CVE-2023-47709 IBM Security Guardium command injection

IBM Security Guardium 11.3, 11.4, 11.5, and 12.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 271524...

CVE-2023-47709

CVE-2023-47709 affects IBM Security Guardium versions 11.3, 11.4, 11.5 and 12.0. A remote authenticated attacker could execute arbitrary commands by sending a specially crafted request, due to a failure to neutralize certain elements in the OS command handling. The issue is confirmed in multiple ...

CVE-2023-47709 IBM Security Guardium command injection

IBM Security Guardium 11.3, 11.4, 11.5, and 12.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 271524...

PT-2024-4805 · Ibm · Ibm Security Guardium

Name of the Vulnerable Software and Affected Versions: IBM Security Guardium versions 11.3 through 12.0 Description: The issue allows a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. This is due to the failure to neutralize specia...

Unspecified Vulnerability in Apache Superset (CNVD-2024-24409)

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. A security vulnerability exists in Apache Superset versions prior to 3.1.2, which can be exploited by an authenticated attacker to access metadata from data sources they are not authorized to vie...

Security Bulletin: IBM Sterling Connect:Direct Web Service is vulnerable to multiple vulnerabilities due to IBM Java

Summary IBM Sterling Connect:Direct Web Service uses IBM Java SE. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2024-20932 DESCRIPTION: An unspecified vulnerability in Java SE related to the Security component could allow a remote...

VulnCheck KEV: CVE-2024-20345

A vulnerability in the file upload functionality of Cisco AppDynamics Controller could allow an authenticated, remote attacker to conduct directory traversal attacks on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit...

CVE-2024-4335 Rank Math SEO with AI Best SEO Tools <= 1.0.217 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Rank Math SEO with AI Best SEO Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘textAlign’ parameter in versions up to, and including, 1.0.217 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-4339 Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) <= 3.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Prime Slider – Addons For Elementor Revolution of a slider, Hero Slider, Ecommerce Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the General widget in all versions up to, and including, 3.14.3 due to insufficient input sanitization and output escaping. This make...

CVE-2024-3954

CVE-2024-3954 affects the Ditty WordPress plugin (Ditty – Responsive News Tickers, Sliders, and Lists) for all versions up to 3.1.38. Root cause: PHP Object Injection via deserialization of untrusted input when adding a new ditty. Exploitation requires authenticated access at contributor level or...

IBM Cognos Controller Access Control Error Vulnerability

IBM Cognos Controller is a suite of business intelligence and planning solutions from International Business Machines IBM. The product features process automation, financial audit control, and the creation and management of financial reports. An access control error vulnerability exists in IBM...

CVE-2024-28132 BIG-IP NEXT CNF vulnerability

Exposure of Sensitive Information vulnerability exists in the GSLB container, which may allow an authenticated attacker with local access to view sensitive information. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2024-28132 BIG-IP NEXT CNF vulnerability

Exposure of Sensitive Information vulnerability exists in the GSLB container, which may allow an authenticated attacker with local access to view sensitive information. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2024-28132

CVE-2024-28132 affects BIG-IP Next CNF and is a Sensitive Information disclosure in the GSLB container. An authenticated attacker with administrator privileges may exploit it locally to view sensitive information. Affected versions: 1.2.0–1.2.1 . Root cause: exposure within the GSLB container; fi...

K000138913: BIG-IP Next CNF vulnerability CVE-2024-28132

Security Advisory Description Exposure of a Sensitive Information vulnerability exists in the Global Server Load Balancing GSLB container, which may allow an authenticated attacker with administrator role privileges to view sensitive information. CVE-2024-28132 Impact An authenticated attacker ma...

CVE-2024-29150

An issue was discovered in Alcatel-Lucent ALE NOE deskphones through 86x8NOE-R300.1.40.12.4180 and SIP deskphones through 86x8SIP-R200.1.01.10.728. Because of improper privilege management, an authenticated attacker is able to create symlinks to sensitive and protected data in locations that are...

CVE-2024-29150

An issue was discovered in Alcatel-Lucent ALE NOE deskphones through 86x8NOE-R300.1.40.12.4180 and SIP deskphones through 86x8SIP-R200.1.01.10.728. Because of improper privilege management, an authenticated attacker is able to create symlinks to sensitive and protected data in locations that are...

Alcatel-Lucent ALE NOE 安全漏洞

The Alcatel-Lucent ALE NOE is a desktop phone from Alcatel-Lucent. A security vulnerability exists in Alcatel-Lucent ALE NOE versions 86x8NOE-R300.1.40.07.4140, 86x8SIP-R200.1.01.10.728, which stems from a security issue at check time, which could allow an authenticated attacker to replace the...

CVE-2024-29150

The CVE affects Alcatel-Lucent ALE NOE deskphones (86x8 NOE-R300.1.40.12.4180 and earlier) and SIP deskphones (86x8_SIP-R200.1.01.10.728 and earlier). The root cause is improper privilege management that allows an authenticated attacker to create symbolic links to sensitive files in debugging dat...

CVE-2024-29149

An issue was discovered in Alcatel-Lucent ALE NOE deskphones through 86x8NOE-R300.1.40.12.4180 and SIP deskphones through 86x8SIP-R200.1.01.10.728. Because of a time-of-check time-of-use vulnerability, an authenticated attacker is able to replace the verified firmware image with malicious firmwar...