CVE-2024-4537 IDOR vulnerability in Janto Ticketing Software

IDOR vulnerability in Janto Ticketing Software affecting version 4.3r10. This vulnerability could allow a remote user to obtain the download URL of another user to obtain the purchased ticket...

CVE-2024-4537

CVE-2024-4537 describes an IDOR vulnerability in Janto Ticketing Software version 4.3r10. The issue could allow a remote attacker to obtain another user’s download URL to access purchased tickets, indicating a potential confidentiality impact. Server-side access control appears insufficient to pr...

CVE-2024-34091

An issue was discovered in Archer Platform 6 before 2024.04. There is a stored cross-site scripting XSS vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When...

CVE-2024-4418

A race condition leading to a stack use-after-free flaw was found in libvirt. Due to a bad assumption in the virNetClientIOEventLoop method, the data pointer to a stack-allocated virNetClientIOEventData structure ended up being used in the virNetClientIOEventFD callback while the data pointer's...

CVE-2021-20556

IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 could allow a remote user to enumerate usernames due to differentiating error messages on existing usernames. IBM X-Force ID: 199181...

CVE-2024-25015

IBM MQ has a vulnerability CVE-2024-25015 affecting IBM MQ 9.2 LTS, 9.3 LTS, and 9.3 CD Internet Pass-Thru where a remote attacker could cause a denial of service by sending HTTP requests that consume all available resources. The CVSS base score is 7.5 (NETWORK, NO privileges, no user interaction...

CVE-2024-25015 IBM MQ denial of service

IBM MQ 9.2 LTS, 9.3 LTS, and 9.3 CD Internet Pass-Thru could allow a remote user to cause a denial of service by sending HTTP requests that would consume all available resources. IBM X-Force ID: 281278...

mysql: Server: RAPID unspecified vulnerability (CPU Jan 2024)

A flaw was found in MySQL Server RAPID. This vulnerability allows a malicious user with low privileges and network access to compromise the MySQL Server. A successful attack can result in the unauthorized ability to cause a hang, or a frequently repeatable crash, a complete denial of service DOS,...

Security Bulletin: IBM MQ Internet Pass-Thru is vulnerable to a denial of service issue (CVE-2024-25015)

Summary IBM MQ Internet Pass-Thru has addressed a vulnerability in which HTTP requests could cause a denial of service. Vulnerability Details CVEID:CVE-2024-25015 DESCRIPTION: IBM MQ Internet Pass-Thru could allow a remote user to cause a denial of service by sending HTTP requests that would...

CVE-2023-3597

A flaw was found in Keycloak, where it does not correctly validate its client step-up authentication in org.keycloak.authentication. This flaw allows a remote user authenticated with a password to register a false second authentication factor along with an existing one and bypass authentication...

CVE-2023-3597

Keycloak vulnerability CVE-2023-3597 affects the client step-up authentication logic (org.keycloak.authentication). A remote user authenticated with a password can register a false second authentication factor, enabling bypass of authentication. CVSSv3.1 base score 5.0 (MEDIUM). No explicit explo...

PT-2024-23851 · Synapse +2 · Synapse +2

Name of the Vulnerable Software and Affected Versions: Synapse versions prior to 1.105.1 Description: A remote Matrix user with malicious intent, sharing a room with Synapse instances, can dispatch specially crafted events to exploit a weakness in the V2 state resolution algorithm. This can induc...

CVE-2024-3796 Cross-site Scripting vulnerability in WBSAirback

Vulnerability in WBSAirback 21.02.04, which consists of a stored Cross-Site Scripting XSS through /admin/BackupSchedule, description field. Exploitation of this vulnerability could allow a remote user to send a specially crafted URL to the victim and steal their session data...

CVE-2024-3796 Cross-site Scripting vulnerability in WBSAirback

Vulnerability in WBSAirback 21.02.04, which consists of a stored Cross-Site Scripting XSS through /admin/BackupSchedule, description field. Exploitation of this vulnerability could allow a remote user to send a specially crafted URL to the victim and steal their session data...

CVE-2024-3796

CVE-2024-3796 affects WBSAirback 21.02.04 with a stored XSS in the /admin/BackupSchedule endpoint (description field). A remote attacker could send a crafted URL to steal session data. Exploitation details are not confirmed in all sources, but PT-2024-27865 recommends disabling access to the /adm...

CVE-2024-3786

Vulnerability in WBSAirback 21.02.04, which involves improper neutralisation of Server-Side Includes SSI, through Device Synchronizations /admin/DeviceReplication. Exploitation of this vulnerability could allow a remote user to execute arbitrary code...

CVE-2024-3785

Vulnerability in WBSAirback 21.02.04, which involves improper neutralisation of Server-Side Includes SSI, through Device NAS shared section /admin/DeviceNAS. Exploitation of this vulnerability could allow a remote user to execute arbitrary code...

CVE-2024-3795

WBSAirback 21.02.04 is affected by a stored XSS vulnerability in the /admin/BackupTemplate endpoint, specifically in the name and description fields. The vulnerability could let an attacker craft a URL to execute script in a victim’s browser and potentially steal session data. Affected software/c...

CVE-2024-3795 Cross-site Scripting vulnerability in WBSAirback

Vulnerability in WBSAirback 21.02.04, which consists of a stored Cross-Site Scripting XSS through /admin/BackupTemplate, name / description fields. Exploitation of this vulnerability could allow a remote user to send a specially crafted URL to the victim and steal their session data...

CVE-2024-3795 Cross-site Scripting vulnerability in WBSAirback

Vulnerability in WBSAirback 21.02.04, which consists of a stored Cross-Site Scripting XSS through /admin/BackupTemplate, name / description fields. Exploitation of this vulnerability could allow a remote user to send a specially crafted URL to the victim and steal their session data...