PT-2024-31201 · Unknown · Guardian/Cmc

Name of the Vulnerable Software and Affected Versions: Guardian/CMC affected versions not specified Description: An access control issue was discovered in the Reports section due to a specific access restriction not being properly enforced for users with limited privileges. If a logged-in user wi...

Incorrect authorization for Reports configuration in Guardian/CMC before 24.2.0

Summary An access control vulnerability was discovered in the Reports section due to a specific access restriction not being properly enforced for users with limited privileges. Impact If a logged-in user with reporting privileges learns how to create a specific application request, they might be...

NewStart CGSL MAIN 6.02 : rpm Multiple Vulnerabilities (NS-SA-2024-0052)

The remote NewStart CGSL host, running version MAIN 6.02, has rpm packages installed that are affected by multiple vulnerabilities: - A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly...

NewStart CGSL MAIN 6.02 : grub2 Multiple Vulnerabilities (NS-SA-2024-0068)

The remote NewStart CGSL host, running version MAIN 6.02, has grub2 packages installed that are affected by multiple vulnerabilities: - A flaw in grub2 was found where its configuration file, known as grub.cfg, is being created with the wrong permission set allowing non privileged users to read i...

NewStart CGSL MAIN 6.02 : webkit2gtk3 Multiple Vulnerabilities (NS-SA-2024-0053)

The remote NewStart CGSL host, running version MAIN 6.02, has webkit2gtk3 packages installed that are affected by multiple vulnerabilities: - A use-after-free issue was found in the AudioSourceProviderGStreamer class of WebKitGTK and WPE WebKit in versions prior to 2.30.5. Processing maliciously...

The vulnerability of the new kernel component in the Linux operating system allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the new kernel component in the Linux operating system is related to a single-shift error. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerability of the arc_emac component in the Linux operating system allows attackers to compromise the confidentiality, integrity, and accessibility of data.

The vulnerability of the arcemac component in the Linux operating system’s kernel is related to the use of memory after deallocation. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of data...

The vulnerability of the RDMA/cma component of the Linux operating system allows attackers to compromise the confidentiality, integrity, and accessibility of data.

The vulnerability of the RDMA/cma component of the Linux operating system’s kernel is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of data...

The vulnerability of software for asset management and GLPI data processing centers, related to improper access control, allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of software for asset management and GLPI data processing centers relates to the implementation of a CSV file, by creating a file with a fake header. Exploiting this vulnerability can allow an attacker operating remotely to compromise the confidentiality, integrity, and...

ROS-20240902-23

A vulnerability in the Flatpak application and environment management tool is related to improper Neutralization of special output elements used by a downstream component. Exploitation of the vulnerability could allow a remote attacker to gain access to sensitive data and compromise its integrity...

The vulnerability of the NTLMSSP discriver, an analyzer of computer network traffic by Wireshark, allows a hacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the NTLMSSP discriminator and the Wireshark traffic analyzer involves an issue where an operation is executed outside the buffer in memory, as a result of a pointer being reassigned when its validity period has expired. Exploiting this vulnerability allows a remote attacker t...

PT-2024-41490 · Ао "Нппкт" · Осон Основа Оnyx

Уязвимость функции run timers модуля net/bluetooth/mgmt.c ядра операционных систем Linux связана с использованием памяти после ее освобождения при обработке объекта struct hci dev. Эксплуатация уязвимости может позволить нарушителю оказать воздействие на конфиденциальность, целостность и...

Missing hostname validation in Kroxylicious

A flaw was found in Kroxylicious. When establishing the connection with the upstream Kafka server using a TLS secured connection, Kroxylicious fails to properly verify the server's hostname, resulting in an insecure connection. For a successful attack to be performed, the attacker needs to perfor...

GHSA-H83P-72JV-G7VP Missing hostname validation in Kroxylicious

A flaw was found in Kroxylicious. When establishing the connection with the upstream Kafka server using a TLS secured connection, Kroxylicious fails to properly verify the server's hostname, resulting in an insecure connection. For a successful attack to be performed, the attacker needs to perfor...

CVE-2024-8285

A flaw was found in Kroxylicious. When establishing the connection with the upstream Kafka server using a TLS secured connection, Kroxylicious fails to properly verify the server's hostname, resulting in an insecure connection. For a successful attack to be performed, the attacker needs to perfor...

CVE-2024-8285

A flaw was found in Kroxylicious. When establishing the connection with the upstream Kafka server using a TLS secured connection, Kroxylicious fails to properly verify the server's hostname, resulting in an insecure connection. For a successful attack to be performed, the attacker needs to perfor...

CVE-2024-8285

CVE-2024-8285 affects Kroxylicious, where TLS upstream connections to Kafka fail to verify the server hostname. This creates a potential for MITM and data integrity/confidentiality impact. Attacks require network access and, per the sources, may require high privileges to modify Kroxylicious conf...

CVE-2024-8285 Kroxylicious: missing upstream kafka tls hostname verification

A flaw was found in Kroxylicious. When establishing the connection with the upstream Kafka server using a TLS secured connection, Kroxylicious fails to properly verify the server's hostname, resulting in an insecure connection. For a successful attack to be performed, the attacker needs to perfor...

CVE-2024-8285 Kroxylicious: missing upstream kafka tls hostname verification

A flaw was found in Kroxylicious. When establishing the connection with the upstream Kafka server using a TLS secured connection, Kroxylicious fails to properly verify the server's hostname, resulting in an insecure connection. For a successful attack to be performed, the attacker needs to perfor...

PT-2024-38914 · Unknown · Kroxylicious

Name of the Vulnerable Software and Affected Versions: Kroxylicious affected versions not specified Description: A flaw was found in Kroxylicious. When establishing the connection with the upstream Kafka server using a TLS secured connection, Kroxylicious fails to properly verify the server's...