CVE-2024-20947

CVE-2024-20947 affects Oracle E-Business Suite, Oracle Common Applications (CRM User Management Framework) and impacts version 12.2.3–12.2.13. The vulnerability allows a low-privilege, network-access attacker (HTTP) to compromise Oracle Common Applications with user interaction required. Conseque...

CVE-2024-20935

CVE-2024-20935 affects Oracle E-Business Suite, specifically the Oracle Installed Base component (Engineering Change Order). Affected versions are 12.2.3–12.2.13. The vulnerability allows an unauthenticated attacker, with network access via HTTP, to compromise data and perform unauthorized update...

CVE-2024-21915

CVE-2024-21915 affects Rockwell Automation’s FactoryTalk Service Platform (FTSP) before version 2.74. The vulnerability allows a user with basic privileges to escalate to FTSP Administrator privileges, enabling reading/modifying sensitive data, data deletion, and potential FTSP service disruption...

CVE-2024-1523 EC-WEB FS-EZViewer(Web) - SQL Injection

EC-WEB FS-EZViewerWeb's query functionality lacks proper restrictions of user input, allowing remote attackers authenticated as regular user to inject SQL commands for reading, modifying, and deleting database records, as well as executing system commands. Attackers may even leverage the dbo...

CVE-2024-25643

The SAP Fiori app My Overtime Request - version 605, does not perform the necessary authorization checks for an authenticated user which may result in an escalation of privileges. It is possible to manipulate the URLs of data requests to access information that the user should not have access to...

Authorization

In SAP ABA Application Basis - versions 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75I, an attacker authenticated as a user with a remote execution authorization can use a vulnerable interface. This allows the attacker to use the interface to invoke an application function to perform actions...

Vulnerabilities fixed in Siemens products

Siemens has fixed vulnerabilities in various products such as. SIMATIC, WinCC, Parasolid, RUGGEDCOM, Simcenter, SCALANCE, SIDIS, Teknomatix, Unicam and Location Intelligence. The vulnerabilities potentially enable a malicious party to conduct attacks that could result in the following categories ...

Vulnerability of the MySQL Server component: The DML mechanism of the MySQL database management system’s server allows a hacker to trigger a service failure.

The vulnerability of the MySQL Server component exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...

Vulnerability of the Server component: The Oracle MySQL Server database management system’s replication mechanism allows a hacker to gain unauthorized access to read, modify, or delete data, or to cause service interruptions.

The vulnerability of the Oracle MySQL Server database management system’s replication component is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to read, modify, or delete data, or to cause service interruptions...

Directory Traversal: Examples, Testing, and Prevention

Unveiling the Enigma of Path Navigation: An Exhaustive Exploration and Insight Path Navigation, often referred to as Folder Navigation, symbolizes a kind of security extraction point allowing unauthorized individuals to gain unauthorized access to specific files held within a server's database...

Out-of-bounds Read

Vyper is vulnerable to Out-of-bounds Read. The vulnerability is due to improper validation of the return data length. This allows an attacker to manipulate the data to extend beyond the intended boundaries...

SUSE SLED15: java-11-openjdk / java-11-openjdk-demo / java-11-openjdk-devel / etc (SUSE-SU-2024:0321-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0321-1 advisory. Updated to version 11.0.22 January 2024 CPU: - CVE-2024-20918: Fixed an out of bounds access in...

JobSearch WP Job Board < 2.3.4 - Arbitrary File Upload to RCE

Description The plugin does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server Navigate to the site, and paste the following in your browser's console: fetch'/wp-admin/admin-ajax.php', method: 'POST', headers:...

GHSA-29W6-C52G-M8JC C5 Firefly III CSV Injection.

Summary CSV injection is a vulnerability where untrusted user input in CSV files can lead to unauthorized access or data manipulation. In my subsequent testing of the application. Details I discovered that there is an option to "Export Data" from the web app to your personal computer, which expor...

Unauthorized Data Manipulation

Oracle Java SE is vulnerable to Unauthorized Data Manipulation attack. The vulnerability is due to improper handling of data supplied to APIs in the Hotspot component without using untrusted Java Web Start applications or untrusted Java applets, which allows an unauthenticated attacker with netwo...

Vulnerabilities fixed in Splunk

Splunk has fixed vulnerabilities in Splunk Enterprise. A malicious party can exploit the vulnerabilities to launch attacks execute attacks that can result in the following categories of damage: Denial-of-Service DoS. Manipulation of data Access to sensitive data Access to system data Splunk has...

CVE-2024-23687 FOLIO mod-data-export-spring Hard-Coded Credentials

Hard-coded credentials in FOLIO mod-data-export-spring versions before 1.5.4 and from 2.0.0 to 2.0.2 allows unauthenticated users to access critical APIs, modify user data, modify configurations including single-sign-on, and manipulate fees/fines...

Vulnerabilities fixed in Oracle Hyperion

Oracle has fixed vulnerabilities in several Hyperion products. A malicious party can exploit the vulnerabilities to launch attacks execute attacks that can result in the following categories of damage: Denial-of-Service DoS. Data manipulation. Remote code execution User rights Access to sensitive...

Vulnerabilities fixed in Oracle Analytics

Oracle has fixed vulnerabilities in several Analytics products. A malicious party could exploit the vulnerabilities to execute attacks that could result in the following categories of damage: Cross-Site Scripting XSS Denial-of-Service DoS. Manipulation of data Access to sensitive data Oracle has...

Vulnerabilities fixed in Oracle Java SE

Oracle has fixed vulnerabilities in several Java products. A malicious party can exploit the vulnerabilities to launch attacks execute attacks that can lead to the following categories of damage: Denial-of-Service DoS. Data manipulation. Remote code execution User rights Access to sensitive data...