CVE-2024-38641

CVE-2024-38641 is an OS command injection vulnerability affecting QNAP QTS and QuTS hero. The issue could allow local network users to execute commands via unspecified vectors; impact is described as high (confidentiality, integrity, and availability). Fixed in QTS 5.1.8.2823 build 20240712 and l...

CVE-2024-32771 QTS, QuTS hero

An improper restriction of excessive authentication attempts vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow local network authenticated administrators to perform an arbitrary number of authentication attempts via...

Security Bulletin: Vulnerability in Go affects watsonx.data

Summary TheScalarMult and ScalarBaseMult methods of the P256 Curve in Golang Go have an unspecified error that returns an incorrect result which has an unknown impact and attack vector. watsonx.data may be affected by this. Vulnerability Details CVEID:CVE-2023-24532 DESCRIPTION: An unspecified...

PT-2024-37270 · Imanage · Imanager

Name of the Vulnerable Software and Affected Versions: Manager affected versions not specified Description: This issue allows unauthenticated remote attackers to bypass authentication and gain access to the Manager's APIs. The estimated number of potentially affected devices worldwide is not...

PT-2024-9683 · Solarwinds · Solarwinds Platform

Name of the Vulnerable Software and Affected Versions: SolarWinds Platform affected versions not specified Description: The issue is related to a lack of protection for the web page structure in the Search/Node Information Section component of the SolarWinds Platform user interface. This allows a...

PT-2024-9569 · Veeam · Veeam Agent For Linux

Name of the Vulnerable Software and Affected Versions: Veeam Agent for Linux affected versions not specified Description: A missing authorization vulnerability allows a local low-privileged user on the machine to escalate their privileges to root level. This issue is related to the lack of an...

Security Bulletin: Vulnerabilities in Golang Go affect watsonx.data

Summary Golang Go has multiple vulnerabilities that include HTTP request smuggling, remote attacks to obtain sensitive information, denial of service, and unspecified errors with return an incorrect results. These can affect watsonx.data. Vulnerability Details CVEID:CVE-2022-1705 DESCRIPTION:...

PT-2024-29705 · Systemui · Systemui

Name of the Vulnerable Software and Affected Versions: SystemUI module affected versions not specified Description: The issue is related to an access control vulnerability in the SystemUI module. Successful exploitation of this vulnerability may affect service confidentiality. Recommendations: At...

PT-2024-31635 · Huawei · Emui +1

Name of the Vulnerable Software and Affected Versions: Camera driver module affected versions not specified Description: The issue is related to an access permission verification vulnerability in the camera driver module. Successful exploitation of this vulnerability will affect availability. The...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to multiple Base OS issues

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to multiple Base OS issues. We have updated the base image used by our Speech Services and the following vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details...

PT-2025-3745 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android affected versions not specified Description: The issue is related to insufficient input validation in Android operating systems. Exploitation of this issue may allow an attacker to elevate their privileges. Recommendations: At the...

PT-2024-6552 · Grafana +3 · Grafana +3

Name of the Vulnerable Software and Affected Versions: Grafana affected versions not specified Description: The issue is related to the wrong permission being applied to the alert rule write API endpoint in Grafana. This allows users with permission to write external alert instances to also write...

PT-2024-41039 · Unknown · Knowledge Space

Name of the Vulnerable Software and Affected Versions: Knowledge Space affected versions not specified Description: The issue is related to a lack of user permission checks in the Knowledge Space integrated planning platform's application programming interface. This could allow a remote attacker ...

PT-2024-29878 · Cyberark · Cyberark

Name of the Vulnerable Software and Affected Versions: CyberArk affected versions not specified Description: The issue concerns the exposure of sensitive information to an unauthorized actor. This is a case of CWE-200, which involves the exposure of confidential information. Recommendations: At t...

PT-2024-29879 · Cyberark · Cyberark

Name of the Vulnerable Software and Affected Versions: CyberArk affected versions not specified Description: The issue concerns the exposure of sensitive information to an unauthorized actor. This is a critical vulnerability that affects CyberArk, allowing unauthorized access to confidential data...

BIT-VALKEY-2023-31655

redis v7.0.10 was discovered to contain a segmentation violation. This vulnerability allows attackers to cause a Denial of Service DoS via unspecified vectors...

BIT-KEYDB-2023-31655

redis v7.0.10 was discovered to contain a segmentation violation. This vulnerability allows attackers to cause a Denial of Service DoS via unspecified vectors...

Security Bulletin: IBM Sterling Connect:Direct Web Service is vulnerable to multiple vulnerabilities due to IBM Java

Summary IBM Sterling Connect:Direct Web Service uses IBM Java SE which is vulnerable to multiple CVEs. Vulnerability Details CVEID:CVE-2024-21094 DESCRIPTION: An unspecified vulnerability in Java SE related to the VM component could allow a remote attacker to cause no confidentiality impact, low...

PT-2024-29935 · Avtec · Avtec Outpost

Name of the Vulnerable Software and Affected Versions: Avtec Outpost affected versions not specified Description: The issue concerns the use of a default cryptographic key in Avtec Outpost, which can be exploited to decrypt sensitive information. Recommendations: At the moment, there is no...

python-certifi: Removal of e-Tugra root certificate

A flaw was found in the python-certifi package. This issue occurs when the e-Tugra root certificate in Certifi is removed, resulting in an unspecified error that has an unknown impact and attack vector...