yamcs__yamcs_CVE-2023-45277_5-8-6

Yamcs Mission Control Sito web: https://yamcs.org Mailing list: Google Groups Yamcs è un framework per il controllo di missione sviluppato in Java. Utilizza un'architettura aperta che consente di adattare le sue funzionalità tramite file di configurazione yaml. Puoi anche estendere l'insieme di...

CVE-2026-73499

A flaw was found in etcd, a distributed key-value store. A user with READ permission on a single key can bypass authorization checks in the Watch gRPC API by using open-ended range requests. This allows them to receive watch events for keys beyond their authorized scope, leading to information...

BIT-ETCD-2026-73499 etcd: Watch API authorization bypass via open-ended range requests

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with clientv3.WithFromKey to receive watch events for every key lexicographically greater than o...

CVE-2026-73499

etcd vulnerable to authorization bypass in the Watch gRPC API when using clientv3.WithFromKey() with an open-ended range end. Before versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ on a single exact key could observe watch events for every key lexicographically greater than or equal to th...

CVE-2026-73499 etcd: Watch API authorization bypass via open-ended range requests

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with clientv3.WithFromKey to receive watch events for every key lexicographically greater than o...

CVE-2026-73499 etcd: Watch API authorization bypass via open-ended range requests

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with clientv3.WithFromKey to receive watch events for every key lexicographically greater than o...

etcd: Watch API authorization bypass via open-ended range requests

Impact What kind of vulnerability is it? Who is impacted? A user granted READ permission on a single, exact key can use the Watch gRPC API with clientv3.WithFromKey an open-ended, "from this key to the end of the keyspace" watch to receive watch events for every key lexicographically greater than...

GHSA-XG4H-6GFC-H4M8 etcd: Watch API authorization bypass via open-ended range requests

Impact What kind of vulnerability is it? Who is impacted? A user granted READ permission on a single, exact key can use the Watch gRPC API with clientv3.WithFromKey an open-ended, "from this key to the end of the keyspace" watch to receive watch events for every key lexicographically greater than...

CVE-2026-15538

A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the component API. This manipulation of the argument Field causes improperly controlled modification of object prototype attributes. The attack is possible to be...

Microsoft Windows 11 23H2 Pro SEoL

Microsoft Windows 11 23H2 Pro is no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if...

CVE-2026-6885

Borg SPM 2007 Sales Ended in 2008 developed by BorG Technology Corporation has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

CVE-2025-12296

A security vulnerability has been detected in D-Link DAP-2695 2.00RC13. The impacted element is the function sub4174B0 of the component Firmware Update Handler. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be...

EUVD-2025-36209

A security vulnerability has been detected in D-Link DAP-2695 2.00RC13. The impacted element is the function sub4174B0 of the component Firmware Update Handler. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be...

CVE-2025-9752

A security vulnerability has been detected in D-Link DIR-852 1.00CN B09. Impacted is the function soapcgimain of the file soap.cgi of the component SOAP Service. Such manipulation of the argument service leads to os command injection. The attack can be launched remotely. The exploit has been...

Malicious code in @malware-test-cagot-heist-ended-total/test-mlw3-cagot-heist-ended-total (npm)

The package @malware-test-cagot-heist-ended-total/test-mlw3-cagot-heist-ended-total was found to contain malicious code...

Training RL Agents for Multi-Objective Network Defense Tasks

Open-ended learning OEL -- which emphasizes training agents that achieve broad capability over narrow competency -- is emerging as a paradigm to develop artificial intelligence AI agents to achieve robustness and generalization. However, despite promising results that demonstrate the benefits of...

CVE-2024-12907

Kentico CMS in version 7 is vulnerable to a Reflected XSS attacks through manipulation of a specific GET request parameter sent to /CMSMessages/AccessDenied.aspx endpoint. Notably, support for this version of Kentico ended in 2016. Version 8 was tested as well and does not contain this...

CVE-2024-12907

CVE-2024-12907 affects Kentico CMS 7, where a Reflected XSS can be triggered by manipulating a specific GET parameter sent to the /CMSMessages/AccessDenied.aspx endpoint. The description notes that Kentico 7 reached end of support in 2016, and Kentico 8 has been tested and does not contain this v...

PT-2024-38246 · Bolt Cms · Bolt Cms

Name of the Vulnerable Software and Affected Versions: Bolt CMS version 3.7.1 Description: A vulnerability was found in the Entry Preview Handler component, affecting the processing of the file /preview/page. The manipulation of the body argument leads to cross-site scripting. The attack can be...

CVE-2024-21780

Stack-based buffer overflow vulnerability exists in HOME SPOT CUBE2 V102 and earlier. Processing a specially crafted command may result in a denial of service DoS condition. Note that the affected products are no longer supported...