530 matches found
Calibre-Web 安全漏洞
Calibre-Web is a web application for browsing, reading, and downloading eBooks from the Calibre database by Jan B Individual Developer. A security vulnerability exists in Calibre-Web that originates from allowing unauthorized users to view the names of private bookshelves belonging to other users...
PRIMX ZEDMAIL 安全漏洞
PRIMX ZEDMAIL is an enterprise messaging application encryption solution from PRIMX Corporation. A security vulnerability exists in PRIMX ZEDMAIL version 2024.3 and earlier, which stems from the fact that by default dedicated folders can be accessed by other users to misuse technical files and...
Brokerage Wave 安全漏洞
Brokerage Wave is a frontend product from Brokerage, Inc. A security vulnerability exists in Brokerage Wave version 2.0, which stems from a lack of authorization checking on certain API endpoints, which could allow a remote attacker to manipulate the parameter userid via the API request URL to...
PT-2024-34699 · Wave · Wave
Name of the Vulnerable Software and Affected Versions: Wave version 2.0 Description: The issue arises from insufficient encryption of sensitive data received at the API response, allowing an authenticated remote attacker to exploit it by manipulating API input parameters. This could lead to...
CVE-2024-48936
Summary: CVE-2024-48936 affects SchedMD Slurm prior to 24.05.4. A mis-implementation in authentication handling in the stepmgr could allow an attacker to run processes under other users’ jobs, limited to jobs explicitly using --stepmgr or systems with stepmgr globally enabled via SlurmctldParamet...
SAMSUNG Video Player 安全漏洞
SAMSUNG Video Player is a built-in system video player application optimized for the Samsung Galaxy series from Samsung South Korea. A security vulnerability exists in SAMSUNG Video Player that originates from improper validation of user input. An attacker could exploit the vulnerability to acces...
CVE-2024-47657
This vulnerability exists in the Shilpi Net Back Office due to improper access controls on certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating a parameter dfclientid through API request URLs which could lead to unauthorized access to sensitive...
Cross-site Scripting (XSS)
Overview librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support. Affected versions of this package are vulnerable to Cross-site Scripting XSS through the hostname parameter, in the context of other users' sessions, by injecting...
CVE-2024-47087
This vulnerability exists in Apex Softcell LD Geo due to improper validation of the certain parameters Client ID, DPID or BOID in the API endpoint. An authenticated remote attacker could exploit this vulnerability by manipulating parameters in the API request body leading to exposure of sensitive...
CVE-2024-45787
This vulnerability exists in Reedos aiM-Star version 2.0.1 due to transmission of sensitive information in plain text in certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating a parameter through API request URL and intercepting response of the AP...
CVE-2024-45786
This vulnerability exists in Reedos aiM-Star version 2.0.1 due to improper access controls on its certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating a parameter through API request URL which could lead to gain unauthorized access to sensitive...
Reedos aiM-Star 安全漏洞
Reedos aiM-Star is a software product from Reedos for mutual fund distribution. A security vulnerability exists in Reedos aiM-Star version 2.0.1 that originates from the transmission of sensitive information in plain text in certain API endpoints, resulting in the exposure of sensitive informatio...
PT-2024-36765 · B&R · B&R Aprol
Name of the Vulnerable Software and Affected Versions: B&R APROL versions = R 4.4-00P3 Description: An untrusted search path vulnerability exists in the software, allowing an authenticated local attacker to execute arbitrary code under other users' privileges. Recommendations: For B&R APROL...
CVE-2024-39875
A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.2 SP1. The affected application allows authenticated, low privilege users with the 'Manage own remote connections' permission to retrieve details about other users and group memberships...
CVE-2024-39870
A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.2 SP1. The affected applications can be configured to allow users to manage own users. A local authenticated user with this privilege could use this modify users outside of their own scope as well as to escalate...
CVE-2022-38383
IBM Cloud Pak for Security CP4S 1.10.0.0 through 1.10.11.0 and IBM QRadar Software Suite 1.10.12.0 through 1.10.21.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 233673...
The vulnerability of the Git-based software platform for collaborative code development on GitLab stems from deficiencies in access control, allowing attackers to execute arbitrary code.
The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary code by executing scripts on behalf of other users...
PT-2024-19346 · Ibm · Ibm Maximo Application Suite +1
Name of the Vulnerable Software and Affected Versions: IBM Maximo Asset Management version 7.6.1.3 IBM Maximo Application Suite versions 8.10 through 8.11 Description: The issue allows web pages to be stored locally, which can then be read by another user on the system. Recommendations: For IBM...
Moodle Security Breach
Moodle is a free, open source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment. A security vulnerability exists in Moodle that originates in a shared hosting environment that is misconfigured to allow access to oth...