CVE-2024-8382

The CVE-2024-8382 entry describes a vulnerability where privileged EventHandler interfaces were exposed to web content during execution of their listener callbacks. Affected software includes Firefox (less than 130; ESR <128.2 and ESR

HPESBGN04696 rev.1 - HPE Unified OSS Console Assurance Monitoring (UOCAM), Multiple Vulnerabilities

Potential Security Impact: Local: Authentication Bypass, Denial of Service DoS, Escalation of Privilege; Remote: Authentication Bypass, Denial of Service DoS, Escalation of Privilege SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Unified OSS Console UOC - Prior to v3.1.8 CVSS...

Security Vulnerabilities fixed in Thunderbird 115.15 — Mozilla

A potentially exploitable type confusion could be triggered when looking up a property name on an object being used as the with environment. Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events. Web content that tried t...

Novell ZENworks Asset Management 7.5 Configuration Access

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Novell ZENworks Asset Management 7.5 Configuration Access', 'Description' = %q This module exploits a hardcoded user and password for the GetConf...

Cisco Firepower Management Console 6.0 Post Auth Report Download Directory Traversal

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "Cisco Firepower Management Console 6.0 Post Auth Report Download Directory Traversal", 'Description' = %q This module exploits a directory...

SAP Management Console Brute Force

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SAP Management Console Brute Force', 'Description' = %q This module simply attempts to brute force the username and password for the SAP Manageme...

Novell ZENworks Asset Management 7.5 Remote File Access

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Novell ZENworks Asset Management 7.5 Remote File Access', 'Description' = %q This module exploits a hardcoded user and password for the GetFile...

JBoss Scanner

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'JBoss Vulnerability Scanner', 'Description' = %q This module scans a JBoss instance for a few vulnerabilities. , 'Author' = 'Tyler Krpata', 'Zach...

Jenkins-CI Unauthenticated Script-Console Scanner

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'cgi' class MetasploitModule 'Jenkins-CI Unauthenticated Script-Console Scanner', 'Description' = %q This module scans for unauthenticated Jenkins-CI script...

GO-2024-3083 Openshift Console insufficient entropy vulnerability in github.com/openshift/console

Openshift Console insufficient entropy vulnerability in github.com/openshift/console...

CRLF Injection in RestSharp's `RestRequest.AddHeader` method

Summary The second argument to RestRequest.AddHeader the header value is vulnerable to CRLF injection. The same applies to RestRequest.AddOrUpdateHeader and RestClient.AddDefaultHeader. Details The way HTTP headers are added to a request is via the HttpHeaders.TryAddWithoutValidation method: This...

Path Traversal

github.com/mattermost/mattermost-server is vulnerable to Path Traversal. The vulnerability is due to insufficient input sanitization in the frontend for user-provided redirection paths. This allows attackers to craft malicious links that trick unsuspecting users into clicking on them, leading to...

Mattermost Path Traversal Vulnerability

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a path traversal vulnerability that stems from an inability to clean up front-end user input used for redirection, which can be exploited by an attacker to cause a cross-site...

SUSE-SU-2024:3052-1 Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: Update to version 2.44.3 bsc1228696 bsc1228697 bsc1228698: - Fix web process cache suspend/resume when sandbox is enabled. - Fix accelerated images dissapearing after scrolling. - Fix video flickering with DMA-BUF sink. - Fix pointer lock on...

Release History for Veeam Service Provider Console 8.1

Newer Product Version Available A complete list of Veeam Service Provider Console versions and their release dates is available on KB4464: Build Numbers and Versions of Veeam Service Provider Console. Veeam Service Provider Console 8.1 Builds 8.1.0.21999 Security Vulnerabilities CVE- 2024-42448 |...

[SECURITY] Fedora 40 Update: dotnet8.0-8.0.108-1.fc40

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

SUSE SLED12: libjavascriptcoregtk-4_0-18 / libjavascriptcoregtk-4_0-18-32bit / etc (SUSE-SU-2024:3005-1)

The remote SUSE Linux SLED12 / SLEDSAP12 / SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3005-1 advisory. Update to version 2.44.3 bsc1228696 bsc1228697 bsc1228698: - Fix web process cache suspend/resume when sandbox...

SUSE-SU-2024:3005-1 Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: Update to version 2.44.3 bsc1228696 bsc1228697 bsc1228698: - Fix web process cache suspend/resume when sandbox is enabled. - Fix accelerated images dissapearing after scrolling. - Fix video flickering with DMA-BUF sink. - Fix pointer lock on...

PT-2024-9470 · Veeam · Veeam Service Provider Console

Name of the Vulnerable Software and Affected Versions: Veeam Service Provider Console versions prior to 8.1.0.21377 Description: A vulnerability in Veeam Service Provider Console has been identified, which allows an attacker to perform arbitrary HTTP requests to arbitrary hosts of the network and...

AWS Console Session Traceability: How Attackers Obfuscate Identity Through the AWS Console

Attackers can take advantage of a quirk of the default AWS configuration without SourceIdentity configured to potentially make detecting and attributing their actions more difficult...