resources...

CVE-2024-25600

Improper Control of Generation of Code 'Code Injection' vulnerability in Codeer Limited Bricks Builder allows Code Injection.This issue affects Bricks Builder: from n/a through 1.9.6...

Access Control Bypass

typo3/cms-core is vulnerable to Access Control Bypass. The vulnerability is due to insufficient access control for backend users, allowing them to modify and create pages in the default language despite having limited access to specific languages...

RHEL 5 : others (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter CVE-2014-0227 - Apache Tomcat...

RHEL 9 : libtiff (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 9 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - libtiff: heap-based buffer overflow in TIFFmemcpy in tifunix.c CVE-2022-1056 - libtiff: out-of-bounds rea...

PT-2024-40227 · Packagist · Typo3/Cms-Core

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned. Description: A security issue has been found where backend users with limited access to specific languages can modify and create pages in the default language, which should be restricted. This can b...