OneDev Unauthenticated Arbitrary File Read

This module exploits an unauthenticated arbitrary file read vulnerability CVE-2024-45309, which affects OneDev versions use auxiliary/gather/onedev/arbitraryfileread msf undefinedarbitraryfileread show actions ...actions... msf undefinedarbitraryfileread set ACTION msf undefinedarbitraryfileread...

CVE-2024-45408

eLabFTW is an open source electronic lab notebook for research labs. An incorrect permission check has been found that could allow an authenticated user to access several kinds of otherwise restricted information. If anonymous access is allowed something disabled by default, this extends to anyon...

CVE-2024-45408 eLabFTW contains a direct and indirect information disclosure

eLabFTW is an open source electronic lab notebook for research labs. An incorrect permission check has been found that could allow an authenticated user to access several kinds of otherwise restricted information. If anonymous access is allowed something disabled by default, this extends to anyon...

GO-2022-0455 Argo CD will blindly trust JWT claims if anonymous access is enabled in github.com/argoproj/argo-cd

Argo CD will blindly trust JWT claims if anonymous access is enabled in github.com/argoproj/argo-cd...

CVE-2024-25633

eLabFTW is an open source electronic lab notebook for research labs. In an eLabFTW system, one can configure who is allowed to create new user accounts. A vulnerability has been found starting in version 4.4.0 and prior to version 5.0.0 that allows regular users to create new, validated accounts ...

CVE-2024-25633 In eLabFTW, if administrators can create users, users can too

eLabFTW is an open source electronic lab notebook for research labs. In an eLabFTW system, one can configure who is allowed to create new user accounts. A vulnerability has been found starting in version 4.4.0 and prior to version 5.0.0 that allows regular users to create new, validated accounts ...

CVE-2024-25633 In eLabFTW, if administrators can create users, users can too

eLabFTW is an open source electronic lab notebook for research labs. In an eLabFTW system, one can configure who is allowed to create new user accounts. A vulnerability has been found starting in version 4.4.0 and prior to version 5.0.0 that allows regular users to create new, validated accounts ...

CVE-2024-25633 In eLabFTW, if administrators can create users, users can too

eLabFTW is an open source electronic lab notebook for research labs. In an eLabFTW system, one can configure who is allowed to create new user accounts. A vulnerability has been found starting in version 4.4.0 and prior to version 5.0.0 that allows regular users to create new, validated accounts ...

PT-2024-21053 · Elabftw · Elabftw

Name of the Vulnerable Software and Affected Versions: eLabFTW versions 4.4.0 through 4.9.x are not explicitly mentioned, but since the vulnerability exists starting in version 4.4.0 and prior to version 5.0.0, it can be simplified to: eLabFTW versions 4.4.0 through 4.9.x is not needed, instead...

CVE-2024-24749 Classpath resource disclosure in GWC Web Resource API on Windows / Tomcat

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.23.5 and 2.24.3, if GeoServer is deployed in the Windows operating system using an Apache Tomcat web application server, it is possible to bypass existing input validation in the GeoWebCach...

CVE-2024-5276

A SQL Injection vulnerability in Fortra FileCatalyst Workflow allows an attacker to modify application data. Likely impacts include creation of administrative users and deletion or modification of data in the application database. Data exfiltration via SQL injection is not possible using this...

PT-2024-19340 · Ibm · Ibm System Storage Ds8900F

Name of the Vulnerable Software and Affected Versions: IBM System Storage DS8900F versions 89.22.19.0 through 89.40.93.0 Description: The issue allows a remote user to create an LDAP connection with a valid username and an empty password, potentially establishing an anonymous connection...

IBM System Storage DS8900F Security Vulnerability

The IBM System Storage DS8900F is one of the fastest, most reliable and secure storage systems from International Business Machines IBM. A security vulnerability exists in the IBM System Storage DS8900F that stems from a vulnerability that could allow a remote user to create an LDAP connection...

PT-2024-5523 · Minio +2 · Minio +2

Name of the Vulnerable Software and Affected Versions: MinIO versions prior to RELEASE.2024-05-27T19-17-46Z Description: The issue concerns the use of If-Modified-Since and If-Unmodified-Since headers with anonymous requests, allowing an attacker to determine if an object exists on the server in ...

PT-2024-26880 · Tine · Tine

Name of the Vulnerable Software and Affected Versions: tine versions prior to 2023.11.8 Description: The issue allows anonymous remote attackers to obtain sensitive authentication information via setup.php because of getRegistryData in Setup/Frontend/Json.php, when an LDAP backend is used...

PT-2024-26131 · Unknown · Prestashop

Name of the Vulnerable Software and Affected Versions: PrestaShop version 8.1.5 Description: PrestaShop is an open source e-commerce web application. The issue allows any invoice to be downloaded from the front-office in anonymous mode by supplying a random secure key parameter in the url...

PrestaShop 信息泄露漏洞

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides multiple payment methods, short message alerts and product image scaling. An information disclosure vulnerability exists in PrestaShop versions prior to 8.1.6, which stems from the...

BIT-ARTIFACTORY-2024-4142

An Improper input validation vulnerability that could potentially lead to privilege escalation was discovered in JFrog Artifactory. Due to this vulnerability, users with low privileges may gain administrative access to the system. This issue can also be exploited in Artifactory platforms with...

CVE-2024-4142

An Improper input validation vulnerability that could potentially lead to privilege escalation was discovered in JFrog Artifactory. Due to this vulnerability, users with low privileges may gain administrative access to the system. This issue can also be exploited in Artifactory platforms with...

CVE-2024-4142 JFrog Artifactory Improper input validation within token creation flow

An Improper input validation vulnerability that could potentially lead to privilege escalation was discovered in JFrog Artifactory. Due to this vulnerability, users with low privileges may gain administrative access to the system. This issue can also be exploited in Artifactory platforms with...