CVE-2024-21026

CVE-2024-21026 affects Oracle E-Business Suite, LOV component, in versions 12.2.3–12.2.13. The issue stems from insufficient input validation in LOV, allowing an unauthenticated attacker with network access via HTTP to compromise data; attacks require user interaction. Impact includes unauthorize...

CVE-2024-21024

CVE-2024-21024 affects Oracle E-Business Suite, specifically the LOV component in Oracle Complex Maintenance, Repair, and Overhaul. Affected versions are 12.2.3–12.2.13. The issue stems from insufficient input validation in LOV, allowing a remote, unauthenticated attacker with network access via ...

CVE-2024-21023

The CVE-2024-21023 issue affects Oracle E-Business Suite - Complex Maintenance, Repair, and Overhaul (LOV component) on versions 12.2.3–12.2.13. Root cause: insufficient input validation in the LOV, enabling unauthenticated, network-accessible HTTP exploitation. Impact: unauthorized update/insert...

CVE-2024-21017

CVE-2024-21017 affects Oracle E-Business Suite, specifically the LOV component within Oracle Complex Maintenance, Repair, and Overhaul. Publicly confirmed versions affected are 12.2.3–12.2.13. The vulnerability allows an unauthenticated attacker with network access over HTTP to compromise the pro...

CVE-2024-21012

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Networking. Supported versions that are affected are Oracle Java SE: 11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM...

CVE-2024-21012

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Networking. Supported versions that are affected are Oracle Java SE: 11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM...

CVE-2024-21004

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JavaFX. Supported versions that are affected are Oracle Java SE: 8u401; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated...

CVE-2024-21000

CVE-2024-21000 affects Oracle MySQL Server (Server: Security: Privileges). The vulnerability is present in affected MySQL Server components for versions 8.0.36 and prior, and 8.3.0 and prior. Exploitation is possible with network access via multiple protocols and requires high privileges; success...

CVE-2024-21000

Removed by vendor...

CVE-2024-20989

Oracle Hospitality Simphony (Simphony POS) is affected in versions 19.1.0–19.5.4 due to insufficient input validation in the POS component. The vulnerability allows a remote, unauthenticated attacker with network access (HTTP) to modify, add, or delete data and potentially gain unauthorized acces...

CVE-2024-0549

mintplex-labs/anything-llm is vulnerable to a relative path traversal attack, allowing unauthorized attackers with a default role account to delete files and folders within the filesystem, including critical database files such as 'anythingllm.db'. The vulnerability stems from insufficient input...

CVE-2024-0549 Relative Path Traversal in mintplex-labs/anything-llm

mintplex-labs/anything-llm is vulnerable to a relative path traversal attack, allowing unauthorized attackers with a default role account to delete files and folders within the filesystem, including critical database files such as 'anythingllm.db'. The vulnerability stems from insufficient input...

CVE-2024-30248 Piccolo Admin's raw SVG loading may lead to complete data compromise from admin page

Piccolo Admin is an admin interface/content management system for Python, built on top of Piccolo. Piccolo's admin panel allows media files to be uploaded. As a default, SVG is an allowed file type for upload. An attacker can upload an SVG which when loaded can allow arbitrary access to the admin...

The software’s vulnerability for simulating and automating discrete events in Arena Simulation arises from buffer overflows, allowing intruders to execute arbitrary code and compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Arena Simulation software for modeling and automating discrete events arises from buffer overflows. Exploiting this vulnerability allows an attacker to execute arbitrary code and compromise the confidentiality, integrity, and accessibility of the protected information...

GHSA-PMWW-V6C9-7P83 Piccolo Admin's raw SVG loading may lead to complete data compromise from admin page

Summary Piccolo's admin panel provides the ability to upload media files and view them within the admin panel. If SVG is an allowed file type for upload; the default; an attacker can upload an SVG which when loaded under certain contexts allows for arbitrary access to the admin page. This access...

Piccolo Admin's raw SVG loading may lead to complete data compromise from admin page

Summary Piccolo's admin panel provides the ability to upload media files and view them within the admin panel. If SVG is an allowed file type for upload; the default; an attacker can upload an SVG which when loaded under certain contexts allows for arbitrary access to the admin page. This access...

Top 4 Industries at Risk of Credential Stuffing and Account Takeover (ATO) attacks

All industries are at risk of credential stuffing and account takeover ATO attacks. However, some industries are at a greater risk because of the sensitive information or volume of customer data they possess. While cyber-attacks come in all forms and techniques, credential stuffing involves an...

Key Lesson from Microsoft's Password Spray Hack: Secure Every Account

In January 2024, Microsoft discovered they'd been the victim of a hack orchestrated by Russian-state hackers Midnight Blizzard sometimes known as Nobelium. The concerning detail about this case is how easy it was to breach the software giant. It wasn't a highly technical hack that exploited a...

GHSA-X32M-MVFJ-52XV Bypassing Brute Force Protection via Application Crash and In-Memory Data Loss

Summary An attacker can exploit a chain of vulnerabilities, including a Denial of Service DoS flaw and in-memory data storage weakness, to effectively bypass the application's brute force login protection. This makes the application susceptible to brute force attacks, compromising the security of...

EulerOS 2.0 SP8 : python-urllib3 (EulerOS-SA-2024-1296)

According to the versions of the python-urllib3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect i.e., a redirect that differs...