CVE-2024-40583

Pentaminds CuroVMS v2.0.1 was discovered to contain exposed credentials...

The vulnerability of microprogramming software in embedded network control controllers of ASPECT Enterprise, NEXUS Series, MATRIX Series, arises from the use of files and directories accessible to external parties, allowing attackers to gain access to protected information.

The vulnerability of microprogramming software in embedded network control devices of ASPECT Enterprise, NEXUS Series, and MATRIX Series is related to the use of files and directories accessible to external parties. Exploiting this vulnerability can allow an attacker operating remotely to gain...

The vulnerability of the software used for creating, monitoring, and orchestrating data processing scripts in Apache Airflow lies in the fact that it exposes information in debugging messages, allowing attackers to gain unauthorized access to protected information.

The vulnerability of the software used for creating, monitoring, and orchestrating data processing scripts in Apache Airflow lies in the exposure of information in debugging messages. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected...

CVE-2024-40582

Pentaminds CuroVMS v2.0.1 is affected by CVE-2024-40582, with exposed sensitive information (credentials in particular) leading to potential confidentiality impact. The Red Hat advisories also describe the same affected release as exposing credentials (CVE-2024-40583). The sources do not provide ...

Pentaminds CuroVMS 安全漏洞

Pentaminds CuroVMS is an intelligent visitor management system from Pentaminds. A security vulnerability exists in Pentaminds CuroVMS version 2.0.1 that stems from the inclusion of exposed credentials...

CVE-2024-40582

Pentaminds CuroVMS v2.0.1 was discovered to contain exposed sensitive information...

CVE-2024-40582

Pentaminds CuroVMS v2.0.1 was discovered to contain exposed sensitive information...

PT-2024-28929

Name of the Vulnerable Software and Affected Versions Pentaminds CuroVMS version 2.0.1 Description The issue is related to exposed credentials in the software. This means that sensitive information, such as passwords or other authentication data, is not properly secured and can be accessed by...

CVE-2024-40583

Pentaminds CuroVMS v2.0.1 was discovered to contain exposed credentials...

GHSA-VRJR-P3XP-XX2X phpMyFAQ Generates an Error Message Containing Sensitive Information if database server is not available

Summary Exposure of database ie postgreSQL server's credential when connection to DB fails. Details Exposed database credentials upon misconfig/DoS @ permalink: https://github.com/thorsten/phpMyFAQ/blob/main/phpmyfaq/src/phpMyFAQ/Setup/Installer.phpL694 PoC When postgreSQL server is unreachable, ...

PT-2024-30386 · WordPress · Sweet Date

Name of the Vulnerable Software and Affected Versions: Sweet Date versions 3.7.3 and earlier Description: The issue is related to a Missing Authorization vulnerability in the Sweet Date WordPress theme, which could expose thousands of sites to potential takeovers. This vulnerability may allow...

CVE-2024-53702

Use of cryptographically weak pseudo-random number generator PRNG vulnerability in the SonicWall SMA100 SSLVPN backup code generator that, in certain cases, can be predicted by an attacker, potentially exposing the generated secret...

CVE-2024-48846

Cross Site Request Forgery vulnerabilities where found providing a potiential for exposing sensitive information or changing system settings. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02...

PT-2024-9197 · Abb · Abb Nexus Series +2

Name of the Vulnerable Software and Affected Versions: ABB ASPECT Enterprise version 3.08.02 ABB NEXUS Series version 3.08.02 ABB MATRIX Series version 3.08.02 Description: The issue is related to the use of files and directories that are accessible to external parties, potentially allowing a...

GHSA-FWFX-RRV8-CRPF op_panic in the base runtime can force a panic in the runtime's containing thread

Affected versions use denocore releases that expose Deno.core.ops.oppanic to the JS runtime in the base core This function when called triggers a manual panic in the thread containing the runtime. It can be fixed by stubbing out the exposed op: javascript Deno.core.ops.oppanic = msg = throw new...

CVE-2024-42457

A vulnerability in Veeam Backup & Replication allows users with certain operator roles to expose saved credentials by leveraging a combination of methods in a remote management interface. This can be achieved using a session object that allows for credential enumeration and exploitation, leading ...

A week in security (November 25 – December 1)

Last week on Malwarebytes Labs: Printer problems? Beware the bogus help Data broker exposes 600,000 sensitive files including background checks Medical testing company LifeLabs failed to protect customer data, report finds Explained: the Microsoft connected experiences controversy Spotify, Audibl...

MAL-2024-11104 Malicious code in ssc-ui-static (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 10775484e313af2e57ee7c28ebce842529ccf7c54b60d5deec9443f2d77324f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-6538

A flaw was found in OpenShift Console. A Server Side Request Forgery SSRF attack can happen if an attacker supplies all or part of a URL to the server to query. The server is considered to be in a privileged network position and can often reach exposed services that aren't readily available to...

CVE-2024-6538 Openshift-console: openshift console: server-side request forgery

A flaw was found in OpenShift Console. A Server Side Request Forgery SSRF attack can happen if an attacker supplies all or part of a URL to the server to query. The server is considered to be in a privileged network position and can often reach exposed services that aren't readily available to...