Security Bulletin: IBM Maximo Spatial Asset Management is vulnerable to Blind Server-Side Request Forgery (CVE-2023-32337)

Summary IBM Maximo Spatial Asset Management is vulnerable to Blind Server-Side Request Forgery Vulnerability Details CVEID: CVE-2023-32337 DESCRIPTION: IBM Maximo Spatial Asset Management is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send...

Security Bulletin: IBM App Connect Enterprise is vulnerable to a remote attacker due to OpenSSL. (CVE-2023-5363)

Summary IBM App Connect Enterprise is vulnerable to a remote attacker due to OpenSSL in Node.js. This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details CVEID:CVE-2023-5363 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information,...

Security Bulletin: IBM App Connect Enterprise is vulnerable to an information disclosure and a denial of service. (CVE-2024-22317)

Summary The remote administration API in IBM App Connect Enterprise is vulnerable to an information disclosure and denial of service vulnerability due to improper Brute Force protection. This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details...

Security Bulletin: Vulnerabilities in Apache Struts library affect Tivoli Netcool/OMNIbus WebGUI (CVE-2023-50164)

Summary Apache Struts is used by Tivoli Netcool/OMNIbus WebGUI as part of its web client component. The fix includes Apache Struts v2.5.33. Vulnerability Details CVEID:CVE-2023-50164 DESCRIPTION: Apache Struts could allow a remote attacker to execute arbitrary code on the system, caused by the...

Security Bulletin: There is a vulnerability in CSRF Token used by IBM Maximo Asset Management application (CVE-2023-47718)

Summary There is a vulnerability in CSRF Token used by IBM Maximo Asset Management application. Vulnerability Details CVEID:CVE-2023-47718 DESCRIPTION: IBM Maximo Application Suite is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized...

Xitami 2.5 Denial Of Service

!/usr/bin/perl use IO::Socket::INET; Exploit Title: Xitami 2.5 - Denial of Service DoS Discovery by: Fernando Mengali Discovery Date: 14 january 2024 Vendor Homepage: https://imatix-legacy.github.io/xitami.com/ Download to demo:...

ProSSHD 1.2 20090726 Denial Of Service Exploit

!/usr/bin/perl use Net::SSH2 Exploit Title: ProSSHD 1.2 20090726 - Denial of Service DoS Discovery by: Fernando Mengali Discovery Date: 13 january 2024 Vendor Homepage: https://prosshd.com/ Notification vendor: No reported Tested Version: ProSSHD 1.2 20090726 Tested on: Window XP Professional -...

Security Bulletin: IBM® Db2® is vulnerable to a privilege escalation to SYSTEM user via MSI repair functionality on Windows (CVE-2023-47145)

Summary IBM® Db2® is vulnerable to a privilege escalation to SYSTEM user via MSI repair functionality on Windows. Vulnerability Details CVEID:CVE-2023-47145 DESCRIPTION: IBM Db2 for Windows includes Db2 Connect Server could allow a local user to escalate their privileges to the SYSTEM user using...

Horner Automation Cscape Buffer Error Vulnerability

Horner Automation Cscape is a suite of programming software for industrial control system development from Horner Automation. A security vulnerability exists in Horner Automation Cscape 9.90 SP10 and prior versions, which stems from the presence of a buffer overflow vulnerability...

Vulnerabilities fixed in Trend Micro Apex One

Trend Micro has fixed vulnerabilities in Apex One. A local, authenticated malicious person could exploit the vulnerabilities to grant themselves elevated privileges and execute arbitrary code execute arbitrary code, possibly as SYSTEM. Trend Micro has released updates to fix the vulnerabilities...

Description of the security update for SharePoint Enterprise Server 2016: January 9, 2024 (KB5002541)

None None...

PT-2024-13706 · Trendnet · Trendnet Tv-Ip1314Pi

Name of the Vulnerable Software and Affected Versions: TRENDnet TV-IP1314PI version 5.5.3 200714 Description: An issue was discovered where command injection can occur because the system function is used by davinci to unpack language packs without strict filtering of URL strings. Recommendations:...

Security Bulletin: Multiple security vulnerabilities Affect IBM WebSphere Application Server Liberty shipped with IBM OpenPages

Summary IBM WebSphere Application Server Liberty is shipped as a supporting program of IBM OpenPages. Information about a security vulnerability affecting IBM WebSphere Application Server Liberty has been published in multiple security bulletins. These products have addressed the applicable CVEs...

Security Bulletin: IBM® Db2® is vulnerable to a denial of service when using a specially crafted query (CVE-2023-47747)

Summary IBM® Db2® is vulnerable to a denial of service when using a specially crafted query. Vulnerability Details CVEID:CVE-2023-47747 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes Db2 Connect Server could allow an authenticated user with CONNECT privileges to cause a denial of servi...

Security Bulletin: The IBM® Engineering Lifecycle Engineering products using IBM WebSphere Application Server Liberty is vulnerable to a denial of service (CVE-2023-44487)

Summary IBM WebSphere Application Server Liberty is vulnerable to a denial of service with the servlet-3.1, servlet-4.0, servlet-5.0, or servlet-6.0 feature with the HTTP/2 protocol enabled. Following IBM® Engineering Lifecycle Engineering products are vulnerable to this attack, it has been...

CVE-2023-52121

Cross-Site Request Forgery CSRF vulnerability in NitroPack Inc. NitroPack – Cache & Speed Optimization for Core Web Vitals, Defer CSS & JavaScript, Lazy load Images.This issue affects NitroPack – Cache & Speed Optimization for Core Web Vitals, Defer CSS & JavaScript, Lazy load Images: from n/a...

FTPDMIN 0.96 Denial Of Service

!/usr/bin/perl use Net::FTP; Exploit Title: FTPDMIN 0.96 - Denial of Service DoS Discovery by: Fernando Mengali Discovery Date: 2024-01-01 Vendor Homepage: https://www.sentex.ca/mwandel/ftpdmin/ Download to demo: https://drive.google.com/file/d/1CpfvaJbJVxR3HPWvcxIVipTaTj7RAaLd/view?usp=sharing...

CVE-2023-51527

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Senol Sahin AI Power: Complete AI Pack – Powered by GPT-4.This issue affects AI Power: Complete AI Pack – Powered by GPT-4: from n/a through 1.8.2...

CVE-2023-51527

CVE-2023-51527 describes an Exposure of Sensitive Information to an Unauthorized Actor in the plugin AI Power: Complete AI Pack – Powered by GPT-4 . Reports indicate the vulnerability affects versions up to 1.8.2 and allows an unauthorized actor to access sensitive data. Related connected records...

CVE-2023-50854

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Squirrly Squirrly SEO - Advanced Pack.This issue affects Squirrly SEO - Advanced Pack: from n/a before 2.4.02...