Improper Authorization

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Improper Authorization. An attacker can gain access to minor information by sending crafted requests with low privileges. Remediation Upgrade magento/community-edition to...

Improper Authorization

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Improper Authorization. An attacker can gain access to minor information by bypassing security restrictions using a low-privileged account. Remediation Upgrade...

CVE-2024-38501

An unauthenticated remote attacker may use a HTML injection vulnerability with limited length to inject malicious HTML code and gain low-privileged access on the affected device...

CVE-2024-21152

Vulnerability in the Oracle Process Manufacturing Financials product of Oracle E-Business Suite component: Allocation Rules. Supported versions that are affected are 12.2.12-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2024-21146

Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite component: GL Accounts. Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trade Management...

mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2023)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.34 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

CVE-2024-2731

CVE-2024-2731 describes an improper access control issue in Mautic-based deployments (cited via Red Hat and CVE records) where users with low privileges can view pages exposing sensitive data (company names, user names/surnames, stage names, monitoring campaigns and their descriptions) and can al...

Mautic 安全漏洞

Mautic is an open source marketing automation software. The software monitors and manages websites, sends emails and manages customer resources. Mautic suffers from a security vulnerability that stems from the fact that low-privileged users can view certain pages that expose sensitive information...

PT-2024-18973 · Kiloview · Kiloview Ndi

Name of the Vulnerable Software and Affected Versions: Kiloview NDI versions prior to 2.02.0227 Description: An OS Command Injection issue allows a low-privileged user to execute arbitrary code remotely on the device with high privileges. This issue affects various Kiloview NDI models, including...

SAP NetWeaver Application Server 信息泄露漏洞

SAP NetWeaver Application Server is an application server from SAP, Germany. An information disclosure vulnerability exists in SAP NetWeaver Application Server ABAP that stems from allowing an attacker to access information that may be restricted by low privileges. No details of the vulnerability...

PT-2024-19160 · Veeam · Veeam Recovery Orchestrator

Name of the Vulnerable Software and Affected Versions: Veeam Recovery Orchestrator affected versions not specified Description: The issue allows a user with a low-privileged role to access the NTLM hash of the service account used by the Veeam Orchestrator Server Service. Recommendations: At the...

CVE-2024-22432

Networker 19.9 and all prior versions contains a Plain-text Password stored in temporary config file during backup duration in NMDA MySQL Database backups. User has low privilege access to Networker Client system could potentially exploit this vulnerability, leading to the disclosure of configure...

Design/Logic Flaw

Networker 19.9 and all prior versions contains a Plain-text Password stored in temporary config file during backup duration in NMDA MySQL Database backups. User has low privilege access to Networker Client system could potentially exploit this vulnerability, leading to the disclosure of configure...

CVE-2024-22432

Networker 19.9 and all prior versions contains a Plain-text Password stored in temporary config file during backup duration in NMDA MySQL Database backups. User has low privilege access to Networker Client system could potentially exploit this vulnerability, leading to the disclosure of configure...

CVE-2024-22432

Networker 19.9 and all prior versions contains a Plain-text Password stored in temporary config file during backup duration in NMDA MySQL Database backups. User has low privilege access to Networker Client system could potentially exploit this vulnerability, leading to the disclosure of configure...

PT-2024-2070 · Dell Emc · Dell Emc Networker

Name of the Vulnerable Software and Affected Versions: Dell EMC NetWorker versions 19.9 and all prior versions Description: The issue is related to insufficient protection of registration data, which may allow an attacker to obtain user registration data. Specifically, a plain-text password is...

CVE-2024-23676

In Splunk versions below 9.0.8 and 9.1.3, the “mrollup” SPL command lets a low-privileged user view metrics on an index that they do not have permission to view. This vulnerability requires user interaction from a high-privileged user to exploit...

CVE-2023-41786

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pandora FMS on all allows File Discovery. This vulnerability allows users with low privileges to download database backups. This issue affects Pandora FMS: from 700 through 772...

Oracle E-Business Suite Security Vulnerability

Oracle E-Business Suite E-Business Suite is a set of fully integrated global business management software from Oracle Oracle. The software provides customer relationship management, service management, financial management, and other functions. A security vulnerability exists in Oracle Enterprise...

PT-2023-4353 · Trend Micro · Trend Micro Apex Central

Name of the Vulnerable Software and Affected Versions: Trend Micro Apex Central versions prior to build 6481 Description: A server-side request forgery SSRF vulnerability could allow an attacker to interact with internal or local services directly. The attacker must first obtain the ability to...