CVE-2024-21073

CVE-2024-21073 affects Oracle E-Business Suite Oracle Trade Management, component Claim LOV. The issue arises from insufficient input validation in Claim LOV, allowing unauthenticated remote attacker over HTTP to access or compromise Oracle Trade Management, with impact on data confidentiality (p...

CVE-2024-21072

CVE-2024-21072 affects Oracle E-Business Suite Installed Base, Data Provider UI (versions 12.2.3–12.2.13). An unauthenticated attacker with network access via HTTP can compromise Oracle Installed Base; attacks require human interaction and may lead to unauthorized update/insert/delete and read ac...

CVE-2024-21061

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Audit Plug-in. Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQ...

CVE-2024-21056

CVE-2024-21056 affects Oracle MySQL Server (Server: DML); supported versions 8.0.34 and prior are impacted. The vulnerability allows a high-privileged attacker with network access via multiple protocols to cause a hang or frequent, complete denial of service of MySQL Server. CVSS 3.1 base score 4...

CVE-2024-21051

Removed by vendor...

CVE-2024-21052

Removed by vendor...

CVE-2024-21042

The CVE-2024-21042 flaw affects Oracle E-Business Suite, specifically the Complex Maintenance, Repair, and Overhaul (LOV component). Affected versions are 12.2.3 through 12.2.13. The issue allows an unauthenticated attacker with network access over HTTP to compromise the LOV component, with attac...

CVE-2024-21006

CVE-2024-21006 affects Oracle WebLogic Server (Core) in 12.2.1.4.0 and 14.1.1.0.0. The connected PoC demonstrates unauthenticated remote code execution via IIOP/JNDI (T3/IIOP access) leading to arbitrary code execution and data compromise. Oracle’s April 2024 CPU provides fixes (update to version...

CVE-2024-21005

CVE-2024-21005 affects Oracle Java SE / GraalVM Enterprise Edition (JavaFX). Affected: Oracle Java SE 8u401; GraalVM EE 20.3.13 and 21.3.9. Description notes a difficult-to-exploit vulnerability that requires network access via multiple protocols and user interaction, with potential unauthorized ...

CVE-2024-21002

CVE-2024-21002 affects Oracle Java SE (JavaFX) and Oracle GraalVM Enterprise Edition. Affected: Oracle Java SE 8u401; Oracle GraalVM Enterprise Edition 20.3.13 and 21.3.9. Exploitation requires user interaction; an unauthenticated attacker with login could indirectly impact data via updates/inser...

CVE-2024-20993

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL...

CVE-2024-20954

CVE-2024-20954 affects Oracle GraalVM for JDK (versions 17.0.10, 21.0.2, 22) and Oracle GraalVM Enterprise Edition (20.3.13, 21.3.9) with the Compiler component. It allows an unauthenticated attacker with network access to read data from affected GraalVM instances. Exploitation requires network a...

CVE-2024-1646

parisneo/lollms-webui is vulnerable to authentication bypass due to insufficient protection over sensitive endpoints. The application checks if the host parameter is not '0.0.0.0' to restrict access, which is inadequate when the application is bound to a specific interface, allowing unauthorized...

CVE-2024-2029 Command Injection in mudler/localai

A command injection vulnerability exists in the TranscriptEndpoint of mudler/localai, specifically within the audioToWav function used for converting audio files to WAV format for transcription. The vulnerability arises due to the lack of sanitization of user-supplied filenames before passing the...

Security Bulletin: There are multiple vulnerabilities in the IBM SDK, Java Technology Edition that is shipped with IBM TXSeries for Multiplatforms (CVE-2023-22081, CVE-2023-22067, CVE-2023-5676, CVE-2023-22045 and CVE-2023-22049).

Summary There are multiple vulnerabilities in the IBM SDK, Java Technology Edition that is shipped with IBM TXSeries for Multiplatforms CVE-2023-22081, CVE-2023-22067, CVE-2023-5676, CVE-2023-22045 and CVE-2023-22049. An update to IBM TXSeries for Multiplatforms has been released to address these...

LayerSlider WordPress Plugin Flaw Impacts Over 1 Million Sites

...

KLA65243 PE vulnerability in Microsoft Apps

An elevation of privilege vulnerability was found in Microsoft Apps. Malicious users can exploit this vulnerability to gain privileges. Original advisories CVE-2024-28916 Exploitation Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details. Related...

De-risking Your Organization in Spite of NVD Delays

In the face of recent struggles with the National Vulnerability Database NVD, causing delays in analyzing Common Vulnerabilities and Exposures CVEs since February 12, 2024, a significant number of CVEs lacked essential metadata including severity scores and affected product details. Qualys remain...

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to low integrity impacts due to Java SE (CVE-2023-22049)

Summary IBM Sterling Partner Engagement Manager uses Java SE. This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details CVEID:CVE-2023-22049 DESCRIPTION: An unspecified vulnerability in Java SE related to the Libraries component could allow a remote attacker t...

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to low confidentiality impacts due to Java SE (CVE-2023-22044)

Summary IBM Sterling Partner Engagement Manager uses Java SE. This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details CVEID:CVE-2023-22044 DESCRIPTION: An unspecified vulnerability in Java SE related to the VM component could allow a remote attacker to cause...