19077 matches found
PT-2023-22218 · Bosch · Bosch Building Integration System
Name of the Vulnerable Software and Affected Versions: Bosch Building Integration System BIS version 5.0 Description: The issue is related to improper information in the cybersecurity guidebook of the Bosch Building Integration System, which may lead to incorrect configuration. This incorrect...
Vulnerability fixed in Sitecore products
Sitecore has fixed a vulnerability in Experience Manager, Experience Platform and Experience Commerce. A malicious party could exploit the vulnerability to execute arbitrary code with rights of the application, or to gain access to sensitive data in the application. Sitecore has released updates ...
The vulnerability of the access control service for remote catalogs and the authentication mechanism sssd, related to the disclosure of information, allows a perpetrator to gain access to confidential data.
The vulnerability of the access control service for remote catalogs and the authentication mechanism of sssd involve revealing information that allows reading of sudo rules, which are accessible to any user. Exploiting this vulnerability could enable a malicious individual to gain access to...
Vulnerability fixed in Schneider Electric EcoStruxture Operator Terminal Expert
Schneider Electric has fixed a vulnerability in the EcoStruxture Operator Terminal Expert. A malicious party could exploit the vulnerability to execute arbitrary code on the vulnerable system and gain access to sensitive data. To do this, the malicious party must have local access to the vulnerab...
Vulnerabilities fixed in IBM MQ
IBM has fixed vulnerabilities in MQ, in both the appliance and the server software. A malicious party could exploit them to cause a denial-of-service DoS, gain access gain access to sensitive data in the queue or to execute arbitrary execute arbitrary code with user privileges. IBM has released...
The vulnerability of the 3D viewing tool JT and the Teamcenter Visualization lifecycle management system allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the 3D viewing tool JT and the Teamcenter Visualization lifecycle management system lies in the reading of data beyond the buffer in memory. Exploiting this vulnerability could allow an intruder to gain unauthorized access to protected information when analyzing a specially...
CVE-2023-30993
IBM Cloud Pak for Security CP4S 1.9.0.0 through 1.9.2.0 could allow an attacker with a valid API key for one tenant to access data from another tenant's account. IBM X-Force ID: 254136...
CVE-2023-30993 IBM Cloud Pak for Security information disclosure
IBM Cloud Pak for Security CP4S 1.9.0.0 through 1.9.2.0 could allow an attacker with a valid API key for one tenant to access data from another tenant's account. IBM X-Force ID: 254136...
CVE-2023-30993 IBM Cloud Pak for Security information disclosure
IBM Cloud Pak for Security CP4S 1.9.0.0 through 1.9.2.0 could allow an attacker with a valid API key for one tenant to access data from another tenant's account. IBM X-Force ID: 254136...
keycloak: oauth client impersonation
A flaw was found in Keycloak. A Keycloak server configured to support mTLS authentication for OAuth/OpenID clients does not properly verify the client certificate chain. A client that possesses a proper certificate can authorize itself as any other client, therefore, access data that belongs to...
Uncover and Remediate Toxic Combinations with Attack Path Analysis
Particularly at enterprise scale, it’s not uncommon to have hundreds of thousands of resources running across your cloud environments at any given time. Of course, these resources aren’t running independently. In modern environments, these resources are all interconnected and in many cases...
Improper Access Control
remult is vulnerable to Improper Access Control. The @Entity decorator's apiPrefilter option prevents unwanted access to data by returning a filter that verifies the validity of an entity instance's id. An attacker who knows the id beforehand is able to read, update, and delete the entity instanc...
Vulnerabilities fixed in Google Chrome
Google has fixed vulnerabilities in Google Chrome. A malicious party can exploit the vulnerabilities to execute arbitrary code execute arbitrary code in the context of the browser, or potentially access gain access to sensitive data in the context of the browser. The malicious party must trick th...
Vulnerabilities fixed in NVIDIA GPU products
Nvidia has fixed vulnerabilities in the drivers and control software of several GPUs. A malicious party could exploit vulnerabilities to launch attacks that can lead to the following categories of damage: Denial-of-Service DoS. Manipulation of data Remote code execution Administrator/Root...
CVE-2023-35800
Stormshield Endpoint Security Evolution 2.0.0 through 2.4.2 has Insecure Permissions. An ACL entry on the SES Evolution agent directory that contains the agent logs displayed in the GUI allows interactive users to read data, which could allow access to information reserved to administrators...
IBM Cloud Pak for Security 信息泄露漏洞
IBM Cloud Pak for Security is an application from International Business Machines IBM, Inc. an open security platform that connects to your existing data sources to generate deeper insights and enables you to take automated action faster. A security vulnerability exists in IBM Cloud Pak for...
Vulnerabilities fixed in Synology Mail Station
Synology has fixed vulnerabilities in MailStation. A malicious party can exploit the vulnerabilities to use SQL injection to execute arbitrary code, or gain access to sensitive data. No CVE identifiers have been disclosed for the vulnerabilities yet. Synology gives the vulnerabilities the status...
Trend Micro Apex Central SQL注入漏洞
Trend Micro Apex Central is a Web-based console from Trend Micro, Inc. Trend Micro Apex Central suffers from an SQl injection vulnerability that can be exploited by an attacker to submit a specially crafted SQL request to manipulate the database, obtain sensitive information or execute arbitrary...
CVE-2023-32391
The issue was addressed with improved checks. This issue is fixed in iOS 15.7.6 and iPadOS 15.7.6, watchOS 9.5, iOS 16.5 and iPadOS 16.5, macOS Ventura 13.4. A shortcut may be able to use sensitive data with certain actions without prompting the user...
