CVE-2023-44294

CVE-2023-44294 affects Dell Secure Connect Gateway Application/Appliance (v5.10.00.00–v5.18.00.00). Root cause: SQL injection in the Collection Rest API filters that can be exploited by a user with a valid session to disclose data from the product database. Impact and context align with MEDIUM se...

CVE-2024-24699

Business logic error in some Zoom clients may allow an authenticated user to conduct information disclosure via network access...

CVE-2024-21377

Technical details for CVE-2024-21377 are not available in the provided documents. The entries reference the CVE but do not specify affected products, root cause, impact, or fixes. Monitor for official disclosures and published remediation guidance.

Attacks, Vulnerabilities and Actors 5 to 11 February 2024

For a detailed threat digest, download the pdf file here Summary HiveForce Labs recently made several significant discoveries in the realm of cybersecurity threats. In the past week alone, a total of five attacks were executed, six vulnerabilities were uncovered, and two active adversaries were...

PT-2024-1864 · Microsoft · Dynamics 365

Name of the Vulnerable Software and Affected Versions: Microsoft Dynamics 365 on-premises affected versions not specified Description: The issue is related to a lack of protection for the web page structure in Microsoft Dynamics 365, allowing for cross-site scripting attacks. An attacker could...

PT-2024-2023 · Microsoft · Wdac Ole Db Provider For Sql Server +1

Name of the Vulnerable Software and Affected Versions: Microsoft WDAC OLE DB provider for SQL Server affected versions not specified Description: The issue is related to a buffer overflow in dynamic memory, which can be exploited by a remote attacker to execute arbitrary code. This can affect the...

CVE-2024-1454 Opensc: memory use after free in authentic driver when updating token info

The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An attacker must have physical access to the computer system and requires a crafted USB device or...

CVE-2022-22506 IBM Robotic Process Automation information disclosure

IBM Robotic Process Automation 21.0.2 contains a vulnerability that could allow user ids may be exposed across tenants. IBM X-Force ID: 227293...

Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in VMware Tanzu Spring Framework [CVE-2023-20861, CVE-2023-20860]

Summary Multiple vulnerabilities in VMware Tanzu Spring Framework used by InfoSphere Information Server were addressed. CVE-2023-20861, CVE-2023-20860 Vulnerability Details CVEID:CVE-2023-20861 DESCRIPTION: VMware Tanzu Spring Framework is vulnerable to a denial of service. By sending a specially...

GHSA-3HWC-RQWP-V36Q Apache Solr can leak certain passwords due to System Property redaction logic inconsistencies

Insufficiently Protected Credentials vulnerability in Apache Solr. This issue affects Apache Solr from 6.0.0 through 8.11.2, from 9.0.0 before 9.3.0. One of the two endpoints that publishes the Solr process' Java system properties, /admin/info/properties, was only setup to hide system properties...

DEBIAN-CVE-2023-50291

Insufficiently Protected Credentials vulnerability in Apache Solr. This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.3.0. One of the two endpoints that publishes the Solr process' Java system properties, /admin/info/properties, was only setup to hide system properties...

CVE-2023-50291

Insufficiently Protected Credentials vulnerability in Apache Solr. This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.3.0. One of the two endpoints that publishes the Solr process' Java system properties, /admin/info/properties, was only setup to hide system properties...

Minimal Coming Soon – Coming Soon Page < 2.38 - Unauthenticated Maintenance Mode Bypass

Description The Minimal Coming Soon – Coming Soon Page plugin for WordPress is vulnerable to maintenance mode bypass and information disclosure in all versions up to, and including, 2.37. This is due to the plugin improperly validating the request path. This makes it possible for unauthenticated...

PT-2024-13270 · Microsoft +1 · Outlook +1

Name of the Vulnerable Software and Affected Versions: Sametime affected versions not specified Description: The issue is related to a lack of clickjacking protection in the Outlook add-in. The application does not implement appropriate protections to safeguard users against clickjacking attacks...

CVE-2024-24885

creationtimestamp| type| source ---|---|--- 2024-02-08 13:22:06+00:00| seen| https://t.me/ctinow/181362...

PT-2024-1632 · Apache · Apache Solr

Name of the Vulnerable Software and Affected Versions: Apache Solr versions 6.0.0 through 8.11.2 Apache Solr versions 9.0.0 through 9.2.x Description: The issue is related to insufficient protection of credentials in Apache Solr. One of the endpoints, "/admin/info/properties", was only set up to...

SUSE CVE-2024-24857

A race condition was found in the Linux kernel's net/bluetooth device driver in conninfomin,maxageset function. This can result in integrity overflow issue, possibly leading to bluetooth connection abnormality or denial of service...

PT-2024-40844 · Git +1 · Cras

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-double-free crash. Technical details include a crash state with functions such as handle at command and handle at command...

PT-2024-13092 · Qualcomm · Snapdragon +117

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue involves memory corruption in video while parsing the Videoinfo, which occurs when the size of an atom is greater than the videoinfo size. The...

PT-2024-12387 · Qualcomm · Snapdragon +42

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to a Transient Denial of Service DOS in the Core when a DDR memory check is called while the DDR is not initialized. This suggests ...