UBUNTU-CVE-2024-8606

Bypass of two factor authentication in RestAPI in Checkmk 2.3.0p16 and 2.2.0p34 allows authenticated users to bypass two factor authentication...

IBM Cognos Analytics 安全漏洞

IBM Cognos Analytics is a suite of business intelligence software from International Business Machines IBM. The software includes reports, dashboards, and scorecards, and can assist companies in adjusting their decisions by analyzing such things as key factors and key people. A security...

Apex Softcell LD DP Back Office 安全漏洞

Apex Softcell LD DP Back Office is an application from Apex Softcell. Apex Softcell LD DP Back Office has a security vulnerability that originates from improper validation of certain parameters "cCdslClicentcode" and "cLdClientCode The vulnerability stems from improper validation of certain...

CVE-2024-45786

This vulnerability exists in Reedos aiM-Star version 2.0.1 due to improper access controls on its certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating a parameter through API request URL which could lead to gain unauthorized access to sensitive...

Reedos aiM-Star 安全漏洞

Reedos aiM-Star is a software product from Reedos for mutual fund distribution. A security vulnerability exists in Reedos aiM-Star version 2.0.1, which stems from the lack of a restriction on excessive failed authentication attempts for API-based logins, which could lead to unauthorized access an...

AXIS OS 安全漏洞

AXIS OS is an edge device operating system from Axis Sweden. A security vulnerability exists in AXIS OS versions 6.50 through 11.10, which stems from the Guard Tour VAPIX API parameter that allows the use of arbitrary values...

TechExcel Back Office Software 安全漏洞

TechExcel Back Office Software is a back office software from TechExcel, Inc. A security vulnerability exists in versions of TechExcel Back Office Software prior to 1.0.0 that stems from improper access control on certain API endpoints and could allow an authenticated, remote attacker to gain...

PT-2024-31221 · Seacms · Seacms

Name of the Vulnerable Software and Affected Versions: SeaCMS version 13.1 Description: A Server-Side Request Forgery SSRF issue was discovered in SeaCMS. This issue occurs via the url parameter at the "/admin reslib.php" API endpoint. Recommendations: For SeaCMS version 13.1, as a temporary...

The vulnerability of the Cisco Smart License Utility software management software lies in its ability to disclose information through registration files, allowing a violator to gain unauthorized access to confidential information and unauthorized access to the API.

The vulnerability of the Cisco Smart License Utility software relates to the disclosure of information through registration files. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to confidential information and to obtain unauthorized access to...

SuiteCRM 安全漏洞

SuiteCRM is a customer relationship management system from the SuiteCRM team. SuiteCRM has a security vulnerability that stems from insufficient access control checks. An attacker exploited the vulnerability to delete records via the API...

Trellix IPS Manager 安全漏洞

Trellix IPS Manager is a next-generation IPS for local and virtual networks from FireEye Trellix USA. A security vulnerability exists in Trellix IPS Manager that originates from allowing an unauthenticated remote attacker to bypass authentication and gain access to the manager's API...

PT-2024-31691 · Unknown · Symphony Xts Web Trading

Name of the Vulnerable Software and Affected Versions: Symphony XTS Web Trading version 2.0.0.1 P160 Description: This issue exists due to improper access controls on APIs in the Preference module of the application. An authenticated remote attacker could exploit this by manipulating parameters...

Symphony XTS Web Trader 安全漏洞

Symphony XTS Web Trader is an advanced HTML5-based trading platform from Symphony. A security vulnerability exists in Symphony XTS Web Trader version 2.0.0.1P160 that stems from improper access control to the API. A remote attacker can exploit the vulnerability to manipulate parameters via HTTP...

OESA-2024-2074 moby security update

Docker is a product for you to build, ship and run any application as a lightweight container. Security Fixes: Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain versions of Docker Engine, which could allow an...

PT-2024-29379 · Organizr · Organizr

Name of the Vulnerable Software and Affected Versions: Organizr version 1.90 Description: The issue is related to Cross Site Scripting XSS via the "api.php" endpoint. This means an attacker could potentially inject malicious scripts into the website, affecting users' sessions. Recommendations: Fo...

The vulnerability of the TrueConf Server software, related to insufficient protection of operational data, allows attackers to gather information about system users.

The vulnerability of the TrueConf Server software is related to insufficient protection of operational data. Exploiting this vulnerability allows a malicious actor to gather information about system users through API methods...

Umbraco 安全漏洞

Umbraco is an open source content management system CMS written in C by the Danish company Umbraco. A security vulnerability exists in Umbraco versions prior to 14.1.2, which stems from the fact that certain endpoints in the management API can return stack trace information even if Umbraco is not...

The vulnerability of the graphical user interface of the artificial intelligence-based security threat detection software FortiAIOps allows a perpetrator to disclose protected information.

The vulnerability of the graphical user interface of the artificial intelligence-based security threat detection software FortiAIOps is related to the lack of protection for operational data. Exploiting this vulnerability can allow a malicious actor to disclose the protected information stored in...

SUSE CVE-2024-43167

DISPUTE NOTE: this issue does not pose a security risk as it according to analysis by the original software developer, NLnet Labs falls within the expected functionality and security controls of the application. Red Hat has made a claim that there is a security risk within Red Hat products. NLnet...

SAP Commerce Cloud 信息泄露漏洞

SAP Commerce Cloud is a cloud-based e-commerce platform from Germany's SAP. It supports sales management, marketing management, order management, and operations management. An information disclosure vulnerability exists in SAP Commerce Cloud that stems from certain OCC API endpoints that allow...