CVE-2024-42169

CVE-2024-42169 affects HCL DRYiCE MyXalytics (MyXalytics) with an insecure direct object reference caused by missing access control checks. The CVE entry and multiple connected sources (NVD, CVE List, CIRCL, PT Security) consistently describe unauthorized access to data due to insufficient verifi...

CVE-2024-54847

An issue in CP Plus CP-VNR-3104 B3223P22C02424 allows attackers to access the Diffie-Hellman DH parameters and access sensitive data or execute a man-in-the-middle attack...

CVE-2024-54849

An issue in CP Plus CP-VNR-3104 B3223P22C02424 allows attackers to obtain the second RSA private key and access sensitive data or execute a man-in-the-middle attack...

CVE-2024-54846

An issue in CP Plus CP-VNR-3104 B3223P22C02424 allows attackers to obtain the EC private key and access sensitive data or execute a man-in-the-middle attack...

CP Plus CP-VNR-3104 安全漏洞

The CP Plus CP-VNR-3104 is a network video recorder from CP Plus. A security vulnerability exists in CP Plus CP-VNR-3104 version B3223P22C02424. An attacker could exploit this vulnerability to obtain a second RSA private key and access sensitive data or perform a man-in-the-middle attack...

CVE-2024-54846

CVE-2024-54846 affects CP Plus CP‑VNR‑3104 (firmware/build B3223P22C02424). The vulnerability reportedly allows an attacker to obtain an EC private key and either access sensitive data or perform a man‑in‑the‑middle attack. Publicly documented details in CNNVD describe exploitation against CP‑VNR...

PT-2025-4767 · Apache · Apache Cassandra

Name of the Vulnerable Software and Affected Versions: Apache Cassandra versions 3.0.30, 3.11.17, 4.0.15, 4.1.7, 5.0.2 Description: A privilege escalation issue exists in Apache Cassandra, where a user with MODIFY permission on all keyspaces can escalate privileges to superuser within a targeted...

ROS-20250110-02

A vulnerability in the Exiv2 media metadata management library is related to a flaw in the use of the assert function. Exploitation of the vulnerability allows an attacker acting remotely to cause a denial of service using a specially crafted image file Vulnerability in the Jp2Image::readMetadata...

Insufficient Type Distinction

Overview strawberry-graphql is an A library for creating GraphQL APIs Affected versions of this package are vulnerable to Insufficient Type Distinction in the relay integration that affects multiple ORM integrations Django, SQLAlchemy, Pydantic. An attacker can access unauthorized data by queryin...

Important: Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 (openstack-ironic) security update

An update for openstack-ironic is now available for Red Hat OpenStack Platform 16.2 Train for Red Hat Enterprise Linux RHEL 8.4. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

PT-2025-2643 · Ibm · Ibm Openpages

Name of the Vulnerable Software and Affected Versions: IBM OpenPages version 9.0 Description: The issue allows an authenticated user to obtain sensitive information, such as configurations that should only be available to privileged users. Recommendations: For IBM OpenPages version 9.0, at the...

WordPress plugin linkID 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2025-3076

Name of the Vulnerable Software and Affected Versions CP Plus CP-VNR-3104 B3223P22C02424 affected versions not specified Description The issue allows attackers to obtain the EC private key, which can be used to access sensitive data or execute a man-in-the-middle attack. This can potentially...

Duke Smart Toilet Lab Motius 安全漏洞

Duke Smart Toilet Lab Motius is a smart sampling toilet from Duke University. A security vulnerability exists in Duke Smart Toilet Lab Motius version 1.3.11. An attacker exploiting this vulnerability could gain access to sensitive information...

ROS-20250109-05

Vulnerability in Firefox ESR, Firefox web browsers and Thunderbird email client is related to errors in data type conversion due to enabled autorun private mode. data type conversion errors due to enabled private mode autorun. Exploitation of the vulnerability could allow an attacker acting...

LangChain < 0.2.5 SQLi through Prompt Injection

The version of LangChain installed on the remote host is prior to 0.2.5. It is, therefore, affected by a prompt injection vulnerability in the GraphCypherQAChain class which leads to SQL injection. This vulnerability permits unauthorized data manipulation, data exfiltration, denial of service DoS...

HPESBNW04772 rev.1 - Aruba CX 10000 Switch Series, Traffic Handling Vulnerability

Potential Security Impact: Remote: Unauthorized Access to Data SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Aruba CX 10000 Switch Series See summary for affected versions. Affected Products HPE Aruba Networking CX 10000 Switch Series running the following CX Operating System...

CVE-2024-12316

The Jupiter X Core plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportpopupaction function in all versions up to, and including, 4.8.5. This makes it possible for unauthenticated attackers to export popup templates...

CVE-2024-10866

CVE-2024-10866: Export Import Menus (WordPress) vulnerability is confirmed in the WordPress Export Import Menus plugin up to version 1.9.1, where an missing capability check in dsp_export_import_menus() allows unauthenticated users to export menu data and settings. The CVSS-like score in the init...

CVE-2024-12535 Host PHP Info <= 1.0.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure

The Host PHP Info plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check when including the 'phpinfo' function in all versions up to, and including, 1.0.4. This makes it possible for unauthenticated attackers to read configuration settings and predefin...