GHSA-G5VW-3H65-2Q3V Access control vulnerable to user data deletion by anonynmous users

Impact Anonymous users can delete the user data maintained by an AccessControl.userfolder.UserFolder which may prevent any privileged access. Patches The problem is fixed in version 7.2. Workarounds The problem can be fixed by adding dataroles = to AccessControl.userfolder.UserFolder. References...

Zope AccessControl 访问控制错误漏洞

Zope AccessControl is the common security framework used in Zope from the Zope Foundation. An access control error vulnerability exists in Zope AccessControl versions prior to 7.2, which stems from an attacker being able to delete user data maintained by AccessControl.userfolder.UserFolder, which...

Sailing the Seven Seas Securely from Port to Port – OT Access Security for Ships and Cranes

Operational Technology OT security has affected marine vessel and port operators, since both ships and industrial cranes are being digitalized and automated at a rapid pace, ushering in new types of security challenges. Ships come to shore every six months on average. Container cranes are mostly...

The vulnerability of the Core module of the Indeed Privileged Access Manager allows a perpetrator to trigger a service failure.

The vulnerability of the Core module of the Indeed Privileged Access Manager software lies in its uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

PT-2024-7265 · Indeed · Indeed Privileged Access Manager

Name of the Vulnerable Software and Affected Versions: Indeed Privileged Access Manager affected versions not specified Description: The issue is related to an uncontrolled resource consumption vulnerability in the Core module of Indeed Privileged Access Manager. This could allow a remote attacke...

PT-2024-33490 · Autolab · Autolab

Name of the Vulnerable Software and Affected Versions: Autolab version 3.0.0 Description: The issue concerns misconfigured reset password permissions for email-based accounts. Users with insufficient privileges could reset and potentially access privileged users' accounts by resetting their...

Apache CloudStack 跨站请求伪造漏洞

Apache CloudStack is a suite of Infrastructure as a Service IaaS cloud computing platforms from the Apache Foundation in the United States. The platform is primarily used to deploy and manage large networks of virtual machines. Apache CloudStack suffers from a cross-site request forgery...

CVE-2024-21264

Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft component: Activity Guide Composer. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise...

CVE-2024-21213

CVE-2024-21213 concerns Oracle MySQL Server (InnoDB) with affected versions: 8.0.39 and earlier, 8.4.2 and earlier, and 9.0.1 and earlier. The vulnerability is described as an easily exploitable denial of service causing a hang or crash of MySQL Server, enabling a high-privilege attacker who can ...

Vivo Fibra Askey RTF8225VW Command Execution Vulnerability

The Vivo Fibra Askey RTF8225VW modem suffers from an input validation vulnerability that allows for full escalation to a functioning shell once logged in and using the restricted aspsh shell. --- Exploit 1 Documentation on the Vivo Fibra Modem Exploit I discovered an exploit that allows access to...

Vivo Fibra Askey RTF8225VW Command Execution

--- Exploit 1 Documentation on the Vivo Fibra Modem Exploit I discovered an exploit that allows access to the sh shell on the Vivo Fibra modem. This method essentially involves terminating the aspsh shell and invoking sh using the output of cat /dev/null. Using the pipe | is crucial for this...

CVE-2024-45754

An issue was discovered in the centreon-bi-server component in Centreon BI Server 24.04.x before 24.04.3, 23.10.x before 23.10.8, 23.04.x before 23.04.11, and 22.10.x before 22.10.11. SQL injection can occur in the listing of configured reporting jobs. Exploitation is only accessible to...

CVE-2024-39544

An Incorrect Default Permissions vulnerability in the command line interface CLI of Juniper Networks Junos OS Evolved allows a low privileged local attacker to view NETCONF traceoptions files, representing an exposure of sensitive information. On all Junos OS Evolved platforms, when NETCONF...

CVE-2024-45754

An issue was discovered in the centreon-bi-server component in Centreon BI Server 24.04.x before 24.04.3, 23.10.x before 23.10.8, 23.04.x before 23.04.11, and 22.10.x before 22.10.11. SQL injection can occur in the listing of configured reporting jobs. Exploitation is only accessible to...

CVE-2024-9471

A privilege escalation PE vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated PAN-OS administrator with restricted privileges to use a compromised XML API key to perform actions as a higher privileged PAN-OS administrator. For example, an administrator with...

The vulnerability of the software solutions for control, management, and audit, namely Zoho ManageEngine Password Manager Pro, and the ManageEngine Privileged Access Manager 360 (PAM360) software, allows a perpetrator to execute arbitrary code.

The vulnerability of the Zoho ManageEngine Password Manager Pro and the ManageEngine Privileged Access Manager 360 PAM360 software solutions lies in the lack of measures taken to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability could allow a...

CVE-2024-28812

An issue was discovered in Infinera hiT 7300 5.60.50. A hidden SSH service on the local management network interface with hardcoded credentials allows attackers to access the appliance operating system with highest privileges via an SSH connection...

CVE-2024-0003

A condition exists in FlashArray Purity whereby a malicious user could use a remote administrative service to create an account on the array allowing privileged access...

CVE-2024-0003

A condition exists in FlashArray Purity whereby a malicious user could use a remote administrative service to create an account on the array allowing privileged access...

CVE-2024-0003

CVE-2024-0003 affects Pure Storage FlashArray Purity. The issue: a malicious user could use a remote administrative service to create an account on the array, granting privileged access. Documented impact includes high confidentiality, integrity, and availability concerns with a network attack ve...