CVE-2024-11401 Rapid7 Insight Platform Privilege Escalation Vulnerability

Rapid7 Insight Platform versions prior to November 13th 2024, suffer from a privilege escalation vulnerability whereby, due to a lack of authorization checks, an attacker can successfully update the password policy in the platform settings as a standard user by crafting an API the functionality w...

Rapid7 Insight Platform 安全漏洞

Rapid7 Insight Platform is a platform for managing profiles, users, products, API keys and settings from Rapid7 USA. Rapid7 Insight Platform has a security vulnerability that stems from a lack of authorization checks. An attacker can exploit the vulnerability to elevate privileges...

MyBB <= 1.8.38 XSS Vulnerability

MyBB is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mybb:mybb";...

The vulnerability of the Desigo Insight building management software lies in the improper restriction on the visible layers of the user interface. This allows a hacker to redirect users to any desired website.

The vulnerability of the Desigo Insight building management software is related to an improper limitation on the visible layers of the user interface. Exploiting this vulnerability could allow a malicious actor to redirect users to any desired website...

The vulnerability of the processAtatchmentDataStream method implementation in the software for remote monitoring, management, and support of servers and data storage systems, HPE Insight Remote Support, allows a attacker to execute arbitrary code.

The vulnerability of the processAtatchmentDataStream method implementation in the software for remote monitoring, management, and support of servers and data storage systems in HPE Insight Remote Support relates to the use of files and directories accessible to external parties. Exploiting this...

Hewlett Packard Enterprise Insight Remote Support processAtatchmentDataStream Directory Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hewlett Packard Enterprise Insight Remote Support. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the processAtatchmentDataStream...

Hewlett Packard Enterprise Insight Remote Support getDocumentRootElement XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Hewlett Packard Enterprise Insight Remote Support. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the getDocumentRootEleme...

Hewlett Packard Enterprise Insight Remote Support DESTA Service Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hewlett Packard Enterprise Insight Remote Support. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DESTA service, which listens on TCP port 7901 by...

Hewlett Packard Enterprise Insight Remote Support setInputStream XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Hewlett Packard Enterprise Insight Remote Support. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the setInputStream metho...

openSUSE Security Advisory (SUSE-SU-2024:4086-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-53676

CVE-2024-53676 is a directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support that may allow remote code execution. Multiple connected sources (including Red Hat and PT-Security) corroborate a flaw in handling attachments/streams, related to a method akin to processAt...

CVE-2024-53674

An XML external entity injection XXE vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases...

CVE-2024-53674

An XML external entity injection XXE vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases...

CVE-2024-53675

An XML external entity injection XXE vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases...

CVE-2024-53673

A java deserialization vulnerability in HPE Remote Insight Support may allow an unauthenticated attacker to execute code...

CVE-2024-53673

A java deserialization vulnerability in HPE Remote Insight Support may allow an unauthenticated attacker to execute code...

CVE-2024-11622

An XML external entity injection XXE vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases...

CVE-2024-11622

An XML external entity injection XXE vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases...

CVE-2024-53675

An XML external entity injection XXE vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases...

CVE-2024-53675

CVE-2024-53675 concerns an XML External Entity (XXE) vulnerability in HPE Insight Remote Support . The connected documents consistently describe XXE as the underlying issue and indicate that remote users may disclose information in certain cases. Public details provided include the vulnerability ...