CVE-2024-4457

The Management Console fails to properly validate input related to the configuration of JDBC user stores. This weakness allows an attacker to supply specially crafted input that can lead to the execution of arbitrary code on the affected server. Successful exploitation of this vulnerability enabl...

EUVD-2024-55805

The Management Console fails to properly validate input related to the configuration of JDBC user stores. This weakness allows an attacker to supply specially crafted input that can lead to the execution of arbitrary code on the affected server. Successful exploitation of this vulnerability enabl...

GIMP resource management error vulnerabilities

GIMP has a resource management vulnerability. This vulnerability arises because the XCF loader may leave empty pointers in the link channel list after the link channel’s properties are destroyed by the selection attribute. Opening a specially crafted XCF file can cause the GIMP main process to...

Ellucian Banner Student Registration Self-Service Cross-site Scripting Vulnerability

The Ellucian Banner Student Registration Self-Service versions prior to 9.23 contain a cross-site scripting vulnerability. This vulnerability stems from the mepCode parameter in the /ssb/registration endpoint, which contains cross-site scripting. This could allow remote attackers to execute...

Apache Camel deserialization injection vulnerability

Apache Camel versions prior to 2.11.0 through 4.18.5, as well as versions from 4.19.0 through 4.22.1, have security vulnerabilities. These vulnerabilities stem from the Apache Camel Spring Redis component using JdkSerializationRedisSerializer when a serialization option is not configured...

Pillow Resource Management Error Vulnerability

Pillow versions from 11.3.0 to 13.0.0 contain a resource management vulnerability. This vulnerability arises when the application saves TIFF tags affected by attackers to BytesIO. During the ImagingLibTiffEncode encoding process, libtiff refuses to save the tags. The error path releases the outpu...

Dell Application Store permissions and access control vulnerabilities

Versions of the Dell Application Store prior to 26.05.0.7 have vulnerabilities related to permission management and access control. These vulnerabilities stem from improper control of path elements, which may allow low-privilege attackers with local access to escalate their privileges and execute...

IBM MQ Operator buffer error vulnerability

IBM MQ Operator versions 2.0.0 through 2.0.29, 3.2.0 through 3.2.29, 3.3.0 through 3.4.0 excluding versions prior to 3.4.1, 3.4.1, 3.5.0, 3.5.1 through 3.5.3, 3.6.0 through 3.6.4, 3.7.0 through 3.7.2, 3.8.0, 3.8.1, 3.9.0, 3.9.1, 3.9.2, 4.0.0, 4.0.1, 4.0.2, 4.0.3, and 4.0.4 have a buffer error...

Dell Application Store Authorization Issues Vulnerability

Versions of the Dell Application Store prior to 26.05.0.7 have a vulnerability related to authorization. This vulnerability stems from the lack of authentication for critical functions, allowing attackers with unauthenticated access and network access rights to execute arbitrary code...

Red Hat Enterprise Linux Input Validation Vulnerability

Red Hat Enterprise Linux versions 8, 9, and 10, as well as Red Hat Hardened Images version 1, have a vulnerability in input validation. This vulnerability arises from bootc, under the default container signature policy, automatically or manually upgrading variable image tags that fall under...

Purocean Yank Note: Path traversal vulnerability

Purocean Yank Note versions prior to 3.93.1 have a path traversal vulnerability. This vulnerability stems from issues with the path or doc parameters in the/api/help endpoint. Attackers can exploit this by providing repeated “../” segments, thereby bypassing single replacement cleanup. As a resul...

IBM MQ Operator buffer error vulnerability

IBM MQ Operator versions 2.0.0 through 2.0.29, 3.2.0 through 3.2.29, 3.3.0 through 3.4.0 excluding versions prior to 3.4.1, 3.4.1, 3.5.0, 3.5.1 through 3.5.3, 3.6.0 through 3.6.4, 3.7.0 through 3.7.2, 3.8.0, 3.8.1, 3.9.0, 3.9.1, 3.9.2, 4.0.0, 4.0.1, 4.0.2, 4.0.3, and 4.0.4 have a buffer error...

Viraj Potdar Criminal-Management-System: Vulnerabilities in Permission Authorization and Access Control Mechanisms

The Viraj Potdar criminal-management-system has a security vulnerability. This vulnerability stems from improper handling of the parameter ‘myimg’ in the ‘move Uploaded File’ function within the ‘home.php’ file. As a result, arbitrary file uploads can occur, and this vulnerability may be exploite...

MLJAR Mercury authorization issue vulnerability

The MLJAR mercury version prior to 3.2.6 has an authorization issue vulnerability. This vulnerability stems from the default lack of token deployment, allowing anonymous clients to create Jupyter kernels and send executerequest messages containing arbitrary Python code. Additionally, the endpoint...

Eptura Archibus arbitrary file upload vulnerability

Versions of Eptura Archibus prior to 2025.02 contained a vulnerability related to arbitrary file upload. This vulnerability stemmed from the ability of users to upload exported reports containing arbitrary file content, specify arbitrary content, and upload JSP code with JSPX as the file extensio...

IBM Cloud Pak System Cross-site Scripting Vulnerability

IBM Cloud Pak System versions 2.3.6.0 and 2.3.6.1 have a cross-site scripting vulnerability. This vulnerability stems from cross-site scripting issues, which may allow users to embed arbitrary JavaScript code in the Web UI, altering intended functions and leading to the exposure of credentials in...

IBM MQ Operator deserialization injection vulnerability

IBM MQ Operator versions 2.0.0 through 2.0.29, 3.2.0 through 3.2.29, 3.3.0 through 3.4.0 excluding versions prior to 3.4.1, 3.4.1, 3.5.0 through 3.5.3, 3.6.0 through 3.6.4, 3.7.0 through 3.7.2, 3.8.0 through 3.8.1, 3.9.0 through 3.9.2, and 4.0.0 through 4.0.4 have a deserialization injection...

Google Agent Mesh Authorization Vulnerability

The Google Agent Mesh version 0.1.0-alpha.1 to 0.1.0-alpha.2 contains an authorization vulnerability. This vulnerability stems from the lack of key functionality for authentication and authorization in the/libp2p-http entry server. Biscuit tokens or grid registrations are not verified, resulting ...

Progressive Robot hMailServer authorization issue vulnerability

The Progressive Robot hMailServer versions from 6.2.22 to 6.3.6, as well as from 6.0.0 to 6.3.6, have an authorization vulnerability. This vulnerability stems from the lack of authorization for Sieve notification actions and email rule responses. The server does not verify whether the sender...

WSO2 Enterprise Integrator code injection vulnerability

The WSO2 Enterprise Integrator version 6.6.0 up to 6.6.0.205 contained a code injection vulnerability. This vulnerability stemmed from insufficient data validation for user-provided data, allowing malicious Expression Language EL code to be injected. Attackers with administrative privileges could...