CVE-2024-12111 Potential LDAP injection vulnerability in OpenText Privileged Access Manager

In a specific scenario a LDAP user can abuse the authentication process using injection attack in OpenText Privileged Access Manager that allows authentication bypass. This issue affects Privileged Access Manager version 23.34.4; 24.34.5...

Improper Authorization

apachesuperset is vulnerable to Improper Authorization. The vulnerability is due to the FABADDSECURITYAPI being enabled, allows lower-privileged users to access and use an API that should be restricted to higher-privileged users...

Sophos Firewall 安全漏洞

Sophos Firewall is a firewall from Sophos UK. A security vulnerability exists in versions prior to Sophos Firewall 20.0 MR3 20.0.3. An attacker exploiting this vulnerability could access the firewall as a privileged system via SSH...

OpenText Privileged Access Manager 安全漏洞

OpenText Privileged Access Manager is a privileged access management software from OpenText Canada. A security vulnerability exists in OpenText Privileged Access Manager versions 23.3 4.4 and 24.3 4.5. An attacker could bypass authentication by exploiting the vulnerability...

PT-2024-17446 · Opentext · Opentext Privileged Access Manager

Name of the Vulnerable Software and Affected Versions: OpenText Privileged Access Manager versions 23.34.4 through 24.34.5 Description: In a specific scenario, a LDAP user can abuse the authentication process in OpenText Privileged Access Manager, allowing authentication bypass. Recommendations:...

PT-2024-9753

Name of the Vulnerable Software and Affected Versions Sophos Firewall versions prior to 20.0 MR3 20.0.3 Description A weak credentials vulnerability potentially allows privileged system access via SSH to Sophos Firewall. This issue could let an attacker gain unauthorized access to protected...

PT-2024-32410 · Ibm · Ibm I

Name of the Vulnerable Software and Affected Versions: IBM i versions 7.4 and 7.5 Description: The issue allows an authenticated user to gain elevated privilege to a physical file. A user with authority to a view can alter the based-on physical file security attributes without having object...

CVE-2024-46971

Software installed and run as a non-privileged user may conduct GPU system calls to read and write freed physical memory from the GPU...

CVE-2024-47892 GPU DDK - UAF of kernel memory in PMRUnlockPhysAddressesOSMem for on-demand non-4KB PMRs in system memory (UMA)

Software installed and run as a non-privileged user may conduct GPU system calls to read and write freed physical memory from the GPU...

CVE-2024-46971 GPU DDK - UAF of memory in PMRUnlockSysPhysAddressesLocalMem for on-demand PMRs on PCI (LMA) systems

Software installed and run as a non-privileged user may conduct GPU system calls to read and write freed physical memory from the GPU...

GO-2024-3248 KubeSphere IDOR vulnerability in github.com/kubesphere/kubesphere

An Insecure Direct Object Reference IDOR vulnerability in KubeSphere allows low-privileged authenticated attackers to access sensitive resources without proper authorization checks. NOTE: A fix is expected in v4.1.3 in January 2025...

Seven Bolt-Ons to Make Your Entra ID More Secure for Critical Sessions

Identity security is all the rage right now, and rightfully so. Securing identities that access an organization's resources is a sound security model. But IDs have their limits, and there are many use cases when a business should add other layers of security to a strong identity. And this is what...

K000148895: Intel UEFI firmware vulnerabilities CVE-2023-2235, CVE-2023-23904, and CVE-2023-25546

Security Advisory Description CVE-2023-22351 Out-of-bounds write in UEFI firmware for some IntelR Processors may allow a privileged user to potentially enable escalation of privilege via local access. CVE-2023-23904 NULL pointer dereference in the UEFI firmware for some IntelR Processors may allo...

One Identity Named Winner of the Coveted Top InfoSec Innovator Awards for 2024

One Identity wins "Hot Company: Privileged Access Management" at the 12th Cyber Defense Magazine InfoSec Innovator Awards, showcasing PAM excellence in cybersecurity...

UBUNTU-CVE-2024-53137

In the Linux kernel, the following vulnerability has been resolved: ARM: fix cacheflush with PAN It seems that the cacheflush syscall got broken when PAN for LPAE was implemented. User access was not enabled around the cache maintenance instructions, causing them to fault...

CVE-2024-45757

An issue was discovered in Centreon centreon-bam 24.04, 23.10, 23.04, and 22.10. SQL injection can occur in the user-settings form. Exploitation is only accessible to authenticated users with high-privileged access...

CVE-2024-45757

An issue was discovered in Centreon centreon-bam 24.04, 23.10, 23.04, and 22.10. SQL injection can occur in the user-settings form. Exploitation is only accessible to authenticated users with high-privileged access...

CVE-2024-45757

CVE-2024-45757 affects Centreon centreon-bam versions 22.10–24.04. The issue is a SQL injection in the user-settings form , with exploitation limited to authenticated users holding high privileges . The root cause is untrusted input handling in the user-settings workflow, enabling injected SQL st...

PT-2024-31753 · Centreon · Centreon Bam

Name of the Vulnerable Software and Affected Versions: Centreon centreon-bam versions 22.10 through 24.04 Description: A problem was discovered in the user-settings form of Centreon centreon-bam, where SQL injection can occur. The exploitation of this issue is only accessible to authenticated use...

UBUNTU-CVE-2024-36464

When exporting media types, the password is exported in the YAML in plain text. This appears to be a best practices type issue and may have no actual impact. The user would need to have permissions to access the media types and therefore would be expected to have access to these passwords...