CVE-2024-49818

IBM Security Guardium Key Lifecycle Manager versions 4.1, 4.1.1, 4.2.0, and 4.2.1 are affected by CVE-2024-49818, which could allow a remote attacker to obtain sensitive information via a browser-embedded detailed error message (information disclosure). The IBM security bulletin lists remediation...

IBM Security Guardium Key Lifecycle Manager security vulnerabilities

IBM Security Guardium Key Lifecycle Manager is an encryption key management tool from International Business Machines IBM. It centralizes, simplifies and automates the key management process. An information disclosure vulnerability exists in IBM Security Guardium Key Lifecycle Manager, which can ...

Task scams surge by 400%, but what are they?

An unfamiliar type of scam has surged against everyday people, with a year-over-year increase of some 400%, putting job seekers at risk of losing their time and money. The emerging threat is delivered in "task scams" or "gamified job scams." While these scams were virtually non-existent in 2020,...

PT-2024-36252 · Unknown · Vimeography

Name of the Vulnerable Software and Affected Versions: Vimeography versions prior to 2.4.4 Vimeography version 2.4.4 Description: The issue is related to the generation of error messages that contain sensitive information, allowing the retrieval of embedded sensitive data. Recommendations: For...

USN-7159-1 linux, linux-gcp, linux-gcp-5.4, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-kvm, linux-raspi, linux-xilinx-zynqmp vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM32 architecture; - ARM64 architecture; - S390 architecture; - x86 architecture; - Power management core; - GPU...

Important: postgresql16

Issue Overview: Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended. CVE-2023-2455 and CVE-2016-2193 fixed most interaction between row security and user ID changes. They missed cases where a subquery, WITH query...

Important: postgresql16

Issue Overview: Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended. CVE-2023-2455 and CVE-2016-2193 fixed most interaction between row security and user ID changes. They missed cases where a subquery, WITH query...

CVE-2024-51460

CVE-2024-51460 affects IBM InfoSphere Information Server 11.7. An authenticated user could obtain sensitive information via a stack-trace that reveals detailed error messages. This disclosure is the stated vulnerability, with CVSS v3.1 base score 4.3 (Network, Low complexity, Privileges Low, Conf...

CVE-2024-51460 IBM InfoSphere Information Server information disclosure

IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information when a detailed technical error message is returned in a stack trace. This information could be used in further attacks against the system...

PT-2024-34638 · Ibm · Ibm Infosphere Information Server

Name of the Vulnerable Software and Affected Versions: IBM InfoSphere Information Server version 11.7 Description: The issue allows an authenticated user to obtain sensitive information when a detailed technical error message is returned in a stack trace. This information could be used in further...

GHSA-8MVQ-8H2V-J9VF Drupal Core Cross-Site Scripting (XSS)

Drupal uses JavaScript to render status messages in some cases and configurations. In certain situations, the status messages are not adequately sanitized. This issue affects Drupal Core: from 8.8.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8...

Drupal Core Cross-Site Scripting (XSS)

Drupal uses JavaScript to render status messages in some cases and configurations. In certain situations, the status messages are not adequately sanitized. This issue affects Drupal Core: from 8.8.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8...

USN-7141-1 ofono vulnerabilities

It was discovered that oFono incorrectly handled decoding SMS messages leading to a stack overflow. A remote attacker could potentially use this issue to cause a denial of service. CVE-2023-2794, CVE-2023-4233, CVE-2023-4234...

CVE-2024-54919

creationtimestamp| type| source ---|---|--- 2024-12-09 17:12:36+00:00| seen| https://t.me/cvedetector/12402...

CVE-2024-53948 Apache Superset: Error verbosity exposes metadata in analytics databases

Generation of Error Message Containing analytics metadata Information in Apache Superset. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue...

Apache Superset security vulnerabilities

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. An information disclosure vulnerability exists in Apache Superset versions prior to 4.1.0, which stems from an error message generation that contains analysis metadata information. An attacker ca...

PT-2024-10308

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 4.1.0 Description The issue is related to the generation of error messages containing analytics metadata information in Apache Superset. This can allow a remote attacker to gain unauthorized access to protecte...

Apache Airflow Information Disclosure

The vulnerability of the software used for creating, monitoring, and orchestrating data processing scripts in Apache Airflow lies in the exposure of information in debugging messages. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected...

[SECURITY] Fedora 41 Update: uv-0.5.5-2.fc41

An extremely fast Python package installer and resolver, written in Rust. Designed as a drop-in replacement for common pip and pip-tools workflows. Highlights: =E2=80=A2 =E2=9A=96=EF=B8=8F Drop-in replacement for common pip, pip-tools, and virtualenv commands. =E2=80=A2 =E2=9A=A1=EF=B8=8F 10-100x...

CVE-2024-11353

The SMS for Lead Capture Forms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deletemessage function in all versions up to, and including, 1.1.0. This makes it possible for authenticated attackers, with Subscriber-level access and...