CISA: Transportation Security Administration Surface Operations Overview

System About Files News Vote Help | Services API Advertise Contact | Account Join Login ---|---|---...

CVE-2024-45100

CVE-2024-45100 affects IBM Security QRadar EDR (ReaQta) 3.12. The vulnerability arises from improper allocation of resources, enabling a privileged user to cause a denial of service by sending multiple administration requests. IBM’s security bulletin documents this CVE alongside CVE-2024-45640 an...

PT-2024-17874 · Unknown · Phpgurukul Maid Hiring Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Maid Hiring Management System version 1.0 Description: A critical issue has been found in the system, affecting an unknown part of the file /admin/edit-category.php. The manipulation of the editid argument leads to SQL injection. I...

CVE-2024-54775

Dcat-Admin v2.2.0-beta and v2.2.2-beta contains a Cross-Site Scripting XSS vulnerability via /admin/auth/menu and /admin/auth/extensions...

PT-2024-17839 · Unknown · Phpgurukul Complaint Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Complaint Management System version 1.0 Description: A critical issue has been found in the PHPGurukul Complaint Management System. This issue affects an unknown part of the /admin/state.php file. The manipulation of the state...

CVE-2024-56433

shadow-utils aka shadow 4.4 through 4.17.0 establishes a default /etc/subuid behavior e.g., uid 100000 through 165535 for the first user account that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by...

1000 Projects Attendance Tracking Management System 注入漏洞

1000 Projects Attendance Tracking Management System is an open source attendance management system from 1000 Projects. 1000 Projects Attendance Tracking Management System version 1.0 suffers from an injection vulnerability, which originates from the parameter facultycourseid in the file...

Absolute Secure Access 跨站脚本漏洞

Absolute Secure Access is an application from Absolute, Inc. to provide Secure Service Edge SSE optimized for hybrid and mobile working models. A cross-site scripting vulnerability exists in versions prior to Absolute Secure Access 13.52. An attacker exploiting this vulnerability could interfere...

Congress Again Fails to Limit Scope of Spy Powers in New Defense Bill

The National Defense Authorization Act passed today, but lawmakers stripped language that would keep the Trump administration from wielding unprecedented authority to surveil Americans...

The Top Cybersecurity Agency in the US Is Bracing for Donald Trump

Staffers at the Cybersecurity and Infrastructure Security Agency tell WIRED they fear the new administration will cut programs that keep the US safe—and “persecution.”...

GO-2024-3325 kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp

kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp...

Description of the security update for SharePoint Server 2019 Language Pack: December 10, 2024 (KB5002664)

None None...

FTC Says Data Brokers Unlawfully Tracked Protesters and US Military Personnel

The FTC is targeting data brokers that monitored people’s movements during protests and around US military installations. But signs suggest the Trump administration will be far more lenient...

Sensitive Information Exposure

Moodle is vulnerable to Sensitive Information Exposure. The vulnerability is due to sensitive secrets and keys not being excluded from site administration preset exports, potentially leading to unintentional data leaks when presets are shared with third parties...

PT-2024-9086 · Billion Electric · Billion Electric Routers

Name of the Vulnerable Software and Affected Versions: Billion Electric routers affected versions not specified Description: The issue concerns an OS Command Injection vulnerability in certain models of Billion Electric routers. This vulnerability allows remote attackers with administrator...

Eaton 9PX Cross-Site Request Forgery (CVE-2018-9281)

An issue was discovered on Eaton UPS 9PX 8000 SP devices. The administration panel is vulnerable to a CSRF attack on the change- password functionality. This vulnerability could be used to force a logged-in administrator to perform a silent password update. The affected forms are also vulnerable ...

Billion Electric多款产品 安全漏洞

Billion Electric M100 and others are a wireless router from China-based Shengda Electric Billion Electric. A security vulnerability exists in various Billion Electric products that stems from the presence of operating system command injection, which allows a remote attacker with administrator...

PT-2024-16714 · Sma · Sunny Central Sc 1760-Us +28

Name of the Vulnerable Software and Affected Versions: No specific software name or versions are mentioned in the provided descriptions. Description: An authenticated attacker with low privileges may use a SQL Injection vulnerability in the affected product's administration panel to gain read and...

Sharp MFP和Toshiba MFP 跨站脚本漏洞

Sharp MFP is a series of multifunction printers from Sharp Corporation, Japan.Toshiba MFP is a series of printers from Toshiba Corporation, Japan. A cross-site scripting vulnerability exists in Sharp MFP and Toshiba MFP that originates from arbitrary scripts that can be executed on the...

Korenix JetNet Cross-Site Request Forgery (CVE-2020-12502)

Improper Authorization vulnerability of Korenix JetNet 5428G-20SFP, JetNet 5810G, JetNet 4706F, JetNet 4510, JetNet 5310, JetNet 4706, JetNet 5428G, JetNet 6095, JetNet 4706 are prone to unauthenticated device administration. This plugin only works with Tenable.ot. Please visit...