3216 matches found
CVE-2024-27182
CVE-2024-27182 affects Apache Linkis
GHSA-HRMX-8JJV-G758 Navidrome uses MD5 hashing algorithm
Use of insecure hashing algorithm in the Gravatar's service in Navidrome v0.52.3 allows attackers to manipulate a user's account information...
CVE-2024-41259
Use of insecure hashing algorithm in the Gravatar's service in Navidrome v0.52.3 allows attackers to manipulate a user's account information...
CVE-2024-41259
Use of insecure hashing algorithm in the Gravatar's service in Navidrome v0.52.3 allows attackers to manipulate a user's account information...
CVE-2024-41259
Use of insecure hashing algorithm in the Gravatar's service in Navidrome v0.52.3 allows attackers to manipulate a user's account information...
CVE-2024-6895
Insufficient authentication in user account management in Yugabyte Platform allows local network attackers with a compromised user session to change critical security information without re-authentication. An attacker with user session and access to application can modify settings such as passwor...
CVE-2024-6895 Insecure Account Profile Management
Insufficient authentication in user account management in Yugabyte Platform allows local network attackers with a compromised user session to change critical security information without re-authentication. An attacker with user session and access to application can modify settings such as passwor...
CVE-2024-41107
The CloudStack SAML authentication disabled by default does not enforce signature check. In CloudStack environments where SAML authentication is enabled, an attacker that initiates CloudStack SAML single sign-on authentication can bypass SAML authentication by submitting a spoofed SAML response...
CVE-2024-40644 gitoxide's gix-path can use a fake program files location
gitoxide An idiomatic, lean, fast & safe pure Rust implementation of Git. gix-path can be tricked into running another git.exe placed in an untrusted location by a limited user account on Windows systems. Windows permits limited user accounts without administrative privileges to create new...
CVE-2024-40644
The CVE-2024-40644 issue affects gitoxide’s gix-path on Windows. Affected code path allows a limited user to place a malicious git.exe in hard-coded fallback locations (C:/Program Files/Git/mingw64/bin or C:/Program Files (x86)/Git/mingw32/bin). gix-path’s env logic may directly execute that git....
PT-2024-28228 · Cloud Foundry Foundation · Cloud Foundry
Name of the Vulnerable Software and Affected Versions: Cloud Foundry Foundation version v40.17.0 Description: The issue is related to a failure in properly synchronizing a user's permissions in the User Account and Authentication UAA system. This potentially results in users retaining access righ...
Critical Error: "Unable to contact the database server. Ensure Provisioning Services is configured correctly"
When starting Provisioning Services Console, the following error appears: “Critical Error: Unable to contact the database server. Ensure Provisioning Services is configured correctly”. Background After running the Configuration Wizard and configuring a user account for the Provisioning Services,...
Error 1603 Occurs When Installing Hotfix Rollup Pack 2 on XenApp 6.0
Error 1603 occurs when installing Hotfix Rollup Pack2 on XenApp 6.0. Troubleshooting Methodology The Technical Support Engineer completedthefollowing steps to resolve the issue: Enabled msi logging and attempted the hotfix rollup pack install again. Error 1603 occurred. Examined the msi logs; the...
CVE-2024-6328 MStore API – Create Native Android & iOS Apps On The Cloud <= 4.14.7 - Authentication Bypass
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.14.7. This is due to insufficient verification on the 'phone' parameter of the 'firebasesmslogin' and 'firebasesmsloginv2' functions...
CVE-2024-37148
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can exploit a SQL injection vulnerability in some AJAX scripts to alter another user account data and take control of it. Upgrad...
CVE-2024-37148
Technical details (affected versions, components, fixes) are not provided in connected documents. The initial CVE description notes GLPI SQL injection with upgrade to 10.0.16. Monitor vendor advisories for updates.
PT-2024-5860 · Glpi +2 · Glpi +2
Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 10.0.16 Description: The issue is related to a SQL injection vulnerability in some AJAX scripts of the GLPI software. This vulnerability can be exploited by an authenticated user to alter another user's account data and...
Insecure Deserialization
TYPO3 is vulnerable to Insecure Deserialization. The vulnerability is due to failing to properly validate incoming data in the suggest wizard, which allows an attacker to exploit insecure unserialize operations. A valid backend user account is required to exploit this vulnerability...