Security Bulletin: IBM Security SOAR is vulnerable to denial of service (CVE-2024-45296)

Summary IBM Security SOAR was using a UI component which contained a vulnerability that could lead to a client-side regular expression denial of service CVE-2024-45296. The vulnerable component has been removed from the UI. Please upgrade to IBM Security SOAR version 51.0.4.0 or later...

CVE-2024-53253

Sentry is an error tracking and performance monitoring platform. Version 24.11.0, and only version 24.11.0, is vulnerable to a scenario where a specific error message generated by the Sentry platform could include a plaintext Client ID and Client Secret for an application integration. The Client ...

CVE-2024-53253: Generation of Error Message Containing Sensitive Information

Sentry is an error tracking and performance monitoring platform. Version 24.11.0, and only version 24.11.0, is vulnerable to a scenario where a specific error message generated by the Sentry platform could include a plaintext Client ID and Client Secret for an application integration. The Client ...

GHSA-6247-7862-Q2PQ Apache Helix Front (UI) component contained a hard-coded secret

The Apache Helix Front UI component contained a hard-coded secret, allowing an attacker to spoof sessions by generating their own fake cookies. This issue affects Apache Helix Front UI: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are...

Malicious code in passport-ui-component (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2024-2448

An OS command injection vulnerability has been identified in LoadMaster. An authenticated UI user with any permission settings may be able to inject commands into a UI component using a shell command resulting in OS command injection...

PT-2024-3305 · Kemp · Loadmaster

Name of the Vulnerable Software and Affected Versions: LoadMaster affected versions not specified Description: An OS command injection vulnerability has been identified in LoadMaster. An authenticated UI user with any permission settings may be able to inject commands into a UI component using a...

CVE-2023-51982

CrateDB 5.5.1 is contains an authentication bypass vulnerability in the Admin UI component. After configuring password authentication and Local In the case of an address, identity authentication can be bypassed by setting the X-Real IP request header to a specific value and accessing the Admin UI...

CVE-2023-34245: Improper Neutralization of Input During Web Page Generation

@udecode/plate-link is the link handler for the udecode/plate rich-text editor plugin system for Slate & React. Affected versions of the link plugin and link UI component do not sanitize URLs to prevent use of the javascript: scheme. As a result, links with JavaScript URLs can be inserted into th...

PT-2023-24769

Name of the Vulnerable Software and Affected Versions @udecode/plate-link versions prior to 20.0.0 Description The issue arises from the lack of URL sanitization in affected versions of the link plugin and link UI component, allowing links with JavaScript URLs to be inserted into the Plate editor...

Security Bulletin: IBM Event Streams is affected by a vulnerability in Express.js Express (CVE-2022-24999)

Summary This security vulnerability affects qs package before 6.10.3 that is used by the IBM Event Streams UI component. Vulnerability Details CVEID:CVE-2022-24999 DESCRIPTION: Express.js Express is vulnerable to a denial of service, caused by a prototype pollution flaw in qs. By adding or...

CVE-2023-26214

The BusinessConnect UI component of TIBCO Software Inc.'s TIBCO BusinessConnect contains easily exploitable Reflected Cross Site Scripting XSS vulnerabilities that allow a low privileged attacker with network access to execute scripts targeting the affected system or the victim's local system...

Cross site scripting

The BusinessConnect UI component of TIBCO Software Inc.'s TIBCO BusinessConnect contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a cross-site scripting XSS attack on the affected system. Affected releases are TIBCO Software Inc.'s...

Cross site scripting

The BusinessConnect UI component of TIBCO Software Inc.'s TIBCO BusinessConnect contains easily exploitable Reflected Cross Site Scripting XSS vulnerabilities that allow a low privileged attacker with network access to execute scripts targeting the affected system or the victim's local system...

CVE-2022-41567: Improper Neutralization of Input During Web Page Generation

The BusinessConnect UI component of TIBCO Software Inc.'s TIBCO BusinessConnect contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a cross-site scripting XSS attack on the affected system. Affected releases are TIBCO Software Inc.'s...

PT-2023-20542

Name of the Vulnerable Software and Affected Versions TIBCO BusinessConnect versions 7.3.0 and below Description The BusinessConnect UI component of TIBCO Software Inc.'s TIBCO BusinessConnect contains easily exploitable Reflected Cross Site Scripting XSS vulnerabilities. This allows a low...

CVE-2023-26214: Improper Neutralization of Input During Web Page Generation

The BusinessConnect UI component of TIBCO Software Inc.'s TIBCO BusinessConnect contains easily exploitable Reflected Cross Site Scripting XSS vulnerabilities that allow a low privileged attacker with network access to execute scripts targeting the affected system or the victim's local system...

Malicious code in central-ui-component (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2782e2ac553cc54c3f260350e2d849a07145301efed884e5526b17cab6e08973 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-166 Malicious code in central-ui-component (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2782e2ac553cc54c3f260350e2d849a07145301efed884e5526b17cab6e08973 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-47500

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Apache Software Foundation Apache Helix UI component.This issue affects Apache Helix all releases from 0.8.0 to 1.0.4. Solution: removed the the forward component since it was improper designed for UI embedding. User please upgrad...