ROS-20240815-02

The vulnerability of the writestatustextandbuffer function of the cpr.c component of the program for information encryption and creation of electronic digital signatures GnuPG is related to insufficient neutralization of special elements in the request. Exploitation of the vulnerability allows a...

The vulnerability of the MinIO object storage server, related to the exposure of confidential information to unauthorized individuals, allows attackers to disclose confidential information.

The vulnerability of the MinIO object storage server lies in the use of headers to determine whether an object exists on the server at a given time. Exploiting this vulnerability could allow a malicious actor to disclose confidential information...

The vulnerability of the implementation of the ColladaParser::ExtractDataObjectFromChannel() function in the Open Asset Import Library (Assimp) library allows a malicious actor to obtain unauthorized access to confidential information.

The vulnerability of the ColladaParser::ExtractDataObjectFromChannel function in the Open Asset Import Library Assimp import library is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to gain unauthorized access to confidential information...

Huawei HarmonyOS 安全漏洞

Huawei HarmonyOS is an operating system from Huawei, a Chinese company. It provides a full-scene distributed operating system based on a microkernel.Huawei EMUI is an emotional operating system developed by Huawei based on Android Android. Huawei HarmonyOS and EMUI are vulnerable to an access...

ROS-20240806-12

Vulnerability of CPAN.pm component of Perl programming language is related to errors in the procedure of TLS certificate authentication. of TLS certificate authentication. Exploitation of the vulnerability could allow an attacker acting remotely, gain access to confidential data, compromise its...

The vulnerability of the GLPI system for handling requests and incidents, related to the disclosure of confidential information to unauthorized individuals, allows a violator to disclose confidential data.

The vulnerability of the GLPI system for handling requests and incidents involves the disclosure of confidential information to unauthorized individuals. Exploiting this vulnerability could allow a malicious actor, operating remotely, to disclose confidential data...

The vulnerability of the GraphQL Subscription Handler component of the software platform based on Git, which facilitates collaborative code development on GitLab, allows a malicious individual to gain unauthorized access to confidential information.

The vulnerability of the GraphQL Subscription Handler component of the software platform based on Git for collaborative code development on GitLab is related to the lack of protection for sensitive data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthoriz...

The vulnerabilities of the event monitoring, threat detection, security analytics platforms of IBM QRadar Suite, as well as the IBM Cloud Pak for Security security platform, allow attackers to gain access to confidential information.

The vulnerabilities of event monitoring platforms, threat detection systems, security analytics in the IBM QRadar Suite, and IBM Cloud Pak for Security related to security configuration errors can be exploited by attackers operating remotely. This allows them to gain access to confidential...

The vulnerability of the Ivanti Endpoint Manager Mobile (EPMM) application for managing the lifecycle of mobile devices and mobile applications (formerly known as MobileIron Core) stems from authentication procedures that have flaws. This allows attackers to bypass the authentication process and gain access to confidential data.

The vulnerability of the Ivanti Endpoint Manager Mobile EPMM application for managing the lifecycle of mobile devices and mobile applications formerly known as MobileIron Core is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to...

The vulnerability in the web-based client of IBM Datacap software for document collection and processing involves the unencrypted storage of confidential information, allowing an intruder to gain unauthorized access to protected data.

The vulnerability in the web-based client of IBM Datacap software for document collection and processing involves the unencrypted storage of confidential information. Exploiting this vulnerability could allow an attacker to gain unauthorized access to the protected information...

The vulnerability of the Windows operating system’s Codecs library, which allows a hacker to access confidential information

The vulnerability of the Windows operating system’s Codecs library is related to errors in the memory object handling mechanisms. Exploiting this vulnerability can allow an attacker to access confidential information through a specially crafted image file...

PT-2024-4963 · Ibm · Ibm Datacap Navigator

Name of the Vulnerable Software and Affected Versions: IBM Datacap Navigator versions 9.1.5 through 9.1.9 Description: The issue is related to the use of weaker than expected cryptographic algorithms in IBM Datacap Navigator, which could allow an attacker to decrypt highly sensitive information...

CVE-2024-28872

The CVE-2024-28872 issue affects ISC Stork versions 0.15.0 through 1.15.0 and stems from flawed TLS certificate validation. An attacker could obtain a TLS certificate from the Stork server and use it to connect to the Stork agent, then issue malicious commands to monitored services (Kea or BIND 9...

CVE-2024-28872 Incorrect TLS certificate validation can lead to escalated privileges

The TLS certificate validation code is flawed. An attacker can obtain a TLS certificate from the Stork server and use it to connect to the Stork agent. Once this connection is established with the valid certificate, the attacker can send malicious commands to a monitored service Kea or BIND 9,...

CVE-2024-28872 Incorrect TLS certificate validation can lead to escalated privileges

The TLS certificate validation code is flawed. An attacker can obtain a TLS certificate from the Stork server and use it to connect to the Stork agent. Once this connection is established with the valid certificate, the attacker can send malicious commands to a monitored service Kea or BIND 9,...

CVE-2024-39593

SAP Landscape Management allows an authenticated user to read confidential data disclosed by the REST Provider Definition response. Successful exploitation can cause high impact on confidentiality of the managed entities...

CVE-2024-39593

SAP Landscape Management is affected by an information-disclosure vulnerability where an authenticated user can read confidential data exposed by the REST Provider Definition response. The issue is reported across multiple feeds (NVD, Red Hat, CVE lists) and is described as high impact to confide...

ROS-20240703-10

Vulnerability of usbguard-dbus daemon of USBGuard USB device protection software is related to an error of access error of an unprivileged user who could connect USB devices. Exploitation of the vulnerability could allow an attacker to gain access to confidential data, compromise its integrity, a...

The vulnerability of the Calendar component in the cloud software for creating and using the Nextcloud Server storage service allows a perpetrator to gain access to confidential information.

The vulnerability of the Calendar component in the cloud software for creating and using the Nextcloud Server storage service is related to improper access control. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to confidential information...

The vulnerability of configuration management systems and remote execution of operations, related to the creation of special URL addresses, allows attackers to gain access to confidential information.

The vulnerability of configuration management systems and remote execution of operations like Salt is related to the creation of URLs that lead to bypassing the server’s catalog. Exploiting this vulnerability can allow a malicious actor to gain access to confidential information...