CVE-2024-7079: Missing Authentication for Critical Function

A flaw was found in the Openshift console. The /API/helm/verify endpoint is tasked to fetch and verify the installation of a Helm chart from a URI that is remote HTTP/HTTPS or local. Access to this endpoint is gated by the authHandlerWithUser middleware function. Contrary to its name, this...

PT-2024-38065 · Red Hat · Openshift Console

Name of the Vulnerable Software and Affected Versions: Openshift console affected versions not specified Description: A flaw was found in the Openshift console, specifically in the /API/helm/verify endpoint, which is responsible for fetching and verifying the installation of a Helm chart from a...

HPESBGN04670 rev.1 - HPE Unified OSS Console Assurance Monitoring (UOCAM), Multiple Vulnerabilities

Potential Security Impact: Local: Denial of Service DoS, Buffer Overflow; Remote: Cross-Site Scripting XSS, Denial of Service DoS, Buffer Overflow SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Unified OSS Console UOC - Prior to v3.1.7 CVSS Scores: | CVE | CVSS Vector | Base...

Nozomi Guardian Privilege Escalation

The vulnerability of the OpenAPI-based detection and monitoring tool for network activities, Nozomi Guardian, as well as the Nozomi Central Management Console CMC, relates to insufficient protection of registration data. Exploiting this vulnerability could allow a malicious actor to gain access t...

Apache Syncope Improper Input Validation vulnerability

When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits. The same vulnerability was found in the Syncope Enduser, when editing "Personal Information" or "User Requests". Users are recommended to upgrade to...

GHSA-8PXV-X6JQ-5VW9 Apache Syncope Improper Input Validation vulnerability

When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits. The same vulnerability was found in the Syncope Enduser, when editing "Personal Information" or "User Requests". Users are recommended to upgrade to...

org.apache.syncope.client.am:syncope-client-am-console (>=3.0.0-m0, <=3.0.7), org.apache.syncope.client.idm:syncope-client-idm-console (>=3.0.0-m0, <=3.0.7) +5 more potentially affected by CVE-2024-38503 via org.apache.syncope.client.idrepo:syncope-client-idrepo-console (>=3.0.0-m0, <=3.0.7)

org.apache.syncope.client.idrepo:syncope-client-idrepo-console MAVEN version =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.7 Source cves: CVE-2024-38503 Source advisory: OSV:GHSA-8PXV-X6JQ-5VW9...

org.apache.syncope.client.am:syncope-client-am-console (>=3.0.0-m0, <=3.0.7), org.apache.syncope.client.idm:syncope-client-idm-console (>=3.0.0-m0, <=3.0.7) +5 more potentially affected by CVE-2024-38503 via org.apache.syncope.client.idrepo:syncope-client-idrepo-console (>=3.0.0-m0, <=3.0.7)

org.apache.syncope.client.idrepo:syncope-client-idrepo-console MAVEN version =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.7 Source cves: CVE-2024-38503 Source advisory: GHSA-8PXV-X6JQ-5VW9...

CVE-2024-38503 Apache Syncope: HTML tags can be injected into Console or Enduser text fields

When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits. The same vulnerability was found in the Syncope Enduser, when editing “Personal Information” or “User Requests”. Users are recommended to upgrade to...

org.apache.syncope.client.am:syncope-client-am-console (>=3.0.0-m0, <=3.0.7), org.apache.syncope.client.idm:syncope-client-idm-console (>=3.0.0-m0, <=3.0.7) +5 more potentially affected by CVE-2024-38503 via org.apache.syncope.client.idrepo:syncope-client-idrepo-console (>=3.0.0-m0, <=3.0.7)

org.apache.syncope.client.idrepo:syncope-client-idrepo-console MAVEN version =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.7 Source cves: CVE-2024-38503 Source advisory: MEND:CVE-2024-38503...

CVE-2024-38503

When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits. The same vulnerability was found in the Syncope Enduser, when editing “Personal Information” or “User Requests”. Users are recommended to upgrade to...

CVE-2024-38503: Improper Neutralization of Input During Web Page Generation

When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits. The same vulnerability was found in the Syncope Enduser, when editing “Personal Information” or “User Requests”. Users are recommended to upgrade to...

PT-2024-28040 · Unknown +1 · Syncope Console +2

Name of the Vulnerable Software and Affected Versions: Syncope versions prior to 3.0.8 Description: The issue allows HTML tags to be added to any text field when editing a user, group, or object in the Syncope Console, potentially leading to exploits. The same vulnerability is found in the Syncop...

Apache Syncope input validation vulnerability

Apache Syncope is the United States Apache Apache Foundation's set of open source digital identity management system for use in enterprise environments. The system supports identity management, role configuration and more. Apache Syncope suffers from an input validation error vulnerability that c...

NetScaler Buffer Overflow DoS

The vulnerability of the NetScaler Console delivery management service previously known as NetScaler ADM, the NetScaler SDX SVM virtual machine deployment and management platform, and the NetScaler Agent is related to the execution of operations outside the buffer in memory. Exploiting this...

NetScaler Console authentication disclosure

The vulnerability of the NetScaler Console delivery management service formerly NetScaler ADM is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...

[SECURITY] Fedora 40 Update: dotnet6.0-6.0.132-1.fc40

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

Ignite Realtime Openfire Admin Console Detection

Binary data openfiredetect.nbin...

CVE-2024-41111

Sliver is an open source cross-platform adversary emulation/red team framework, it can be used by organizations of all sizes to perform security testing. Sliver version 1.6.0 prerelease is vulnerable to RCE on the teamserver by a low-privileged "operator" user. The RCE is as the system root user...

CVE-2024-41111 BishopFox Sliver Authenticated Remote Code Execution

Sliver is an open source cross-platform adversary emulation/red team framework, it can be used by organizations of all sizes to perform security testing. Sliver version 1.6.0 prerelease is vulnerable to RCE on the teamserver by a low-privileged "operator" user. The RCE is as the system root user...