CVE-2024-23822

CVE-2024-23822 affects Thruk, a multibackend web monitoring interface. Prior to version 3.12, the product’s file upload form allows a threat actor to perform a path traversal vulnerability, enabling arbitrary file uploads to chosen server paths and permissions. The root cause is insufficient vali...

CVE-2024-23822 Thruk Incorrect limitation of a pathname to a restricted directory (Path Traversal) (CWE-22)

Thruk is a multibackend monitoring webinterface. Prior to 3.12, the Thruk web monitoring application presents a vulnerability in a file upload form that allows a threat actor to arbitrarily upload files to the server to any path they desire and have permissions for. This vulnerability is known as...

MachineSense FeverWarn Access Control Error Vulnerability

MachineSense FeverWarn is a temperature detection device from MachineSense. An access control error vulnerability exists in MachineSense FeverWarn that stems from the use of unauthenticated MQTT messaging to monitor the device and remotely view sensor data by a user...

Security Operations (SecOps)

Understanding the Basics of Security Operations SecOps SecOps represents the blending of cybersecurity proficiency with operational domains, forming a powerful bulwark. Its primary mission lies in safeguarding the fundamental data assets and technological infrastructures of an organization. More...

Moderate: Red Hat Security Advisory: tcpdump security update

An update for tcpdump is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

[SECURITY] [DLA 3717-1] zabbix security update

Debian LTS Advisory DLA-3717-1 [email protected] https://www.debian.org/lts/security/ Tobias Frost January 24, 2024 https://wiki.debian.org/LTS Package : zabbix Version : 1:4.0.4+dfsg-1+deb10u4 CVE ID : CVE-2023-32721 CVE-2023-32723 CVE-2023-32726 Debian Bug : 1053877 Several security...

The vulnerability of the Monitoring and Diagnostics component of the JD Edwards EnterpriseOne Tools in the enterprise resource management system makes it possible for a perpetrator to access confidential information.

The vulnerability of the Monitoring and Diagnostics component of the JD Edwards EnterpriseOne Tools in the enterprise resource management system exists due to insufficient validation of input data. Exploiting this vulnerability could allow attackers to access confidential information...

CLSA-2024-1705927642 kernel: Fix of 7 CVEs

netsched: clsroute: remove from list when handle is 0 CVE-2022-2588 - netfilter: nftables: do not allow RULEID to refer to another chain CVE-2022-2586 - netfilter: nftables: do not allow SETID to refer to another table CVE-2022-2586 - netfilter: nftables: prevent OOB access in nftbyteordereval...

Medium: dbus

Issue Overview: D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor message bus traffic, then an unprivileged user with the ability to connect to the...

Medium: dbus

Issue Overview: D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor message bus traffic, then an unprivileged user with the ability to connect to the...

CVE-2023-46447

The POPS! Rebel application 5.0 for Android, in POPS! Rebel Bluetooth Glucose Monitoring System, sends unencrypted glucose measurements over BLE...

Code injection

The POPS! Rebel application 5.0 for Android, in POPS! Rebel Bluetooth Glucose Monitoring System, sends unencrypted glucose measurements over BLE...

POPS Rebel Bluetooth Glucose Monitoring System Security Vulnerability

POPS Rebel Bluetooth Glucose Monitoring System is a blood glucose monitoring system from POPS Rebel. A security vulnerability exists in the POPS Rebel Bluetooth Glucose Monitoring System version 5.0, which originates from the application's presence in the clear text transmission of sensitive...

CVE-2023-46447

The POPS! Rebel application 5.0 for Android, in POPS! Rebel Bluetooth Glucose Monitoring System, sends unencrypted glucose measurements over BLE...

CVE-2023-46447

The POPS! Rebel application 5.0 for Android, in POPS! Rebel Bluetooth Glucose Monitoring System, sends unencrypted glucose measurements over BLE...

Design/Logic Flaw

changedetection.io is an open source tool designed to monitor websites for content changes. In affected versions the API endpoint /api/v1/watch//history can be accessed by any unauthorized user. As a result any unauthorized user can check one's watch history. However, because unauthorized party...

PYSEC-2024-15

changedetection.io is an open source tool designed to monitor websites for content changes. In affected versions the API endpoint /api/v1/watch//history can be accessed by any unauthorized user. As a result any unauthorized user can check one's watch history. However, because unauthorized party...

CVE-2024-23329 changedetection.io API endpoint is not secured with API token

changedetection.io is an open source tool designed to monitor websites for content changes. In affected versions the API endpoint /api/v1/watch//history can be accessed by any unauthorized user. As a result any unauthorized user can check one's watch history. However, because unauthorized party...

PT-2024-13359 · Unknown · Pops! Rebel

Name of the Vulnerable Software and Affected Versions: POPS! Rebel application version 5.0 for Android Description: The POPS! Rebel application sends unencrypted glucose measurements over Bluetooth Low Energy BLE. This issue affects the POPS! Rebel Bluetooth Glucose Monitoring System...

Security Bulletin: IBM Storage Ceph is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Grafana (CVE-2023-1410)

Summary Grafana is used by IBM Storage Ceph as a monitoring dashboard. CVE-2023-1410 This bulletin identifies the steps to take to address the vulnerability in Grafana. Vulnerability Details CVEID: CVE-2023-1410 DESCRIPTION: Grafana is vulnerable to cross-site scripting, caused by improper...