8424 matches found
PT-2024-35761 · Unknown · Favorites-Web
Name of the Vulnerable Software and Affected Versions: Favorites-web version 1.3.0 Description: The issue is related to a directory traversal vulnerability in the SecurityFilter.java file. This vulnerability could potentially allow unauthorized access. Recommendations: For Favorites-web version...
Proactively Managing High-Risk Vulnerabilities with TruRisk Mitigate™
In late 2024, organizations faced over 65 million detections from three critical vulnerabilities—CVE-2013-2900, CVE-2024-38122, and CVE-2024-30078—underscoring the urgent need for proactive vulnerability management. Adding to these challenges, the Qualys Threat Research Unit TRU uncovered five...
CVE-2024-11952
The Classic Addons – WPBakery Page Builder plugin for WordPress is vulnerable to Limited Local PHP File Inclusion in all versions up to, and including, 3.0 via the 'style' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, and permissions grant...
Meinberg NTP Permissions, Privileges, and Access Controls (CVE-2016-3989)
The NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS- LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M300, LANTIME M200, LANTIME M100, SyncFire 1100, and LCES devices with firmware before 6.20.004 allows remote authenticated users to obtain root...
The vulnerability of the implementation of the mTLS protocol in the Keycloak software for managing identity and access control allows a perpetrator to circumvent security restrictions and gain unauthorized access to protected information.
The vulnerability of the mTLS protocol implementation in the Keycloak identity and access management software is related to a certificate authentication error. Exploiting this vulnerability could allow an attacker to circumvent security restrictions and gain unauthorized access to protected...
Cisco Nexus 3000 and 5000 Permissions, Privileges, and Access Controls (CVE-2011-2581)
The ACL implementation in Cisco NX-OS 5.02 and 5.03 before 5.03N21 on Nexus 5000 series switches, and NX-OS before 5.03U12a on Nexus 3000 series switches, does not properly handle comments in conjunction with deny statements, which allows remote attackers to bypass intended access restrictions in...
Cisco Application Policy Infrastructure Permissions, Privileges, and Access Controls (CVE-2015-4235)
Cisco Application Policy Infrastructure Controller APIC devices with software before 1.03o and 1.1 before 1.11j and Nexus 9000 ACI devices with software before 11.04o and 11.1 before 11.11j do not properly restrict access to the APIC filesystem, which allows remote authenticated users to obtain...
Dell 3000cn Permissions, Privileges, and Access Controls (CVE-2006-2112)
Fuji Xerox Printing Systems FXPS print engine, as used in products including 1 Dell 3000cn through 5110cn and 2 Fuji Xerox DocuPrint firmware before 20060628 and Network Option Card firmware before 5.13, allows remote attackers to use the FTP printing interface as a proxy FTP bounce by using...
Imperva Defends Against LLM Hacking
In the evolving landscape of cybersecurity, the advent of large language models LLMs has introduced a new frontier of challenges and opportunities. Research has shown advanced LLMs, such as GPT-4, now possess the ability to autonomously execute sophisticated cyberattacks, including blind database...
CVE-2024-11668
CVE-2024-11668 affects GitLab CE/EE, with versions 16.11–16.11.x before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. The issue allows long‑lived connections to bypass authentication controls and gain unauthorized access to streaming results. The provided connected documents describe the vu...
CVE-2024-11668 Insufficient Session Expiration in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 16.11 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. Long-lived connections could potentially bypass authentication controls, allowing unauthorized access to streaming results...
CVE-2024-11668 Insufficient Session Expiration in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 16.11 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. Long-lived connections could potentially bypass authentication controls, allowing unauthorized access to streaming results...
CVE-2024-11668 Insufficient Session Expiration in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 16.11 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. Long-lived connections could potentially bypass authentication controls, allowing unauthorized access to streaming results...
CVE-2024-11483
A vulnerability was found in the Ansible Automation Platform AAP. This flaw allows attackers to escalate privileges by improperly leveraging read-scoped OAuth2 tokens to gain write access. This issue affects API endpoints that rely on ansiblebase.oauth2provider for OAuth2 authentication. While th...
CVE-2024-11483 Automation-gateway: aap-gateway: improper scope handling in oauth2 tokens for aap 2.5
A vulnerability was found in the Ansible Automation Platform AAP. This flaw allows attackers to escalate privileges by improperly leveraging read-scoped OAuth2 tokens to gain write access. This issue affects API endpoints that rely on ansiblebase.oauth2provider for OAuth2 authentication. While th...
CVE-2024-11483 Automation-gateway: aap-gateway: improper scope handling in oauth2 tokens for aap 2.5
A vulnerability was found in the Ansible Automation Platform AAP. This flaw allows attackers to escalate privileges by improperly leveraging read-scoped OAuth2 tokens to gain write access. This issue affects API endpoints that rely on ansiblebase.oauth2provider for OAuth2 authentication. While th...
CVE-2024-11483
CVE-2024-11483 affects Red Hat Ansible Automation Platform 2.5, specifically automation-gateway: improper scope handling in OAuth2 tokens for AAP 2.5. The flaw allows write access via read-scoped OAuth2 tokens to API endpoints using ansible_base.oauth2_provider, enabling potential modifications w...
CVE-2024-11483 Automation-gateway: aap-gateway: improper scope handling in oauth2 tokens for aap 2.5
A vulnerability was found in the Ansible Automation Platform AAP. This flaw allows attackers to escalate privileges by improperly leveraging read-scoped OAuth2 tokens to gain write access. This issue affects API endpoints that rely on ansiblebase.oauth2provider for OAuth2 authentication. While th...