CVE-2024-11358 Insecure Android File Provider Paths

Mattermost Android Mobile Apps versions =2.21.0 fail to properly configure file providers which allows an attacker with local access to access files via file provider...

The vulnerability of the backup and data recovery software for Veeam Service Provider Console (VSPC) users on remote and cloud-based clients stems from insufficient protection of operational data, allowing attackers to exploit this weakness to disclose sensitive information.

The vulnerability of the backup and data restoration software for Veeam Service Provider Console VSPC for remote and cloud-based customers is related to insufficient protection of operational data. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information by...

Mattermost Mobile Apps 安全漏洞

Mattermost Mobile Apps is a messaging mobile application from Mattermost USA. A security vulnerability exists in Mattermost Mobile Apps version 2.21.0 and prior versions that stems from a failure to properly profile the provider program...

PT-2024-16931 · Mattermost · Mattermost Android Mobile Apps

Name of the Vulnerable Software and Affected Versions: Mattermost Android Mobile Apps versions =2.21.0 Description: The issue arises from a misconfiguration of file providers in the Mattermost Android Mobile Apps, allowing an attacker with local access to access files via the file provider. This...

CVE-2024-55886 OpenTelemetry Logs source may lack authentication with some custom plugins

OpenSearch Data Prepper is a component of the OpenSearch project that accepts, filters, transforms, enriches, and routes data at scale. A vulnerability exists in the OpenTelemetry Logs source in Data Prepper starting inversion 2.1.0 and prior to version 2.10.2 where some custom authentication...

CVE-2024-55886 OpenTelemetry Logs source may lack authentication with some custom plugins

OpenSearch Data Prepper is a component of the OpenSearch project that accepts, filters, transforms, enriches, and routes data at scale. A vulnerability exists in the OpenTelemetry Logs source in Data Prepper starting inversion 2.1.0 and prior to version 2.10.2 where some custom authentication...

Veeam Service Provider Console 安全漏洞

Veeam Service Provider Console is a cloud-enabled platform from Veeam USA. A security vulnerability exists in Veeam Service Provider Console version 8.1 that originates from a remote code execution that can be performed by a management agent machine on a VSPC server machine with server...

Exploit for CVE-2024-42448

CVE-2024-42448-RCE Veeam Service Provider Console VSPC rem...

Veeam Service Provider Console < 8.1.0.21999 Multiple Vulnerabilities (kb4679)

The version of Veeam Service Provider Console installed on the remote host is prior to 8.1.0.21999. It is, therefore, affected by multiple vulnerabilities as referenced in the kb4679 advisory. - From the VSPC management agent machine, under the condition that the management agent is authorized on...

DRUPAL-CONTRIB-2024-067

This module enables you to authenticate users through an Identity Provider IdP or OAuth Server, allowing them to log in to your Drupal site. The module does not sufficiently escape query parameters sent to the callback URL when displaying error messages, particularly if the code parameter is...

Veeam Issues Patch for Critical RCE Vulnerability in Service Provider Console

Veeam has released security updates to address a critical flaw impacting Service Provider Console VSPC that could pave the way for remote code execution on susceptible instances. The vulnerability, tracked as CVE-2024-42448, carries a CVSS score of 9.9 out of a maximum of 10.0. The company noted...

CVE-2024-45206

A vulnerability in Veeam Service Provider Console has been identified, which allows to perform arbitrary HTTP requests to arbitrary hosts of the network and get information about internal resources...

CVE-2024-45206

A vulnerability in Veeam Service Provider Console has been identified, which allows to perform arbitrary HTTP requests to arbitrary hosts of the network and get information about internal resources...

CVE-2024-45206

A vulnerability in Veeam Service Provider Console has been identified, which allows to perform arbitrary HTTP requests to arbitrary hosts of the network and get information about internal resources...

CVE-2024-45206

The CVE-2024-45206 issue affects Veeam Service Provider Console (SPC) up through 8.0.x. It allows an attacker to perform arbitrary HTTP requests to arbitrary hosts in the network and access information about internal resources. Remediation: upgrade to Veeam Service Provider Console 8.1.0.21377 or...

Veeam Service Provider Console 安全漏洞

Veeam Service Provider Console is a cloud-enabled platform from Veeam USA. A security vulnerability exists in the Veeam Service Provider Console that originates from allowing arbitrary HTTP requests to be performed on arbitrary hosts on the network and obtain information about internal resources...

Veeam Service Provider Console 安全漏洞

Veeam Service Provider Console is a cloud-enabled platform from Veeam USA. A security vulnerability exists in Veeam Service Provider Console. An attacker could exploit the vulnerability to delete arbitrary files on the VSPC server machine...

SUSE CVE-2024-48916

Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC provider. As of time of publication, a kno...

PT-2024-9161 · Veeam · Veeam Service Provider Console

Name of the Vulnerable Software and Affected Versions: Veeam Service Provider Console VSPC versions prior to 8.1.0.21377 Description: The issue is related to access control errors in the Veeam Service Provider Console VSPC backup and restore software for remote and cloud clients. It allows a remo...

kafka-clients: privilege escalation to filesystem read-access via automatic ConfigProvider

A flaw was found in Apache Kafka Clients. Apache Kafka Clients accepts configuration data for customizing behavior and includes ConfigProvider plugins to manipulate these configurations. Apache Kafka also provides FileConfigProvider, DirectoryConfigProvider, and EnvVarConfigProvider...