CVE-2024-0394 Rapid7 Minerva Armor Privilege Escalation

Rapid7 Minerva Armor versions below 4.5.5 suffer from a privilege escalation vulnerability whereby an authenticated attacker can elevate privileges and execute arbitrary code with SYSTEM privilege. The vulnerability is caused by the product's implementation of OpenSSL'sOPENSSLDIR parameter where...

CVE-2024-2745 Rapid7 InsightVM Sensitive Information Exposure via URL

Rapid7's InsightVM maintenance mode login page suffers from a sensitive information exposure vulnerability whereby, sensitive information is exposed through query strings in the URL when login is attempted before the page is fully loaded. This vulnerability allows attackers to acquire sensitive...

CVE-2024-2745

Affected product : Rapid7 InsightVM maintenance mode login page. Vulnerability : sensitive information exposure via URL query strings when a login attempt occurs before the page is fully loaded. Impact : potential exposure of passwords, authentication tokens, usernames, and other sensitive data. ...

CVE-2024-2745 Rapid7 InsightVM Sensitive Information Exposure via URL

Rapid7's InsightVM maintenance mode login page suffers from a sensitive information exposure vulnerability whereby, sensitive information is exposed through query strings in the URL when login is attempted before the page is fully loaded. This vulnerability allows attackers to acquire sensitive...

IBM: jazz.net - publicly accessible .svn repositories

The vulnerability regarding publicly accessible .svn/entries files in jazz.net was reported to IBM, analyzed, and remediated. The issue was identified by an external researcher...

IBM: XSS in IBM InfoCenter

The IBM InfoCenter was found to have an XSS vulnerability. The issue was reported to IBM, analyzed, and has been remediated...

IBM: XSS Refelected on jazz.net

A cross-site scripting vulnerability was reported on jazz.net. The issue was analyzed and remediated by IBM...

IBM: XSS in Aspera documentation website

The XSS vulnerability in the Aspera documentation website was reported to IBM, analyzed, and subsequently remediated. The external researcher who discovered the flaw was acknowledged for their contribution...

IBM: Unauthenticated Remote Access to Testing Endpoint

Unauthenticated remote access to a testing endpoint was reported, analyzed and remediated...

IBM: Jenkins server access due to weak password

Jenkins server access was gained due to a weak password. The issue was reported to IBM, analyzed, and remediated...

IBM: RXSS in hidden parameter

RXSS in hidden parameter was reported to IBM, analyzed, and has been remediated. The vulnerability was a reflected cross-site scripting issue found in a hidden parameter...

IBM: Nginx Alias Traversal - babel.bluetab.net

Vulnerability description not provided...

SlideOnline <= 1.2.1 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks The PoC will be displayed once the issue has...

Security Bulletin: IBM Security Verify Information Queue has multiple third-party library vulnerabilities

Summary IBM Security Verify Information Queue ISIQ v10.0.5 has remediated vulnerabilities in the third-party libraries that it uses. Vulnerability Details CVEID:CVE-2022-41946 DESCRIPTION: Postgresql JDBC could allow a local authenticated attacker to obtain sensitive information, caused by not...

CVE-2023-2273

Rapid7 Insight Agent token handler versions 3.2.6 and below, suffer from a Directory Traversal vulnerability whereby unsanitized input from a CLI argument flows into io.ioutil.WriteFile, where it is used as a path. This can result in a Path Traversal vulnerability and allow an attacker to write...

Path traversal

Rapid7 Insight Agent token handler versions 3.2.6 and below, suffer from a Directory Traversal vulnerability whereby unsanitized input from a CLI argument flows into io.ioutil.WriteFile, where it is used as a path. This can result in a Path Traversal vulnerability and allow an attacker to write...

IBM: Subdomain Takeover Affecting at vex.weather.com

Vulnerability description not provided...

IBM: IBM Maximo Asset Management could allow a remote attacker to bypass authentication due to improper access controls

Improper access controls in IBM Maximo Asset Management could allow a remote attacker to bypass authentication. This issue was reported to IBM, analyzed, and remediated...

CVE-2022-3990

HPSFViewer might allow Escalation of Privilege. This potential vulnerability was remediated on July 29th, 2022. Customers who opted for automatic updates should have already received the remediation...

Privilege escalation via HPSFViewer

HPSFViewer might allow Escalation of Privilege. This potential vulnerability was remediated on July 29th, 2022. Customers who opted for automatic updates should have already received the remediation. HP strives to address all security issues with HP apps at best possible speed and make the latest...