CVE-2024-32862 exacqVision CORS

Under certain circumstances the ExacqVision Web Services does not provide sufficient protection from untrusted domains...

CVE-2024-32864

Under certain circumstances exacqVision Web Services will not enforce secure web communications HTTPS...

CVE-2024-32864

Under certain circumstances exacqVision Web Services will not enforce secure web communications HTTPS...

CVE-2024-32863

Under certain circumstances the exacqVision Web Services may be susceptible to Cross-Site Request Forgery CSRF...

CVE-2024-32863

Under certain circumstances the exacqVision Web Services may be susceptible to Cross-Site Request Forgery CSRF...

CVE-2024-32864 exacqVison - HTTPS Session Establishment

Under certain circumstances exacqVision Web Services will not enforce secure web communications HTTPS...

CVE-2024-32864 exacqVison - HTTPS Session Establishment

Under certain circumstances exacqVision Web Services will not enforce secure web communications HTTPS...

CVE-2024-32864

Summary: CVE-2024-32864 affects Johnson Controls exacqVision Web Service prior to version 24.06, where HTTPS is not enforced under certain conditions, enabling potential exposure of sensitive information via cleartext transmission (CWE-319). The vulnerability affects exacqVision Web Service versi...

CVE-2024-32863

Johnson Controls exacqVision Web Service is affected up to version 24.03 by a Cross-Site Request Forgery (CSRF) vulnerability (CVE-2024-32863). The issue allows performing state-changing operations with administrative privileges and has CVSSv3.1 base score 6.8 (vector: AV:N/AC:H/PR:N/UI:R/S:U/C:H...

PT-2024-5518 · Unknown · Exacqvision Web Service

Name of the Vulnerable Software and Affected Versions: ExacqVision Web Services affected versions not specified Description: The issue is related to the ExacqVision Web Services, which under certain circumstances does not provide sufficient protection from untrusted domains. This is due to...

PT-2024-5519 · Tyco Security Products · Exacqvision Web Service

Name of the Vulnerable Software and Affected Versions: exacqVision Web Services affected versions not specified Description: The issue is related to Cross-Site Request Forgery CSRF, which can be exploited under certain circumstances. This could allow a remote attacker to perform a CSRF attack...

USN-6938-1: Linux kernel vulnerabilities

It was discovered that the device input subsystem in the Linux kernel did not properly handle the case when an event code falls outside of a bitmap. A local attacker could use this to cause a denial of service system crash. CVE-2022-48619 黄思聪 discovered that the NFC Controller Interface NCI...

USN-6924-2: Linux kernel vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM SCMI message protocol; - InfiniBand drivers; - TTY drivers; - TLS protocol; CVE-2022-48655, CVE-2024-36016,...

CVE-2024-5670 Softnext Mail SQR Expert and Mail Archiving Expert - OS Command Injection

The web services of Softnext's products, Mail SQR Expert and Mail Archiving Expert do not properly validate user input, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the remote server...

CVE-2024-5670

Summary (CVE-2024-5670) : The web services of Softnext’s Mail SQR Expert and Mail Archiving Expert fail to validate user input, enabling unauthenticated remote attackers to inject and execute arbitrary OS commands on the remote server. This is described across multiple sources as an OS command in...

PT-2024-37010 · Softnext · Softnext Mail Archiving Expert +1

Name of the Vulnerable Software and Affected Versions: Softnext Mail SQR Expert affected versions not specified Softnext Mail Archiving Expert affected versions not specified Description: The web services of Softnext's products do not properly validate user input, allowing unauthenticated remote...

The vulnerability of the JOSE component in Apache CXF web services allows a attacker to cause a service failure.

The vulnerability of the JOSE component in Apache CXF web services is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures...

OESA-2024-1908 openjdk-11 security update

The OpenJDK runtime environment. Security Fixes: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0....

RICOH Printers Multiple Vulnerabilities (ricoh-2024-000003)

Multiple RICOH printers and multifunction printers are prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if...

CVE-2024-41178

Exposure of temporary credentials in logs in Apache Arrow Rust Object Store objectstore crate, version 0.10.1 and earlier on all platforms using AWS WebIdentityTokens. On certain error conditions, the logs may contain the OIDC token passed to AssumeRoleWithWebIdentity...