PT-2024-31420 · Ibm · Webmethods Integration

Name of the Vulnerable Software and Affected Versions: IBM webMethods Integration version 10.15 Description: The issue allows an authenticated user to upload and execute arbitrary files, which could be executed on the underlying operating system. This flaw enables attackers to execute arbitrary...

CVE-2024-36398

A vulnerability has been identified in SINEC NMS All versions V3.0. The affected application executes a subset of its services as NT AUTHORITY\SYSTEM. This could allow a local attacker to execute operating system commands with elevated privileges...

CVE-2024-36398

A vulnerability has been identified in SINEC NMS All versions V3.0. The affected application executes a subset of its services as NT AUTHORITY\SYSTEM. This could allow a local attacker to execute operating system commands with elevated privileges...

CVE-2024-42166 Command Injection in Applicationname

The function "generateappcertificates" in lib/appcertificates.js of FIWARE Keyrock = 8.4 does not neutralize special elements used in an OS Command properly. This allows an authenticated user with permissions to create applications to execute commands by creating an application with a malicious...

TeamT5 ThreatSonar Anti-Ransomware 代码问题漏洞

TeamT5 ThreatSonar Anti-Ransomware is a proactive and intelligent endpoint detection and response solution from TeamT5. A code issue vulnerability exists in TeamT5 ThreatSonar Anti-Ransomware version 3.4.5 and prior versions, which stems from a failure to properly validate the contents of an...

Malicious code in radioplayer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6556141379c5f4a05e6d6f79e61cd58affbe8cf738f0e0db1f9797fad19c8fa3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-40720

The specific API in TCBServiSign Windows Version from CHANGING Information Technology does not properly validate server-side input. When a user visits a spoofed website, unauthenticated remote attackers can modify the HKEYCURRENTUSER registry to execute arbitrary commands...

Changing TCBServiSign 输入验证错误漏洞

Changing TCBServiSign is a cross-platform security control component from Changing, China. An input validation error vulnerability exists in versions prior to Changing TCBServiSign 1.0.24.0318. The vulnerability stems from a specific API that does not properly validate server-side input, which...

Malicious code in psh-hydra-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7e602e73e004aedbd93e2617bee443de236f268346b5b57bd42fcd32669825fd The OpenSSF Package Analysis project identified 'psh-hydra-sdk' @ 1.0.1 npm as malicious. It is considered malicious because: - The package...

CVE-2023-48362

CVE-2023-48362 describes a XXE vulnerability in the XML Format Plugin of Apache Drill . The issue affects Drill 1.19.0 and later, enabling an attacker to read arbitrary files on a remote file system or execute commands through a crafted XML file. The documented remediation is to upgrade to Apache...

Cisco Identity Services Engine File Upload Vulnerability

Cisco Identity Services Engine Cisco ISE is an environment-aware platform ISE Identity Services Engine from Cisco. The platform collects real-time information from the network, users, and devices, and develops and enforces policies to regulate the network. A file upload vulnerability exists in th...

SolarWinds Access Rights Manager 授权问题漏洞

SolarWinds Access Rights Manager ARM is a tool for managing and monitoring user access rights. It helps organizations streamline the rights management process and improve security and compliance. An authorization issue vulnerability exists in SolarWinds Access Rights Manager, which can be exploit...

Malicious code in sap-before (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e69ecc097b76eba1972249f32c908d6b1bb8f988ec091db41d021568410b6c6e The OpenSSF Package Analysis project identified 'sap-before' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in sap-always (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5b6d3b5acd9b98712bf1b1c0babd85de045245395e42d961a8cfd6f3fab49662 The OpenSSF Package Analysis project identified 'sap-always' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in sap-addnew (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 12f8c238be86b6eda197ccf055ce731f7f59ebb9506f2333979fb21e18f5072a The OpenSSF Package Analysis project identified 'sap-addnew' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in compiler-wasm-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2c3e3404f77486c9124e70890333cce19382125d07dac40b2ed4b87a466c855e The OpenSSF Package Analysis project identified 'compiler-wasm-lib' @ 4.0.0 npm as malicious. It is considered malicious because: - The package...

AZL-43110 CVE-2023-24531 affecting package golang for versions less than 1.21.0-1

Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executing its output as a shell script can cause various bad bahaviors, including executing arbitrary commands or inserting new environment variables. This issue is...

CVE-2023-41918

A vulnerability allows unauthorized access to functionality inadequately constrained by ACLs. Attackers may exploit this to unauthenticated execute commands potentially leading to unauthorized data manipulation, access to privileged functions, or even the execution of arbitrary code...

CVE-2023-41918

CVE-2023-41918 is linked to Kiloview P1/P2 devices. Multiple connected sources describe unauthenticated access to functionality inadequately constrained by ACLs, potentially enabling unauthenticated command execution, data manipulation, or access to privileged functions. Some documents allege bro...

Cisco NX-OS Command Injection Vulnerability

Cisco NX-OS contains a command injection vulnerability in the command line interface CLI that could allow an authenticated, local attacker to execute commands as root on the underlying operating system of an affected device...