PT-2024-2635 · Red Hat · 3Scale +2

Name of the Vulnerable Software and Affected Versions: 3Scale versions used with Keycloak 15 or RHSSO 7.5.0 Description: The issue is related to incorrect handling of insufficient permissions or privileges in the 3Scale API Management software. When the auth type is set to use 3scale oidc issuer...

Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus for z/OS are vulnerable to a denial of service due to MiniZip (CVE-2023-45853)

Summary MiniZip, in IBM App Connect Enterprise and IBM Integration Bus for z/OS is vulnerable to a denial of service. This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details CVEID:CVE-2023-45853 DESCRIPTION: MiniZip is vulnerable to a denial of service, caus...

kernel: use-after-free in l2cap_connect and l2cap_le_connect_req in net/bluetooth/l2cap_core.c

A use-after-free flaw was found in the Linux kernel's implementation of logical link control and adaptation protocol L2CAP, part of the Bluetooth stack in the l2capconnect and l2capleconnectreq functions. An attacker with physical access within the range of standard Bluetooth transmission could...

OESA-2024-1192 mod_auth_openidc security update

This module enables an Apache 2.x web server to operate as an OpenID Connect Relying PartyRP to an OpenID Connect ProviderOP. Security Fixes: modauthopenidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying...

OESA-2024-1191 mod_auth_openidc security update

This module enables an Apache 2.x web server to operate as an OpenID Connect Relying PartyRP to an OpenID Connect ProviderOP. Security Fixes: modauthopenidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying...

OESA-2024-1193 mod_auth_openidc security update

This module enables an Apache 2.x web server to operate as an OpenID Connect Relying PartyRP to an OpenID Connect ProviderOP. Security Fixes: modauthopenidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying...

CVE-2023-37540

Sametime Connect desktop chat client includes, but does not use or require, the use of an Eclipse feature called Secure Storage. Using this Eclipse feature to store sensitive data can lead to exposure of that data...

Design/Logic Flaw

Sametime Connect desktop chat client includes, but does not use or require, the use of an Eclipse feature called Secure Storage. Using this Eclipse feature to store sensitive data can lead to exposure of that data...

CVE-2023-37540

The CVE-2023-37540 entry concerns the Sametime Connect desktop chat client, which includes but does not use or require an Eclipse Secure Storage feature. The underlying issue is the use of an Eclipse feature to store sensitive data, which can lead to exposure of that data (information disclosure)...

PT-2024-12637

Name of the Vulnerable Software and Affected Versions Sametime Connect affected versions not specified Description The Sametime Connect desktop chat client includes an Eclipse feature called Secure Storage, although it does not use or require it. If this feature is used to store sensitive data, i...

CVE-2023-37540: Insecure Storage of Sensitive Information

Sametime Connect desktop chat client includes, but does not use or require, the use of an Eclipse feature called Secure Storage. Using this Eclipse feature to store sensitive data can lead to exposure of that data...

Dell Secure Connect Gateway Application SQL Injection Vulnerability

The Dell Secure Connect Gateway Application is a secure connectivity gateway from Dell, USA. The Dell Secure Connect Gateway Application suffers from a SQL injection vulnerability that can be exploited by an attacker to inject malicious content into the filters of the IP range Rest API, resulting...

Exploitation Observed: Ivanti Connect Secure — CVE-2023-46805 and CVE-2024-21887

...

Ivanti Connect Secure Unauthenticated Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Ivanti Connect Secure Unauthenticated Remote Code Execution', 'Description' = %q This module chains a server side request forgery SSRF...

CVE-2024-1389 Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.11.1 - Missing Authorization via pms_stripe_connect_handle_authorization_return

The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pmsstripeconnecthandleauthorizationreturn function in all versions up to, and...

com.scoperetail.fusion:fusion-connect (>=0.46, <=0.79), com.scoperetail.fusion:fusion-connect-core (>=0.3, <=0.58) +11 more potentially affected by CVE-2024-23114 via org.apache.camel:camel-cassandraql (>=3.0.0, <=3.21.3)

org.apache.camel:camel-cassandraql MAVEN version =3.0.0, =0.46, =0.3, =0.5, =1.0.0, =1.0.0, =0.1.0, =0.3.0, =0.1.0, =1.0.0-m6, =1.0.0-m6, =1.0.0-m6, =1.7.0, =3.0.0, =3.21.3 Source cves: CVE-2024-23114 Source advisory: OSV:GHSA-M43P-55RF-8C2J...

com.scoperetail.fusion:fusion-connect (>=0.46, <=0.79), com.scoperetail.fusion:fusion-connect-core (>=0.3, <=0.58) +11 more potentially affected by CVE-2024-23114 via org.apache.camel:camel-cassandraql (>=3.0.0, <=3.21.3)

org.apache.camel:camel-cassandraql MAVEN version =3.0.0, =0.46, =0.3, =0.5, =1.0.0, =1.0.0, =0.1.0, =0.3.0, =0.1.0, =1.0.0-m6, =1.0.0-m6, =1.0.0-m6, =1.7.0, =3.0.0, =3.21.3 Source cves: CVE-2024-23114 Source advisory: MEND:CVE-2024-23114...

CVE-2023-7245

The nodejs framework in OpenVPN Connect 3.0 through 3.4.3 Windows/3.4.7 macOS was not properly configured, which allows a local user to execute arbitrary code within the nodejs process context via the ELECTRONRUNASNODE environment variable...

CVE-2023-7245

The nodejs framework in OpenVPN Connect 3.0 through 3.4.3 Windows/3.4.7 macOS was not properly configured, which allows a local user to execute arbitrary code within the nodejs process context via the ELECTRONRUNASNODE environment variable...

Code injection

The nodejs framework in OpenVPN Connect 3.0 through 3.4.3 Windows/3.4.7 macOS was not properly configured, which allows a local user to execute arbitrary code within the nodejs process context via the ELECTRONRUNASNODE environment variable...