CVE-2025-24977 OpenCTI has remote code execution and sensitive secrets exposed through web hook

OpenCTI is an open cyber threat intelligence CTI platform. Prior to version 6.4.11 any user with the capability manage customizations can execute commands on the underlying infrastructure where OpenCTI is hosted and can access internal server side secrets by misusing the web-hooks. Since the...

infrastructure 访问控制错误漏洞

infrastructure is an open source library from conda-forge. An access control error vulnerability exists in infrastructure versions 2025-02-10 through 2025-04-01, which stems from the use of an incorrect Azure cf-staging access token, which could lead to bypassing the upload process...

The vulnerability of the Infrastructure component of the Oracle Banking Liquidity Management management platform allows a hacker to gain unauthorized access to read, create, modify, and delete data, or to cause a service failure.

The vulnerability of Oracle Banking Liquidity Management’s infrastructure component relates to improper cleaning or release of resources. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to read, create, modify, and delete data, or cause...

CVE-2024-5407

A vulnerability in RhinOS 3.0-1190 could allow PHP code injection through the "search" parameter in /portal/search.htm. This vulnerability could allow a remote attacker to perform a reverse shell on the remote system, compromising the entire infrastructure...

PT-2024-1170 · Oracle · Oracle Financial Services Analytical Applications Infrastructure

Name of the Vulnerable Software and Affected Versions: Oracle Financial Services Analytical Applications Infrastructure versions 8.0.7 through 8.1.2 Description: The issue is related to insufficient input validation in the Infrastructure component of Oracle Financial Services Analytical...

The vulnerability of the Infrastructure component of the Oracle FLEXCUBE Universal Banking system allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Infrastructure component of the Oracle FLEXCUBE Universal Banking system is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected...

Qualys Is the Outperformer in the New GigaOm Radar Report for Continuous Vulnerability Management

GigaOm has unveiled its third-annual Radar for Continuous Vulnerability Management featuring Qualys. In this Report, GigaOm provides a detailed analysis of the value and progression of vulnerability management VM capabilities to help organizations build the best security and vulnerability...

Oracle Coherence Unauthorized Access (Oct 2022 CPU)

The 12.2.1.4.0 and 14.1.1.0.0 versions of Coherence installed on the remote host are affected by an unauthorized access vulnerability as referenced in the Oct 2022 CPU advisory. This easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle...

CVE-2022-21591

Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain component: UI Infrastructure. Supported versions that are affected are 6.4.3 and 6.5.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2022-39403

Removed by vendor...

The vulnerability of the Infrastructure component of the Oracle Banking Trade Finance software allows a perpetrator to gain read access to data and modify it.

The vulnerability of the Infrastructure component of the Oracle Banking Trade Finance software exists due to insufficient validation of input data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain access to read, modify, add, or delete data using the HTTP protoco...

The vulnerability of the Infrastructure component of the Oracle Banking Trade Finance software allows a perpetrator to gain unauthorized access to read, modify, or add data, or to cause a service failure.

The vulnerability of the Infrastructure component of the Oracle Banking Trade Finance software exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to read, modify, or add data, or cause a service...

The vulnerability of the Infrastructure sub-component of the Oracle FLEXCUBE Universal Banking banking analytics system’s simulation model, allowing a perpetrator to gain access to read, modify, add, or delete data.

The vulnerability of the Infrastructure sub-component of the Oracle FLEXCUBE Universal Banking banking analytics system’s simulation model exists due to insufficient validation of input data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain access to read, modify...

The vulnerability of the Infrastructure component of the Oracle FLEXCUBE Universal Banking system allows a perpetrator to gain access to data reading or cause a partial service disruption.

The vulnerability of the Infrastructure component of the Oracle FLEXCUBE Universal Banking system exists due to insufficient verification of input data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain read access to data or cause partial service interruption...

The vulnerability of the Infrastructure component of the Oracle Banking Trade Finance software allows a perpetrator to create, delete, or alter access to critical data, gain read-only access to data, or cause partial service disruption.

The vulnerability of Oracle Banking Trade Finance’s Infrastructure component is related to errors in the code. Exploiting this vulnerability allows a malicious actor to create, delete, or alter access to critical data, gain read-only access to data, or cause partial service interruptions through...

The vulnerability of the Infrastructure component of the Oracle Banking Treasury Management software allows a perpetrator to gain access to protected information, modify file access rights, or cause partial service interruption.

The vulnerability of the Infrastructure component of the Oracle Banking Treasury Management software exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to protected information, modify file access rights, or...

Users Clueless About Cybersecurity Risks: Study

Organizations are facing yet another unprecedented threat to their cybersecurity now that employees are headed back into offices with their personal devices, lax security hygiene and no clue about some of the most catastrophic attacks in history, such as the Colonial Pipeline shutdown. A new surv...

CISA Addresses the Rise in Ransomware Targeting Operational Technology Assets

CISA has published the Rising Ransomware Threat to OT Assets fact sheet in response to the recent increase in ransomware attacks targeting operational technology OT assets and control systems. The guidance: provides steps to prepare for, mitigate against, and respond to attacks; details how the...

CVE-2021-2086

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromis...

The vulnerability of the Infrastructure component of Oracle Financial Services Analytical Applications Infrastructure allows a perpetrator to gain access to modify, add, or delete data, or to unauthorizedly access protected information.

The vulnerability of Oracle Financial Services Analytical Applications Infrastructure’s component is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow an attacker operating remotely to modify, add, or delete data, or to gain...