1463 matches found
CVE-2023-49076 Pimcore missing token/header to prevent CSRF
Customer-data-framework allows management of customer data within Pimcore. There are no tokens or headers to prevent CSRF attacks from occurring, therefore an attacker could abuse this vulnerability to create new customers. This issue has been patched in version 4.0.5...
Pimcore 跨站请求伪造漏洞
Pimcore is Austria Pimcore company's set of open source for creating and managing Web applications Web content management platform. The platform integrates Web content management, e-commerce framework and product information management applications. A cross-site request forgery vulnerability exis...
Design/Logic Flaw
Pimcore is an Open Source Data & Experience Management Platform. In affected versions the /admin/object/grid-proxy endpoint calls getFilterCondition on fields of classes to be filtered for, passing input from the request, and later executes the returned SQL. One implementation of getFilterConditi...
CVE-2023-47637 SQL Injection in Admin Grid Filter API in Pimcore
Pimcore is an Open Source Data & Experience Management Platform. In affected versions the /admin/object/grid-proxy endpoint calls getFilterCondition on fields of classes to be filtered for, passing input from the request, and later executes the returned SQL. One implementation of getFilterConditi...
FDA medical IoT cyber device compliance. FD&C 524b
TL;DR FD&C 524b is new FDA legislation for medical cyber device compliance Introduced on March 30th 2023 it is now a firm requirement as of October 1st 2023 It demands provision of complex evidence that manufacturers take security seriously Medical cyber device market There are over 10,000 medica...
CVE-2023-43648 baserCMS Directory Traversal vulnerability in Form submission data management Feature
baserCMS is a website development framework. Prior to version 4.8.0, there is a Directory Traversal Vulnerability in the form submission data management feature of baserCMS. Version 4.8.0 contains a patch for this issue...
CVE-2023-43648 baserCMS Directory Traversal vulnerability in Form submission data management Feature
baserCMS is a website development framework. Prior to version 4.8.0, there is a Directory Traversal Vulnerability in the form submission data management feature of baserCMS. Version 4.8.0 contains a patch for this issue...
Directory Traversal
basercms is vulnerable to Directory Traversal. The vulnerability is due to improper sanitization and validation in the Form submission data management feature. An attacker can exploit this vulnerability to gain sensitive information from the server...
GHSA-HMQJ-GV2M-HQ55 baserCMS Directory Traversal vulnerability in Form submission data management Feature
There is a Directory Traversal Vulnerability in Form submission data management Feature to baserCMS. This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users. If you are eligible, please update to the new version as soon as possible...
PT-2023-28899 · Basercms · Basercms
Name of the Vulnerable Software and Affected Versions: baserCMS versions prior to 4.8.0 Description: The issue concerns a Directory Traversal Vulnerability in the form submission data management feature of baserCMS. This vulnerability could allow a logged-in user to obtain information on the...
free5GC Data Forgery Issue Vulnerability
free5GC is an open source project for 5th Generation 5G mobile core networks open sourced by free5GC. A security vulnerability exists in free5GC udm versions prior to 1.2.0, which stems from a problem in pkg/suci/suci.go that allows an invalid curve attack when using Go prior to 1.19. An attacker...
Design/Logic Flaw
vantage6 is privacy preserving federated learning infrastructure. When a collaboration is deleted, the linked resources such as tasks from that collaboration should be deleted. This is partly to manage data properly, but also to prevent a potential but unlikely side-effect that affects versions...
CVE-2023-41881 Deleting a collaboration should also delete linked resources
vantage6 is privacy preserving federated learning infrastructure. When a collaboration is deleted, the linked resources such as tasks from that collaboration should be deleted. This is partly to manage data properly, but also to prevent a potential but unlikely side-effect that affects versions...
CVE-2023-41881 Deleting a collaboration should also delete linked resources
vantage6 is privacy preserving federated learning infrastructure. When a collaboration is deleted, the linked resources such as tasks from that collaboration should be deleted. This is partly to manage data properly, but also to prevent a potential but unlikely side-effect that affects versions...
CVE-2023-41881
Vantage6 vulnerabilities: When a collaboration is deleted, linked resources (e.g., tasks) are not reliably deleted in versions prior to 4.0.0. This could allow authenticated users in a later-created collaboration to see results from the deleted collaboration in some cases. The issue is fixed in v...
PT-2023-28140 · Vantage6 · Vantage6
Name of the Vulnerable Software and Affected Versions: vantage6 versions prior to 4.0.0 Description: vantage6 is privacy preserving federated learning infrastructure. When a collaboration is deleted, the linked resources, such as tasks from that collaboration, should be deleted to manage data...
Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server used by IBM Master Data Management (CVE-2022-40609)
Summary IBM Master Data Management is impacted by vulnerabilities in IBM WebSphere Application Server where IBM SDK, Java Technology Edition 7.1.5.18 and 8.0.8.0 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By sending...
Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server used by IBM Master Data Management (CVE-2023-35890)
Summary IBM Master Data Management version 11.6 and 12.0 is impacted by vulnerability in WebSphere Application Server which could provide weaker than expected security, caused by the improper encoding in a local configuration file. Vulnerability Details CVEID:CVE-2023-35890 DESCRIPTION: IBM...
Important: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.13.3 security and bug fix update
Updated images that fix several bugs are now available for Red Hat OpenShift Data Foundation 4.13.3 on Red Hat Enterprise Linux 8 from Red Hat Container Registry. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS ba...