CVE-2024-22412 ClickHouse's Role-based Access Control is bypassed when query caching is enabled.

ClickHouse is an open-source column-oriented database management system. A bug exists in the cloud ClickHouse offering prior to version 24.0.2.54535 and in github.com/clickhouse/clickhouse version 23.1. Query caching bypasses the role based access controls and the policies being enforced on roles...

CVE-2024-27930

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can access sensitive fields data from items on which he has read access. This issue has been patched in version 10.0.13...

CVE-2024-27930 Sensitive fields access through dropdowns in GLPI

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can access sensitive fields data from items on which he has read access. This issue has been patched in version 10.0.13...

CVE-2024-2589

Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/modules/book/main/bookdetailschoolperson.php, in multiple parameters. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in th...

CVE-2024-2587

Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/modules/book/main/bookdetailkhetperson.php, in multiple parameters. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the ...

CVE-2024-26641

In the Linux kernel, the following vulnerability has been resolved: ip6tunnel: make sure to pull inner header in ip6tnlrcv syzbot found ip6tnlrcv could access unitiliazed data 1. Call pskbinetmaypull to fix this, and initialize ipv6h variable after this call as it can change skb-head. 1 BUG: KMSA...

CVE-2024-26641 ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()

In the Linux kernel, the following vulnerability has been resolved: ip6tunnel: make sure to pull inner header in ip6tnlrcv syzbot found ip6tnlrcv could access unitiliazed data 1. Call pskbinetmaypull to fix this, and initialize ipv6h variable after this call as it can change skb-head. 1 BUG: KMSA...

Linux kernel security vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from allowing access to data via ip6tnlrcv...

Linux kernel security vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from allowing access to incorrect data...

The vulnerability of the Query Parameter Handler component in the IBM TXSeries for Multiplatforms transaction management software solutions, including the IBM CICS TX Standard and IBM CICS TX Advanced application servers, allows a malicious individual to gain unauthorized access to confidential information.

The vulnerability of the Query Parameter Handler component in the IBM TXSeries transaction application management software for multiplatforms, as well as in the IBM CICS TX Standard and IBM CICS TX Advanced application servers, is related to the use of an unprotected communication channel for dat...

CVE-2024-25654

CVE-2024-25654 affects AVSystem Unified Management Platform (UMP) version 23.07.0.16567~LTS. The root cause is insecure permissions on log files, which, for users with local access to the UMP application server, can expose credentials used to authenticate to all services and can enable decryption...

ABO.CMS Security Vulnerabilities

ABO.CMS is a content management platform. A security vulnerability exists in ABO.CMS version 5.8, which stems from the presence of a SQL injection vulnerability that allows remote attackers to execute arbitrary code, cause a denial of service DoS, elevate privileges, and gain access to sensitive...

PT-2024-13383 · Epmm · Epmm

Name of the Vulnerable Software and Affected Versions: EPMM versions prior to 12.1.0.0 Description: The issue allows an authenticated user with appropriate privilege to access or modify data in the underlying database due to an SQL Injection vulnerability in the web component. Recommendations: Fo...

PT-2024-13382 · Epmm · Epmm

Name of the Vulnerable Software and Affected Versions: EPMM versions prior to 12.1.0.0 Description: An SQL Injection issue in a web component of EPMM allows an authenticated user with appropriate privilege to access or modify data in the underlying database. Recommendations: For versions prior to...

Vulnerabilities fixed in Adobe Bridge

Adobe has fixed vulnerabilities in Adobe Bridge. A malicious party could exploit the vulnerabilities to execute arbitrary code execute application privileges, or to access gain access to system data. Successful exploitation requires the malicious party to trick the victim into opening a rogue fil...

Vulnerability fixed in JFrog Artifactory

JFrog has fixed a vulnerability in Artifactory. A malicious party could exploit the vulnerability to launch a Cross-Site-Scripting XSS attack. Such an attack can lead to execution of arbitrary code in the victim's browser, or access to sensitive data in the context of the victim's browser. JFrog...

Vulnerabilities fixed in Adobe Animate

Adobe has fixed vulnerabilities in Adobe Animate. A malicious party could exploit the vulnerabilities to execute arbitrary code execute application privileges, or to access gain access to system data. Successful exploitation requires the malicious party to trick the victim into opening a rogue...

CVE-2023-36238

Insecure Direct Object Reference IDOR in Bagisto v.1.5.1 allows an attacker to obtain sensitive information via the invoice ID parameter...

CVE-2024-1690

The TeraWallet – Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the terawalletexportusersearch function in all versions up to, and including, 1.4.10. This...

CVE-2024-1127

The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the bookingexportall function in all versions up to, and including, 3.4.1. This makes it possible for authenticated attackers, with...