PT-2024-32382 · Unknown · Computer Vision Annotation Tool

Name of the Vulnerable Software and Affected Versions: Computer Vision Annotation Tool CVAT versions prior to 2.19.0 Description: The issue allows an attacker to initiate API calls on behalf of a logged-in user if they can trick the user into visiting a maliciously-constructed URL. This gives the...

CVE-2024-34542

Advantech ADAM-5630 shares user credentials plain text between the device and the user source device during the login process...

CVE-2024-47169 Agnai vulnerable to Remote Code Execution via JS Upload using Directory Traversal

Agnai is an artificial-intelligence-agnostic multi-user, mult-bot roleplaying chat system. A vulnerability in versions prior to 1.0.330 permits attackers to upload arbitrary files to attacker-chosen locations on the server, including JavaScript, enabling the execution of commands within those...

Security Bulletin: IBM Cognos Analytics Reports mobile client application (iOS) is vulnerable to unauthorized attacks due to an exposed API key (CVE-2024-40703)

Summary An exposed API key in IBM Cognos Analytics could allow an unauthorized attacker to send unsolicited push notification alerts to IBM Cognos Analytics Reports mobile client applications. IBM Cognos Analytics has addressed the applicable CVE by revoking the exposed API key. Revocation of thi...

Gitlab -- vulnerabilities

Gitlab reports: Maintainer can leak Dependency Proxy password by changing Dependency Proxy URL via crafted POST request AI feature reads unsanitized content, allowing for attacker to hide prompt injection Project reference can be exposed in system notes...

PT-2024-32073 · Icecms · Icecms

Name of the Vulnerable Software and Affected Versions: IceCMS versions 3.4.7 and earlier Description: An access control issue in the CheckVip function in UserController.java of IceCMS allows unauthenticated attackers to access and return all user information, including passwords. Recommendations:...

CVE-2024-8883

A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially...

Red Hat Keycloak 输入验证错误漏洞

Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. An input validation error vulnerability exists in Red Hat Keycloak versions prior to 25.0.6, which stems from a configuration error that allows...

Server Misconfiguration at Fuel Industry Software Provider Exposes SSNs, PII Data

A server misconfiguration exposed a trove of documents belonging to FleetPanda, a leading petroleum and fuel industry software…...

PTZOptics PT30X-SDI/NDI-xx 安全漏洞

PTZOptics PT30X-SDI/NDI-xx is a series of HD cameras from PTZOptics. A security vulnerability exists in PTZOptics PT30X-SDI/NDI-xx versions prior to 6.3.40 that stems from insufficient authentication. An attacker exploiting this vulnerability could disclose sensitive data such as usernames,...

mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener callbacks ran

The Mozilla Foundation's Security Advisory: Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events. Web content that tried to use those interfaces would not be able to use them with elevated privileges, but their presence...

mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener callbacks ran

The Mozilla Foundation's Security Advisory: Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events. Web content that tried to use those interfaces would not be able to use them with elevated privileges, but their presence...

MAL-2024-8860 Malicious code in color-print12345 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 73a80777a026505265f48975425e0d198263c4cce7bae5200201d7a10c7b329d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-37232

Loftware Spectrum through 4.6 exposes Sensitive Information Logs to an Unauthorized Actor...

USN-6841-2 php7.0, php7.2 vulnerability

USN-6841-1 fixed a vulnerability in PHP. This update provides the corresponding updates for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. Original advisory details: It was discovered that PHP could early return in the filtervar function resulting in invalid user information being treated as valid user...

urllib3: proxy-authorization request header is not stripped during cross-origin redirects

A flaw was found in urllib3, an HTTP client library for Python. In certain configurations, urllib3 does not treat the Proxy-Authorization HTTP header as one carrying authentication material. This issue results in not stripping the header on cross-origin redirects...

WordPress plugin PixelYourSite–Your smart PIXEL (TAG) & API Manager 授权问题漏洞

WordPress and the WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

MAL-2024-8602 Malicious code in @diotoborg/rem-minima (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9ac8c3c0c15b0999b73c7815d6ba515d2d37f450180559445f1aaa418dfcb404 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8133 Malicious code in @diotoborg/aperiam-cum (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eb4500021bc56d1007188a6c5a34135cef19214d511bdba545eac3a7fcae98ef Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8587 Malicious code in @diotoborg/ratione-animi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 99fbce442b156c6ca8741c6adc28f303a48f96a03c4ed901e5665e96c520f9d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...