External Secrets 安全漏洞

External Secrets is a Kubernetes-related application open-sourced by External Secrets. A security vulnerability exists in External Secrets versions prior to 0.10.2, which stems from the ability to retrieve or gain access to all secrets across a cluster by abusing deployed SA tokens for elevated...

Security Bulletin: IBM DataPower Gateway vulnerable to multiple kernel CVEs

Summary IBM DataPower Gateway has addressed multiple CVEs in 10.5.0.12 Vulnerability Details CVEID:CVE-2023-2162 DESCRIPTION: Linux Kernel could allow a local attacker to obtain sensitive information, caused by a use-after-free flaw in the iscsiswtcpsessioncreate function in drivers/scsi/iscsitcp...

The vulnerability of the Cisco Meraki Systems Manager, a platform for managing network devices, in the Windows operating system allows a hacker to execute arbitrary code with elevated privileges.

The vulnerability of the Cisco Meraki Systems Manager, a platform for managing network devices, relates to improper handling of search paths in the catalog during execution. Exploiting this vulnerability can allow an attacker to execute arbitrary code with elevated privileges...

Security Bulletin: Vulnerability in Apache Hadoop affects watsonx.data

Summary For CVE-2018-11768, a remote hacker could exploit a vulnerability in Apache Hadoop caused by a mismatch in the size of the fields used to store user/group information between memory and disk representation. For CVE-2020-9492, a remote attacker could gain elevated privileges on the system,...

Amazon Linux 2 : docker (ALASECS-2024-041)

The version of docker installed on the remote host is prior to 25.0.3-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2024-041 advisory. A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read man...

CVE-2024-20469

Cisco CVE-2024-20469 is a local-authenticated command-injection vulnerability in specific Cisco Identity Services Engine (ISE) CLI commands. It allows an authenticated administrator to submit crafted CLI input to execute arbitrary OS commands with root privileges (privilege escalation). The vulne...

Cisco Meraki Systems Manager Agent for Windows Privilege Escalation Vulnerability

A vulnerability in Cisco Meraki Systems Manager SM Agent for Windows could allow an authenticated, local attacker to execute arbitrary code with elevated privileges. This vulnerability is due to incorrect handling of directory search paths at runtime. A low-privileged attacker could exploit this...

WordPress plugin Secure Copy Content Protection and Content Locking 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the WordPre...

CVE-2024-8382

The Mozilla Foundation's Security Advisory: Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events. Web content that tried to use those interfaces would not be able to use them with elevated privileges, but their presence...

CVE-2024-8382

Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events. Web content that tried to use those interfaces would not be able to use them with elevated privileges, but their presence would indicate certain browser features had...

New Flaws in Microsoft macOS Apps Could Allow Hackers to Gain Unrestricted Access

Eight vulnerabilities have been uncovered in Microsoft applications for macOS that an adversary could exploit to gain elevated privileges or access sensitive data by circumventing the operating system's permissions-based model, which revolves around the Transparency, Consent, and Control TCC...

Vulnerabilities fixed in Progress WhatsUp Gold

Progress has fixed vulnerabilities in WhatsUp Gold. A malicious party can exploit the vulnerabilities to retrieve or change the password of the application user in a Single User installation, or in a Multi User installation to change the password of a user with elevated privileges through an...

CVE-2024-5622

An untrusted search path vulnerability in the AprolConfigureCCServices of B&R APROL = R 4.2.-07P3 and = R 4.4-00P3 may allow an authenticated local attacker to execute arbitrary code with elevated privileges...

CVE-2024-5622 Untrusted search path vulnerability in the AprolConfigureCCServices of B&R APROL

An untrusted search path vulnerability in the AprolConfigureCCServices of B&R APROL = R 4.2.-07P3 and = R 4.4-00P3 may allow an authenticated local attacker to execute arbitrary code with elevated privileges...

CVE-2024-5622

The CVE-2024-5622 entry concerns B&R APROL (AprolConfigureCCServices). Multiple sources corroborate an untrusted search path vulnerability that could allow an authenticated local attacker to execute arbitrary code with elevated privileges. Affected are APROL versions R 4.2.-07P3 and R 4.4-00P3 or...

CVE-2024-5622 Untrusted search path vulnerability in the AprolConfigureCCServices of B&R APROL

An untrusted search path vulnerability in the AprolConfigureCCServices of B&R APROL = R 4.2.-07P3 and = R 4.4-00P3 may allow an authenticated local attacker to execute arbitrary code with elevated privileges...

B&R APROL 安全漏洞

B&R Industrial Automation B&R APROL is a process control system from B&R Industrial Automation, Austria. A security vulnerability exists in B&R APROL that stems from the presence of an untrusted search path vulnerability that allows an authenticated, local attacker to execute arbitrary code with...

Dell BIOS Input Validation Error Vulnerability (CNVD-2024-37419)

Dell BIOS is embedded software on a small memory chip on the motherboard of a computer from Dell USA. The Dell BIOS suffers from an input validation error vulnerability that stems from the presence of incorrect input validation, which can be exploited by an attacker with elevated privileges and...

Rockwell Automation ThinManager 安全漏洞

Rockwell Automation ThinManager is the United States Rockwell Rockwell Automation a thin client management software. A remote code execution vulnerability exists in Rockwell Automation ThinManager ThinServer, which can be exploited by an authenticated, local attacker to submit a special request t...

WordPress plugin Ditty 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...