CVE-2023-29241

Improper Information in Cybersecurity Guidebook in Bosch Building Integration System BIS 5.0 may lead to wrong configuration which allows local users to access data via network...

Input validation

Improper Information in Cybersecurity Guidebook in Bosch Building Integration System BIS 5.0 may lead to wrong configuration which allows local users to access data via network...

3 Reasons SaaS Security is the Imperative First Step to Ensuring Secure AI Usage

In today's fast-paced digital landscape, the widespread adoption of AI Artificial Intelligence tools is transforming the way organizations operate. From chatbots to generative AI models, these SaaS-based applications offer numerous benefits, from enhanced productivity to improved decision-making...

Authentication flaw

A broken authentication mechanism in the endpoint excel.php of POS Codekop v2.0 allows unauthenticated attackers to download selling data...

Vulnerabilities fixed in GitLab Enterprise Edition and Community Edition

GitLab has fixed vulnerabilities in GitLab Enterprise Edition EE and Community Edition CE. A malicious party could vulnerabilities to exploit attacks that can result in the following categories of damage: Denial-of-Service DoS. Manipulation of data Circumvention of security measure Accessing...

CVE-2023-29241

Improper Information in Cybersecurity Guidebook in Bosch Building Integration System BIS 5.0 may lead to wrong configuration which allows local users to access data via network...

CVE-2023-29241

Improper Information in Cybersecurity Guidebook in Bosch Building Integration System BIS 5.0 may lead to wrong configuration which allows local users to access data via network...

The vulnerability of the Google Chrome browser’s guest mode allows a hacker to gain access to confidential data, compromise its integrity, and cause service interruptions.

The vulnerability of Google Chrome’s guest mode is related to buffer overflows and the installation of malicious extensions. Exploiting this vulnerability can allow a remote attacker to access confidential data, compromise its integrity, and even cause service interruptions through a specially...

PT-2023-21688 · Unknown · Newspicks App

Name of the Vulnerable Software and Affected Versions: NewsPicks App for Android versions 10.4.5 and earlier NewsPicks App for iOS versions 10.4.2 and earlier Description: The issue is related to hard-coded credentials in the NewsPicks App, which may allow a local attacker to analyze data in the...

PT-2023-22218 · Bosch · Bosch Building Integration System

Name of the Vulnerable Software and Affected Versions: Bosch Building Integration System BIS version 5.0 Description: The issue is related to improper information in the cybersecurity guidebook of the Bosch Building Integration System, which may lead to incorrect configuration. This incorrect...

The vulnerability of the redis-cli interface of the Redis database management system allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the redis-cli interface of the Redis database management system is related to improper restrictions on operations within memory buffers. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and even cause service failures,...

Vulnerability fixed in Sitecore products

Sitecore has fixed a vulnerability in Experience Manager, Experience Platform and Experience Commerce. A malicious party could exploit the vulnerability to execute arbitrary code with rights of the application, or to gain access to sensitive data in the application. Sitecore has released updates ...

Vulnerability fixed in Schneider Electric EcoStruxture Operator Terminal Expert

Schneider Electric has fixed a vulnerability in the EcoStruxture Operator Terminal Expert. A malicious party could exploit the vulnerability to execute arbitrary code on the vulnerable system and gain access to sensitive data. To do this, the malicious party must have local access to the vulnerab...

The vulnerability of the access control service for remote catalogs and the authentication mechanism sssd, related to the disclosure of information, allows a perpetrator to gain access to confidential data.

The vulnerability of the access control service for remote catalogs and the authentication mechanism of sssd involve revealing information that allows reading of sudo rules, which are accessible to any user. Exploiting this vulnerability could enable a malicious individual to gain access to...

Vulnerabilities fixed in IBM MQ

IBM has fixed vulnerabilities in MQ, in both the appliance and the server software. A malicious party could exploit them to cause a denial-of-service DoS, gain access gain access to sensitive data in the queue or to execute arbitrary execute arbitrary code with user privileges. IBM has released...

The vulnerability of the 3D viewing tool JT and the Teamcenter Visualization lifecycle management system allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the 3D viewing tool JT and the Teamcenter Visualization lifecycle management system lies in the reading of data beyond the buffer in memory. Exploiting this vulnerability could allow an intruder to gain unauthorized access to protected information when analyzing a specially...

CVE-2023-30993

IBM Cloud Pak for Security CP4S 1.9.0.0 through 1.9.2.0 could allow an attacker with a valid API key for one tenant to access data from another tenant's account. IBM X-Force ID: 254136...

CVE-2023-30993 IBM Cloud Pak for Security information disclosure

IBM Cloud Pak for Security CP4S 1.9.0.0 through 1.9.2.0 could allow an attacker with a valid API key for one tenant to access data from another tenant's account. IBM X-Force ID: 254136...

CVE-2023-30993 IBM Cloud Pak for Security information disclosure

IBM Cloud Pak for Security CP4S 1.9.0.0 through 1.9.2.0 could allow an attacker with a valid API key for one tenant to access data from another tenant's account. IBM X-Force ID: 254136...

keycloak: oauth client impersonation

A flaw was found in Keycloak. A Keycloak server configured to support mTLS authentication for OAuth/OpenID clients does not properly verify the client certificate chain. A client that possesses a proper certificate can authorize itself as any other client, therefore, access data that belongs to...