CVE-2024-24771 Open Forms potential multi-factor authentication bypass

Open Forms allows users create and publish smart forms. Versions prior to 2.2.9, 2.3.7, 2.4.5, and 2.5.2 contain a non-exploitable multi-factor authentication weakness. Superusers who have their credentials username + password compromised could potentially have the second-factor authentication...

CVE-2024-24771

Open Forms CVE-2024-24771 affects multiple versions prior to 2.2.9, 2.3.7, 2.4.5, and 2.5.2, with a non-exploitable MFA weakness that could allow a second-factor bypass if a superuser’s credentials are compromised. Attack could let the attacker view sensitive submissions or impersonate staff if b...

Qualcomm Chipsets Security Vulnerability

Qualcomm Chipsets are a family of chipsets from Qualcomm Incorporated USA. A security vulnerability exists in Qualcomm Chipsets that stems from improper access control in HAB leading to memory corruption in automotive multimedia...

The vulnerability of CoreMedia’s component in the macOS operating system allows a intruder to gain unauthorized access to the camera.

The vulnerability of CoreMedia’s macOS component is related to access control deficiencies. Exploiting this vulnerability could allow an attacker to gain unauthorized access to the camera...

The vulnerability of the NEXO-OS operating system in the Bosch Nexo cordless nutrunner and Bosch Nexo special cordless nutrunner tools used in production lines allows a intruder to gain unauthorized access to the database.

The vulnerability of the NEXO-OS operating system for tools used in production line assembly work, such as the Bosch Nexo cordless nutrunner and the Bosch Nexo special cordless nutrunner, is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability ca...

The vulnerability of the J-Web interface in Juniper Networks Junos OS systems arises from the lack of authentication for critical functions and deficiencies in the error reporting mechanism. This allows attackers to gain access to confidential information.

The vulnerability of the J-Web interface in Juniper Networks Junos OS operating systems is related to the lack of authentication for critical functions and deficiencies in the error reporting mechanism. Exploiting this vulnerability can allow a malicious actor to gain access to confidential...

CVE-2023-4472

Objectplanet Opinio version 7.22 and prior uses a cryptographically weak pseudo-random number generator PRNG coupled to a predictable seed, which could lead to an unauthenticated account takeover of any user on the application...

Payment EX vulnerable to information disclosure

Overview Payment EX provided by Simplesite contains an information disclosure vulnerability CWE-200. Impact A remote unauthenticated attacker may obtain the information of the user who purchases merchandise using Payment EX. Solution Update the Software Update the software to the latest version...

PT-2024-13903 · Ibm · Ibm Powersc

Name of the Vulnerable Software and Affected Versions: IBM PowerSC versions 1.3 through 2.1 Description: The issue is related to an inadequate account lockout setting in IBM PowerSC, which could allow a remote attacker to brute force account credentials. Recommendations: For versions 1.3 through...

IBM PowerSC 加密问题漏洞

IBM PowerSC is an International Business Machines IBM security and compliance solution for IBM Power Systems servers. IBM PowerSC suffers from an encryption issue vulnerability that stems from the use of a weaker-than-expected encryption algorithm, which could be exploited by an attacker to decry...

PT-2024-1614 · Emerson · Emerson Rosemount Gc700Xa +2

Name of the Vulnerable Software and Affected Versions: Emerson Rosemount GC370XA, GC700XA, and GC1500XA products affected versions not specified Description: The issue is related to weaknesses in the authentication procedure of Emerson Rosemount GC1500XA, GC700XA, and GC370XA products. An...

Tenda AC10U setSmartPowerManagement function stack buffer overflow vulnerability

Tenda AC10U is a wireless router from Tenda China. A stack buffer overflow vulnerability exists in the Tenda AC10U setSmartPowerManagement function, which is caused by a failure of the setSmartPowerManagement function to properly boundary check. An attacker can exploit this vulnerability to cause...

The vulnerability of the args4j library in the Jenkins automation server’s command-line interface (CLI) allows a hacker to execute arbitrary code.

The vulnerability of the args4j library, a built-in command-line interface CLI for Jenkins automation servers, is related to insufficient protection of service data. Exploiting this vulnerability allows an attacker, operating remotely, to execute arbitrary code...

The vulnerability in the built-in command-line interface (CLI) of the Jenkins automation server allows a attacker to execute a CSWSH attack.

The vulnerability in the built-in command-line interface CLI of the Jenkins automation server is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to execute a CSWSH attack remotely...

PT-2024-2034 · Otrs · Otrs

Name of the Vulnerable Software and Affected Versions: OTRS versions 7.0.X through 7.0.48 OTRS versions 8.0.X through 8.0.37 OTRS versions 2023.X through 2023.1.1 Description: The issue is related to the handling of attachments in ticket comments, allowing another user to add attachments...

The vulnerability of the IBM DB2 database management system and the IBM DB2 Connect Server automatic redirection server, related to the use of cryptographic algorithms containing defects, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the IBM DB2 database management system and the IBM DB2 Connect Server automatic redirection server lies in the use of cryptographic algorithms that contain vulnerabilities. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to...

The vulnerability of iCloud Photo Library on operating systems macOS, iOS, and iPadOS allows attackers to disclose protected information.

The vulnerability of iCloud Photo Library in operating systems such as macOS, iOS, and iPadOS lies in the lack of data protection measures. Exploiting this vulnerability could allow an attacker to disclose protected information...

The vulnerability of the Log Management component of the Oracle Enterprise Manager Base Platform allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Log Management component of the Oracle Enterprise Manager Base Platform relates to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information through...

The vulnerability of the Outcome-Result sub-component of the Oracle Customer Interaction History component in the Oracle E-Business Suite system allows a malicious actor to gain access to read, modify, add, or delete data.

The vulnerability of the CRM User Management Framework component of the Oracle Customer Interaction History component within the Oracle E-Business Suite system is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to gain access to read, modify...

PT-2024-2633 · Unknown · Myq Print Server

Name of the Vulnerable Software and Affected Versions: MyQ Print Server versions prior to 8.2 patch 43 Description: The issue is related to the administrative interface of the MyQ Print Server, where remote authenticated administrators can execute arbitrary code via PHP scripts. This is due to...