SUSE SLES12: java-11-openjdk / java-11-openjdk-demo / java-11-openjdk-devel / etc (SUSE-SU-2024:1452-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1452-1 advisory. - CVE-2024-21011: Fixed denial of service due to long Exception message logging JDK-8319851,bsc1222979 - CVE-2024-21012: Fixed...

Vulnerabilities fixed in QNAP QTS and QTS Hero

QNAP has fixed vulnerabilities in QTS and QTS Hero. A malicious party can exploit the vulnerabilities to launch attacks execute attacks that can result in the following categories of damage: Bypassing authentication. Circumvention of security measure Remote code execution Administrator/Root right...

Woo Total Sales <= 3.1.4 - Missing Authorization to Unauthenticated Sales Report Retrieval

Description The Woo Total Sales plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the getordersarchive function in all versions up to, and including, 3.1.4. This makes it possible for unauthenticated attackers to retrieve sales reports for the...

CVE-2024-32730 Missing authorization check in SAP Enable Now Manager

SAP Enable Now Manager does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, the attacker with the role 'Learner' could gain access to other user's data in manager which will lead to a high impact to the...

PT-2024-24817 · Sap · Sap Enable Now Manager

Name of the Vulnerable Software and Affected Versions: SAP Enable Now Manager affected versions not specified Description: The issue is related to the lack of necessary authorization checks for authenticated users, leading to escalation of privileges. An attacker with the 'Learner' role could...

Vulnerabilities fixed in Honeywell Experion and Safety Manager

Honeywell has fixed vulnerabilities in Experion, Experion Plantcruise and Safety Manager. A malicious party could exploit vulnerabilities to launch attacks that can result in the following categories of damage: Denial-of-Service DoS Manipulation of data Remote code execution Administrator/Root...

Vulnerabilities fixed in GitLab Enterprise Edition and Community Edition

GitLab has fixed vulnerabilities in GitLab Enterprise Edition EE and Community Edition CE. A malicious party could exploit the vulnerabilities to cause a Denial-of-Service, or to bypass security measures to gain access to sensitive data or, under specific circumstances, to take over an account ta...

The vulnerability of the Prompts component in Microsoft Edge and Google Chrome browsers allows a perpetrator to access confidential information.

The vulnerability of the Prompts component in Microsoft Edge and Google Chrome is related to improper security checks for standard elements. Exploiting this vulnerability can allow a malicious actor to gain access to confidential information remotely...

Out-of-bounds Read

FreeRDP is vulnerable to Out-of-bounds Read. The vulnerability is caused due to inadequate bounds checking when reading data from a buffer.This allows an attacker to access or manipulate data outside its intended range, potentially leading to unauthorized information disclosure...

Vulnerability fixed in MongoDB Compass

MongoDB developers have fixed a vulnerability in MongoDB Compass. A malicious party could exploit the vulnerability to use a Man-in-the-Middle attack to gain access to sensitive data, or impersonate another user. MongoDB has released updates to fix the vulnerability in Compass 1.42.1. For more...

Azul Zulu Java Multiple Vulnerabilities (2024-04-16)

The version of Azul Zulu installed on the remote host is 6 prior to 6.63.0.14 / 7 prior to 7.69.0.14 / 8 prior to 8.77.0.14 / 11 prior to 11.71.14 / 17 prior to 17.49.16 / 21 prior to 21.33.14 / 22 prior to 22.30.14. It is, therefore, affected by multiple vulnerabilities as referenced in the...

The vulnerability of the Grafana module in the monitoring and IT environment management system Pandora FMS allows a perpetrator to gain unauthorized access to protected information and execute arbitrary SQL code.

The vulnerability of the Grafana module in the monitoring and management system for IT environments developed by Pandora FMS is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain unauthorized...

The vulnerability of the PAN-OS operating system, related to insufficiently secure data encryption, allows a perpetrator to carry out a “man-in-the-middle” attack and gain unauthorized access to protected information.

The vulnerability of the PAN-OS operating system is related to insufficiently secure data encryption. Exploiting this vulnerability allows a remote attacker to carry out a “man-in-the-middle” attack and gain unauthorized access to protected information...

Vulnerabilities fixed in Oracle VirtualBox

Oracle has fixed vulnerabilities in VirtualBox. A malicious party can exploit the vulnerabilities to launch attacks execute attacks that can lead to the following categories of damage: Denial-of-Service DoS. Remote code execution Administrator/Root privileges Access to sensitive data For successf...

Vulnerabilities fixed in Oracle Systems

Oracle has fixed vulnerabilities in components of System Software. A malicious person with physical access to the hardware, or local access to the infrastructure, can exploit the vulnerabilities to exploit attacks that could result in the following categories of damage: Cross-Site Scripting XSS...

Vulnerabilities fixed in Oracle PeopleSoft

Oracle has fixed vulnerabilities in several PeopleSoft products. A malicious party can exploit the vulnerabilities to perform attacks that could result in the following categories of damage: Cross-Site Scripting XSS. Data manipulation. Remote code execution User Rights Access to sensitive data...

Vulnerabilities fixed in Oracle MySQL

Oracle has fixed vulnerabilities in several MySQL products. A malicious party can exploit the vulnerabilities to launch attacks execute attacks that can result in the following categories of damage: Denial-of-Service DoS. Manipulation of data Access to sensitive data Oracle has fixed the...

PT-2024-23698 · Unknown · Autoexpress

Name of the Vulnerable Software and Affected Versions: autoexpress version 1.3.0 Description: The issue allows attackers to run arbitrary SQL commands via the carId parameter, potentially leading to unauthorized data access or modification. Recommendations: For autoexpress version 1.3.0, avoid...

The vulnerability of the Java framework for securing industrial applications using Spring Security lies in the incomplete cleanup of temporary or auxiliary resources. This allows attackers to access confidential data or cause service failures.

The vulnerability of the Java framework for securing industrial applications using Spring Security is related to incomplete cleanup of temporary or auxiliary resources. Exploiting this vulnerability allows an attacker operating remotely to gain access to confidential data or cause service failure...

Vulnerabilities fixed in Solarwinds Platform

Solarwinds has fixed vulnerabilities in Solarwinds Platform. A malicious party can exploit the vulnerabilities to launch attacks execute attacks that can result in the following categories of damage: Cross-Site Scripting XSS. Manipulation of data Circumvention of security measure Remote code...