Enel X Waybox 安全漏洞

The Enel X Waybox is a home charging station from Enel X, Inc. A security vulnerability exists in version 3.0 of the Enel X Waybox, which stems from a request directed to the web management application to obtain information such as the Waybox OS version or service configuration details...

openSUSE Leap 操作系统命令注入漏洞

openSUSE Leap is a new openSUSE build and a new hybrid Linux distribution from SUSE Germany. An operating system command injection vulnerability exists in openSUSE Leap that stems from the presence of command injection, where an attacker can provide configuration to a service to allow execution o...

Centreon Web 安全漏洞

Centreon Web is a set of open source system monitoring tools from the French company Centreon . The product provides monitoring capabilities for network, system and application resources. A security vulnerability exists in Centreon Web that stems from a SQL injection vulnerability in the service...

CVE-2024-39841

A SQL Injection vulnerability exists in the service configuration functionality in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and 22.10.x before 22.10.23...

CVE-2024-39841

A SQL Injection vulnerability exists in the service configuration functionality in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and 22.10.x before 22.10.23...

CVE-2024-39841

Centreon Web is affected by a SQL Injection in the service configuration via the testServiceExistence() function. The issue permits manipulation of SQL queries due to improper input handling, impacting Centreon Web versions 22.10.0–22.10.22, 23.04.0–23.04.18, 23.10.0–23.10.12, and 24.04.0–24.04.2...

[SECURITY] [DSA 5734-1] bind9 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5734-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 25, 2024 https://www.debian.org/security/faq -...

CVE-2024-0949 Improper Access Control in Talya Informatics' Elektraweb

Missing Authentication, Files or Directories Accessible to External Parties, Use of Hard-coded Credentials vulnerability in Talya Informatics Elektraweb allows Authentication Bypass. This issue affects Elektraweb: before v17.0.68...

CVE-2024-0949 Improper Access Control in Talya Informatics' Elektraweb

Missing Authentication, Files or Directories Accessible to External Parties, Use of Hard-coded Credentials vulnerability in Talya Informatics Elektraweb allows Authentication Bypass. This issue affects Elektraweb: before v17.0.68...

The vulnerability of the YAQL component in the interface for managing service configurations in the OpenStack Murano cloud platform, related to the lack of protection for service data, allows a attacker to disclose the protected information.

The vulnerability of the YAQL component in the interface for managing service configurations in the OpenStack Murano cloud platform is related to the lack of protection for operational data. Exploiting this vulnerability can allow an attacker, operating remotely, to disclose the protected...

Tenable Identity Exposure Secure Relay Operating System Command Injection Vulnerability

Tenable Identity Exposure Secure Relay is a schema for transferring Active Directory data from the network to Tenable Identity Exposure using Transport Layer Security TLS from Tenable USA. A security vulnerability exists in Tenable Identity Exposure Secure Relay versions prior to 3.59.4, which...

SUSE-SU-2023:0795-2 Security update for docker

This update for docker fixes the following issues: Docker was updated to 20.10.23-ce. See upstream changelog at https://docs.docker.com/engine/release-notes/201023 Docker was updated to 20.10.21-ce bsc1206065 See upstream changelog at https://docs.docker.com/engine/release-notes/201021 Security...

U.S. Dept Of Defense: LDAP Server NULL Bind Connection Information Disclosure

The LDAP server allowed anonymous access, which could lead to information disclosure. Attackers could exploit this vulnerability to gain access to sensitive information. The recommended mitigation is to configure the service to disallow NULL BINDs...

CVE-2022-47529

Insecure Win32 memory objects in Endpoint Windows Agents in RSA NetWitness Platform before 12.2 allow local and admin Windows user accounts to modify the endpoint agent service configuration: to either disable it completely or run user-supplied code or commands, thereby bypassing tamper-protectio...

CVE-2022-20499

In validateForCommonR1andR2 of PasspointConfiguration.java, uncaught errors in parsing stored configs could lead to local persistent denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12L...

IBM Robotic Process Automation Information Disclosure Vulnerability (CNVD-2022-55661)

IBM Robotic Process Automation is a robotic process automation product from IBM, Inc. It helps you automate more business and IT processes at scale with the ease and speed of traditional RPA. IBM Robotic Process Automation version 21.0.2 is vulnerable to an information disclosure vulnerability th...

CVE-2022-22414

IBM Robotic Process Automation 21.0.2 could allow a local user to obtain sensitive web service configuration credentials from system memory. IBM X-Force ID: 223026...

Design/Logic Flaw

IBM Robotic Process Automation 21.0.2 could allow a local user to obtain sensitive web service configuration credentials from system memory. IBM X-Force ID: 223026...

CVE-2022-24917 Reflected XSS in service configuration window of Zabbix Frontend

An authenticated user can create a link with reflected Javascript code inside it for services’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code has access to all...

Zabbix Frontend 跨站脚本漏洞

A cross-site scripting vulnerability in Zabbix Frontend, a monitoring software front-end tool from Zabbix USA, stems from a lack of data validation filtering of user-supplied data and output in the service configuration window, which could be exploited by an authenticated attacker to create a lin...