CVE-2024-45071

CVE-2024-45071 affects IBM WebSphere Application Server 8.5 and 9.0 and is a stored cross-site scripting vulnerability. A privileged user can embed arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a trusted session. Several IBM security bulletins link to th...

UBUNTU-CVE-2024-45217

Insecure Default Initialization of Resource vulnerability in Apache Solr. New ConfigSets that are created via a Restore command, which copy a configSet from the backup and give it a new name, are created without setting the "trusted" metadata. ConfigSets that do not contain the flag are trusted...

CVE-2024-45217 Apache Solr: ConfigSets created during a backup restore command are trusted implicitly

Insecure Default Initialization of Resource vulnerability in Apache Solr. New ConfigSets that are created via a Restore command, which copy a configSet from the backup and give it a new name, are created without setting the "trusted" metadata. ConfigSets that do not contain the flag are trusted...

CVE-2024-45217 Apache Solr: ConfigSets created during a backup restore command are trusted implicitly

Insecure Default Initialization of Resource vulnerability in Apache Solr. New ConfigSets that are created via a Restore command, which copy a configSet from the backup and give it a new name, are created without setting the "trusted" metadata. ConfigSets that do not contain the flag are trusted...

CVE-2024-45217

CVE-2024-45217 describes an insecure default initialization of resources in Apache Solr. New ConfigSets created via Restore may be created without the trusted metadata, causing some ConfigSets to be implicitly trusted and potentially able to load custom code into classloaders. The issue affects S...

CVE-2024-49340

IBM Watson Studio Local 1.2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

Apache Solr 安全漏洞

Apache Solr is the United States Apache Apache Foundation of a search server based on Lucene a full-text search engine. The product supports level search , vertical search , highlighting search results and so on. A code issue vulnerability exists in Apache Solr, which stems from the presence of a...

httpd security update

2.4.6-99.0.5.1 - Differentiate trusted sources Orabug: 37100272CVE-2024-38476...

CVE-2024-44977

...

PT-2024-31485 · Apache · Apache Solr

Name of the Vulnerable Software and Affected Versions: Apache Solr versions 6.6.0 through 8.11.3 Apache Solr versions 9.0.0 through 9.6.x Description: The issue arises from the insecure default initialization of resources in Apache Solr, where new ConfigSets created via a Restore command lack the...

IBM Watson Studio Local 跨站请求伪造漏洞

IBM Watson Studio Local is a suite of collaborative data processing solutions from International Business Machines IBM. The product includes features such as data analysis, data visualization, data cleansing and streaming data extraction. A cross-site request forgery vulnerability exists in IBM...

HPESBHF04720 rev.1 - Certain HPE ProLiant DX Servers Using Certain Intel Processors, INTEL-SA-01010, Intel TDX Module Software Advisory, Local Escalation of Privilege Vulnerability

Potential Security Impact: Local: Escalation of Privilege SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE ProLiant DX4120 Gen11 - Prior to v2.2005-27-2024 HPE ProLiant DX560 Gen11 - Prior to v2.2005-27-2024 HPE ProLiant DX380 Gen11 - Prior to v2.2005-27-2024 HPE ProLiant DX380...

CVE-2024-29040

...

The vulnerability of Windows operating system kernels, related to the swapping of a non-trusted pointer, allows attackers to escalate their privileges.

The vulnerability of the Windows operating system’s kernel is related to the swapping of an unreliable pointer. Exploiting this vulnerability can allow an attacker to increase their privileges...

The vulnerability of the secure kernel mode of Windows operating systems allows attackers to enhance their privileges.

The vulnerability of the Windows operating system’s safe mode relates to the swapping of a non-trusted pointer. Exploiting this vulnerability can allow an attacker to increase their privileges...

Gradio vulnerable to SSRF in the path parameter of /queue/join

Impact What kind of vulnerability is it? Who is impacted? This vulnerability relates to Server-Side Request Forgery SSRF in the /queue/join endpoint. Gradio’s asyncsaveurltocache function allows attackers to force the Gradio server to send HTTP requests to user-controlled URLs. This could enable...

CVE-2024-45746

An issue was discovered in Trusted Firmware-M through 2.1.0. User provided and controlled mailbox messages contain a pointer to a list of input arguments invec and output arguments outvec. These list pointers are never validated. Each argument list contains a buffer pointer and a buffer length...

CVE-2024-47664

In the Linux kernel, the following vulnerability has been resolved: spi: hisi-kunpeng: Add verification for the maxfrequency provided by the firmware If the value of maxspeedhz is 0, it may cause a division by zero error in hisicalceffectivespeed. The value of maxspeedhz is provided by firmware...

CVE-2024-47664 spi: hisi-kunpeng: Add verification for the max_frequency provided by the firmware

In the Linux kernel, the following vulnerability has been resolved: spi: hisi-kunpeng: Add verification for the maxfrequency provided by the firmware If the value of maxspeedhz is 0, it may cause a division by zero error in hisicalceffectivespeed. The value of maxspeedhz is provided by firmware...

Microsoft Detects Growing Use of File Hosting Services in Business Email Compromise Attacks

Microsoft is warning of cyber attack campaigns that abuse legitimate file hosting services such as SharePoint, OneDrive, and Dropbox that are widely used in enterprise environments as a defense evasion tactic. The end goal of the campaigns are broad and varied, allowing threat actors to compromis...