CVE-2024-5618 Broken Access Control in PruvaSoft Informatics' Apinizer Management Console

Incorrect Permission Assignment for Critical Resource vulnerability in PruvaSoft Informatics Apinizer Management Console allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Apinizer Management Console: before 2024.05.1...

CVE-2024-5618

CVE-2024-5618 affects PruvaSoft Informatics’ Apinizer Management Console (versions prior to 2024.05.1). The issue is an Incorrect Permission Assignment for a Critical Resource, allowing access to functionality not properly constrained by ACLs. Root cause involves improper access controls on the c...

CVE-2024-6504

Rapid7 InsightVM Console versions below 6.6.260 suffer from a protection mechanism failure whereby an attacker with network access to the InsightVM Console can cause it to overload or crash by sending repeated invalid REST requests in a short timeframe, to the Console's port 443 causing the conso...

PT-2024-36733 · Unknown · Apinizer Management Console

Name of the Vulnerable Software and Affected Versions: Apinizer Management Console versions prior to 2024.05.1 Description: The issue is related to an Incorrect Permission Assignment for Critical Resource, which allows accessing functionality not properly constrained by ACLs. Recommendations: For...

PT-2024-36773 · Unknown · Apinizer Management Console

Name of the Vulnerable Software and Affected Versions: Apinizer Management Console versions prior to 2024.05.1 Description: The issue is related to an Improper Restriction of XML External Entity Reference, which allows Data Serialization External Entities Blowup. Recommendations: For versions pri...

PT-2024-37675 · Rapid7 · Rapid7 Insightvm Console

Name of the Vulnerable Software and Affected Versions: Rapid7 InsightVM Console versions prior to 6.6.261 Description: The issue is related to a protection mechanism failure, where an attacker with network access can cause the console to overload or crash by sending repeated invalid REST requests...

BIT-DISCOURSE-2024-38360 Denial of service via Watched Words in Discourse

Discourse is an open source platform for community discussion. In affected versions by creating replacement words with an almost unlimited number of characters, a moderator can reduce the availability of a Discourse instance. This issue has been addressed in stable version 3.2.3 and in current...

SUSE CVE-2022-48804

In the Linux kernel, the following vulnerability has been resolved: vtioctl: fix arrayindexnospec in vtsetactivate arrayindexnospec ensures that an out-of-bounds value is set to zero on the transient path. Decreasing the value by one afterwards causes a transient integer underflow. vsa.console...

SUSE CVE-2024-40966

In the Linux kernel, the following vulnerability has been resolved: tty: add the option to have a tty reject a new ldisc ... and use it to limit the virtual terminals to just NTTY. They are kind of special, and in particular, the "conwrite" routine violates the "writes cannot sleep" rule that som...

CVE-2024-6535

A flaw was found in Skupper. When Skupper is initialized with the console-enabled and with console-auth set to Openshift, it configures the openshift oauth-proxy with a static cookie-secret. In certain circumstances, this may allow an attacker to bypass authentication to the Skupper console via a...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.13.45 bug fix and security update

Red Hat OpenShift Container Platform release 4.13.45 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.13. Red Hat Product Security has rated this update as having a...

RHEL 8 / 9 : OpenShift Container Platform 4.13.45 (RHSA-2024:4486)

The remote Redhat Enterprise Linux 8 / 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:4486 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private clo...

CVE-2023-52290

In streampark-console the list pagese.g: application pages, users can sort page by field. This sort field is sent from the front-end to the back-end, and the SQL query is generated using this field. However, because this sort field isn't validated, there is a risk of SQL injection...

CVE-2023-52290

CVE-2023-52290 affects Apache StreamPark’s streampark-console prior to version 2.1.4. The vulnerability arises from unvalidated sort field input used to build SQL queries in list pages (e.g., application pages), enabling SQL injection after an authenticated user logs in. Impact is described as da...

CVE-2023-52290 Apache StreamPark (incubating): Unchecked SQL query fields trigger SQL injection vulnerability

In streampark-console the list pagese.g: application pages, users can sort page by field. This sort field is sent from the front-end to the back-end, and the SQL query is generated using this field. However, because this sort field isn't validated, there is a risk of SQL injection...

HPESBGN04665 rev.1 - HPE Unified OSS Console Assurance Monitoring (UOCAM), Multiple Vulnerabilities

Potential Security Impact: Local: Elevated Privileges, memory corruption, Buffer Overflow, Input Validation; Remote: Arbitrary Code Execution, Arbitrary Command Execution SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Unified OSS Console UOC - Prior to v3.1.6 CVSS Scores: | C...

PT-2024-14507 · Unknown · Streampark-Console

Name of the Vulnerable Software and Affected Versions: streampark-console versions prior to 2.1.4 Description: The issue arises from the lack of validation of the sort field sent from the front-end to the back-end, which is used to generate SQL queries. This poses a risk of SQL injection,...

CVE-2024-38360

Discourse (3.2.x) is affected by a Denial of Service via the Watched Words feature. The issue arises when a moderator creates replacement words with an almost unlimited length, which can exhaust resources and reduce availability. Remediation is to upgrade to Discourse 3.2.3 or newer betas; for th...

CVE-2024-38360 Denial of service via Watched Words in Discourse

Discourse is an open source platform for community discussion. In affected versions by creating replacement words with an almost unlimited number of characters, a moderator can reduce the availability of a Discourse instance. This issue has been addressed in stable version 3.2.3 and in current...

The vulnerability of the ajaxterm module in the Webmin hosting control panel allows a hacker to intercept the console session.

The vulnerability of the ajaxterm module in the Webmin hosting control panel is related to incorrect handling of permissions or privileges. Exploiting this vulnerability could allow a malicious actor, operating remotely, to intercept the console session...