Dell Update和Dell Alienware Update 安全漏洞

Dell Update and Dell Alienware Update are both an update driver from Dell USA Inc. A security vulnerability exists in Dell Update versions prior to 5.4 and Dell Alienware Update versions prior to 5.4, which arises from the inclusion of an exposed dangerous method or feature vulnerability. An...

PT-2024-5372 · Elastic · Kibana

Name of the Vulnerable Software and Affected Versions: Kibana versions prior to 8.14.2 Kibana versions prior to 7.17.23 Description: A flaw allowing arbitrary code execution was discovered in Kibana. An attacker with access to ML and Alerting connector features, as well as write access to interna...

CVE-2024-40096

The com.cascadialabs.who aka Who - Caller ID, Spam Block application 15.0 for Android places sensitive information in the system log...

CVE-2024-7460

A vulnerability was found in OSWAPP Warehouse Inventory System 1.0/2.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /changepassword.php. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The...

Exploit for Exposed IOCTL with Insufficient Access Control in Dell Dbutil

CVE-2021-21551 Proof of concept exploit for CVE-2021-21551, vu...

The vulnerability of the IBM i operating system, related to the exposure of protected information, allows attackers to enhance their privileges.

The vulnerability of the IBM i operating system is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

PT-2024-37799 · WordPress · Ctt Expresso Para Woocommerce

Name of the Vulnerable Software and Affected Versions: CTT Expresso para WooCommerce plugin for WordPress versions up to and including 3.2.12 Description: The issue concerns the exposure of sensitive information in the CTT Expresso para WooCommerce plugin for WordPress. This exposure occurs via t...

Dell DM5500 安全漏洞

The Dell DM5500 is an integrated solution from Dell, Inc. It provides industry-leading deduplication, data protection solutions and multi-cloud capabilities. A security vulnerability exists in the Dell DM5500 version 5.16.0.0, which stems from the presence of an information disclosure vulnerabili...

CVE-2024-38429

Matrix Tafnit v8 - CWE-552: Files or Directories Accessible to External Parties...

NI VeriStand ProjectServer OpenTool Exposed Dangerous Method Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NI VeriStand. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of service requests in the ProjectServer component. The issue results from...

NI VeriStand IFileTransferServer Exposed Dangerous Method Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of NI VeriStand. Authentication is not required to exploit this vulnerability. The specific flaw exists within the IFileTransferServer component. The issue results from an exposed dangerous...

NI VeriStand ProjectServer Exposed Dangerous Method Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NI VeriStand. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of service requests in the ProjectServer component. The issue results from a...

CVE-2024-6922: Automation Anywhere Automation 360 Server-Side Request Forgery

Automation 360 Robotic Process Automation suite v21-v32 is vulnerable to unauthenticated Server-Side Request Forgery SSRF. SSRF occurs when the server can be induced to perform arbitrary requests on behalf of an attacker. An attacker with unauthenticated access to the Automation 360 Control Room...

Ongoing Cyberattack Targets Exposed Selenium Grid Services for Crypto Mining

Cybersecurity researchers are sounding the alarm over an ongoing campaign that's leveraging internet-exposed Selenium Grid services for illicit cryptocurrency mining. Cloud security firm Wiz is tracking the activity under the name SeleniumGreed. The campaign, which is targeting older versions of...

CVE-2024-41668

The cBioPortal for Cancer Genomics provides visualization, analysis, and download of large-scale cancer genomics data sets. When running a publicly exposed proxy endpoint without authentication, cBioPortal could allow someone to perform a Server Side Request Forgery SSRF attack. Logged in users...

Mexico’s Largest ERP Provider ClickBalance Exposes 769 Million Records

ClickBalance ERP providers cloud database exposed 769 million records, including API keys and email addresses. Learn how this…...

SUSE CVE-2024-40647

sentry-sdk is the official Python SDK for Sentry.io. A bug in Sentry's Python SDK 2.8.0 allows the environment variables to be passed to subprocesses despite the env= setting. In Python's subprocess calls, all environment variables are passed to subprocesses by default. However, if you specifical...

SolarWinds Access Rights Manager ChangeHumster Exposed Dangerous Method Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of SolarWinds Access Rights Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ChangeHumster class. The issue results from an exposed dangerous...

PT-2024-40950 · Deno · Deno

Name of the Vulnerable Software and Affected Versions: Deno affected versions not specified Description: The issue arises from the exposure of Deno.core.ops.op panic to the JS runtime in the base core, which can trigger a manual panic in the thread containing the runtime when called...

SolarWinds Access Rights Manager EndUpdate Exposed Dangerous Method Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Access Rights Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the EndUpdate method. The issue results from an exposed dangerous metho...