Security Bulletin: IBM Tivoli Composite Application Manager for Application Diagnostics installed IBM WebSphere Application Server traditional is vulnerable to an XML External Entity (XXE) injection vulnerability (CVE-2024-22354).

Summary The security issue described in CVE-2024-22354 has been identified in the WebSphere Application Server traditional included as part of IBM Tivoli Composite Application Manager for Application Diagnostics Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes...

Security Bulletin: IBM Tivoli Composite Application Manager for Application Diagnostics installed WebSphere Application Server traditional is vulnerable to a server-side request forgery (SSRF) vulnerability (CVE-2024-22329).

Summary The security issue described in CVE-2024-22329 has been identified in the WebSphere Application Server traditional included as part of IBM Tivoli Composite Application Manager for Application Diagnostics Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes...

Metasploit Weekly Wrap-Up 04/19/24

Welcome Ryan and the new CrushFTP module It's not every week we add an awesome new exploit module to the Framework while adding the original discoverer of the vulnerability to the Rapid7 team as well. We're very excited to welcome Ryan Emmons to the Emergent Threat Response team, which works...

Security Bulletin: IBM Tivoli Composite Application Manager for Application Diagnostics Installed WebSphere Application Server traditional could provide weaker than expected security for outbound SSL connections (CVE-2023-50313)

Summary The security issue described in CVE-2023-50313 has been identified in the WebSphere Application Server traditional included as part of IBM Tivoli Composite Application Manager for Application Diagnostics Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes...

Security Bulletin: IBM Tivoli Composite Application Manager for Application Diagnostics Installed IBM WebSphere Application Server traditional is vulnerable to a denial of service due to jose4j (CVE-2023-51775)

Summary The security issue described in CVE-2023-51775 has been identified in the WebSphere Application Server traditional included as part of IBM Tivoli Composite Application Manager for Application Diagnostics Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes...

CVE-2024-25002

Command Injection in the diagnostics interface of the Bosch Network Synchronizer allows unauthorized users full access to the device...

CVE-2024-25002

Command Injection in the diagnostics interface of the Bosch Network Synchronizer allows unauthorized users full access to the device...

CVE-2024-25002

CVE-2024-25002 relates to a command injection in the Bosch Network Synchronizer diagnostics interface. The vulnerability allows unauthorized users to execute commands, potentially attaining full access to the device. Connected sources indicate affected versions are prior to 9.30, but exact vulner...

CVE-2024-25002: Improper Neutralization of Special Elements used in an OS Command

Command Injection in the diagnostics interface of the Bosch Network Synchronizer allows unauthorized users full access to the device...

PT-2024-20692 · Bosch · Bosch Network Synchronizer

Name of the Vulnerable Software and Affected Versions: Bosch Network Synchronizer affected versions not specified Description: Command Injection in the diagnostics interface of the Bosch Network Synchronizer allows unauthorized users full access to the device. Recommendations: At the moment, ther...

Sunhillo SureLine OS Command Injection Vulnerablity

Sunhillo SureLine contains an OS command injection vulnerability that allows an attacker to cause a denial-of-service or utilize the device for persistence on the network via shell metacharacters in ipAddr or dnsAddr in /cgi/networkDiag.cgi...

PT-2024-7742

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.8.0-rc4-syzkaller-00212-g40b9385dd8e6 Description The vulnerability is related to a possible deadlock in the subflow diag of the mptcp component in the Linux kernel. This issue can be exploited to cause a denia...

CVE-2024-20937

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards component: Monitoring and Diagnostics SEC. Supported versions that are affected are Prior to 9.2.8.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD...

CVE-2024-20937

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards component: Monitoring and Diagnostics SEC. Supported versions that are affected are Prior to 9.2.8.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD...

CVE-2024-20937: Exposure of Sensitive Information to an Unauthorized Actor

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards component: Monitoring and Diagnostics SEC. Supported versions that are affected are Prior to 9.2.8.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD...

Update Rollup 70 for Azure Site Recovery -KB5034599

None None...

CVE-2023-6028

A reflected cross-site scripting XSS vulnerability exists in the SVG version of System Diagnostics Manager of B&R Automation Runtime versions = G4.93 that enables a remote attacker to execute arbitrary JavaScript code in the context of the attacked user’s browser session...

Cross site scripting

A reflected cross-site scripting XSS vulnerability exists in the SVG version of System Diagnostics Manager of B&R Automation Runtime versions = G4.93 that enables a remote attacker to execute arbitrary JavaScript code in the context of the attacked user’s browser session...

CVE-2023-6028

CVE-2023-6028 affects B&R Automation Runtime; a reflected XSS vulnerability exists in the SVG version of the System Diagnostics Manager. Affected products/versions: B&R Automation Runtime versions

CVE-2023-6028: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting XSS vulnerability exists in the SVG version of System Diagnostics Manager of B&R Automation Runtime versions = G4.93 that enables a remote attacker to execute arbitrary JavaScript code in the context of the attacked user’s browser session...