ROS-20241203-10

Vulnerability in the IPAuthenticationProvider component of a centralized service for maintaining configuration information and providing distributed synchronization and group services. configuration, naming, providing distributed synchronization and provisioning of group services Apache ZooKeeper...

PT-2024-9574 · Ruijie · Ruijie Reyee Os

Name of the Vulnerable Software and Affected Versions: Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x Description: The issue allows attackers to force Ruijie's proxy servers to perform any request the attackers choose, potentially giving them access to internal services used by...

PT-2024-9532 · Hitachi · Hitachi Ops Center Common Services +1

Name of the Vulnerable Software and Affected Versions: Hitachi Ops Center Common Services versions 10.9.3-00 through 11.0.3-00 Hitachi Ops Center OVA versions 10.9.3-00 through 11.0.2-01 Description: The issue is related to the use of default credentials in Hitachi Ops Center Common Services, whi...

CVE-2024-53990

The CVE-2024-53990 issue affects the AsyncHttpClient (AHC) library where an auto-enabled CookieStore silently replaces cookies with the same name from the cookie jar. This can cause cookies from one user to be used in another user’s requests, creating potential unauthorized data exposure in multi...

CVE-2024-53990 AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. When making any HTTP request, the automatically enabled and self-managed CookieStore aka cookie jar will silently replace explicitly defined Cookies with any that ha...

WordPress FAT Services Booking plugin <= 5.6 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Dave Jong Patchstack in WordPress Plugin FAT Services Booking versions = 5.6...

WordPress FAT Services Booking plugin <= 5.6 - Subscriber+ Site-Wide Cross Site Scripting (XSS) vulnerability

Subscriber+ Site-Wide Cross Site Scripting XSS vulnerability discovered by Dave Jong Patchstack in WordPress Plugin FAT Services Booking versions = 5.6...

CVE-2024-52503 WordPress Tailored Tools plugin <= 1.8.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Tailored Web Services Tailored Tools allows Stored XSS.This issue affects Tailored Tools: from n/a through 1.8.4...

CVE-2024-10490

The CVE-2024-10490 issue affects B&R mapp Cockpit, View, Services, Motion, and Vision prior to version 6.0, due to an Authentication Bypass in the OPC UA Server configuration. The root cause is an authentication bypass that can be triggered by an unauthenticated network-based attacker, potentiall...

CVE-2024-10490 Authentication bypass flaw in several mapp components

An “Authentication Bypass Using an Alternate Path or Channel” vulnerability in the OPC UA Server configuration required for B&R mapp Cockpit before 6.0, B&R mapp View before 6.0, B&R mapp Services before 6.0, B&R mapp Motion before 6.0 and B&R mapp Vision before 6.0 may be used by an...

Server Side Request Forgery (SSRF)

github.com/openshift/console is vulnerable to Server Side Request Forgery SSRF. The vulnerability is due to the lack of proper checks on the /api/dev-console/proxy/internet endpoint, which allows authenticated users to make arbitrary HTTP requests from the console's pod to services inside the...

PT-2024-40372 · Varnish +1 · Varnish +1

Name of the Vulnerable Software and Affected Versions: ezplatform-http-cache affected versions not specified Description: The issue is related to the BREACH vulnerability, which affects HTTP compression and can allow secrets to be extracted through carefully crafted requests. This is due to...

PT-2024-16313 · B&R · B&R Mapp Vision +5

Name of the Vulnerable Software and Affected Versions: B&R mapp Cockpit versions prior to 6.0 B&R mapp View versions prior to 6.0 B&R mapp Services versions prior to 6.0 B&R mapp Motion versions prior to 6.0 B&R mapp Vision versions prior to 6.0 Description: An "Authentication Bypass Using an...

CVE-2024-53865

zhmcclient is a pure Python client library for the IBM Z HMC Web Services API. In affected versions the Python package "zhmcclient" writes password-like properties in clear text into its HMC and API logs in the following cases: 1. The 'boot-ftp-password' and 'ssc-master-pw' properties when creati...

Cross-site Scripting (XSS)

LibreNMS is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to insufficient input validation, allowing authenticated users to inject arbitrary JavaScript through the "descr" parameter when adding a service to a device in the "Services" tab of the Device page...

[SECURITY] Fedora 41 Update: nss-3.106.0-1.fc41

Network Security Services NSS is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSL v2 and v3, TLS, PKCS 5, PKCS 7, PKCS 11, PKCS 12, S/MIME, X.509 v3 certificates, and other security...

[SECURITY] Fedora 40 Update: nss-3.106.0-1.fc40

Network Security Services NSS is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSL v2 and v3, TLS, PKCS 5, PKCS 7, PKCS 11, PKCS 12, S/MIME, X.509 v3 certificates, and other security...

Provisioning Services with multiple non routable streaming networks

Using Provisioning Services with multiple non routable streaming networks may result in target devices failing to fully boot.A simple example is described below, how customers may have multiple PVS servers added to each network. Example single PVS server farm, the PVS server has three network...

APT-C-60 Hackers Exploit StatCounter and Bitbucket in SpyGlace Malware Campaign

The threat actor known as APT-C-60 has been linked to a cyber attack targeting an unnamed organization in Japan that used a job application-themed lure to deliver the SpyGlace backdoor. That's according to findings from JPCERT/CC, which said the intrusion leveraged legitimate services like Google...

Galaxy Software Services iota C.ai Conversational Platform 代码注入漏洞

Galaxy Software Services iota C.ai Conversational Platform is an intelligent AI conversational platform from Galaxy Software Services China. A code injection vulnerability exists in Galaxy Software Services iota C.ai Conversational Platform versions 1.0.0 through 2.1.3, which stems from a code...