11261 matches found
PT-2024-6371 · Mindsdb +1 · Mindsdb +1
Name of the Vulnerable Software and Affected Versions: MindsDB versions 23.10.3.0 through 24.7.4.1 Description: An arbitrary code execution issue exists when the Weaviate integration is installed on the server. If a specially crafted SELECT WHERE clause containing Python code is run against a...
The vulnerability of the Git-based software platform for collaborative code development on GitLab allows a hacker to replace the code in imported CI/CD pipelines.
The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to replace the code in imported CI/CD pipelines...
PT-2024-6369 · Mindsdb +1 · Mindsdb +1
Name of the Vulnerable Software and Affected Versions: MindsDB versions 23.12.4.0 through 24.7.4.1 Description: An arbitrary code execution issue exists when the ChromaDB integration is installed on the server. If a specially crafted INSERT query containing Python code is run against a database...
PT-2024-6368
Name of the Vulnerable Software and Affected Versions MindsDB versions 23.11.4.2 through 24.7.4.1 Description An arbitrary code execution issue exists when one of several integrations is installed on the server. If a specially crafted UPDATE query containing Python code is run against a database...
NetScaler - How to Integrate NetScaler and Exchange Server when Content Switch is Involved.
How to Integrate NetScaler and Exchange Server when Content Switch is Involved...
Multiple Alps System Integration products and the OEM products vulnerable to cross-site request forgery
Overview Multiple Alps System Integration products and the OEM products contain a cross-site request forgery vulnerability CWE-352. Yoshiaki komeyama of KOBELCO SYSTEMS CORPORATION reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warnin...
IBM webMethods Integration Elevation of Privilege Vulnerability
IBM webMethods Integration is a hybrid enterprise iPaaS from International Business Machines IBM. An elevation of privilege vulnerability exists in IBM webMethods Integration version 10.15, which can be exploited by an authenticated attacker to create scheduler tasks that elevate their privileges...
IBM webMethods Integration Path Traversal Vulnerability
IBM webMethods Integration is a hybrid enterprise iPaaS from International Business Machines IBM. A path traversal vulnerability exists in IBM webMethods Integration version 10.15, which can be exploited by an attacker to send a specially crafted URL request containing the sequence "dot dot" /...
IBM webMethods Integration File Upload Vulnerability
IBM webMethods Integration is a hybrid enterprise iPaaS from International Business Machines IBM. A file upload vulnerability exists in IBM webMethods Integration version 10.15, which can be exploited by an authenticated attacker to upload and execute arbitrary files that can be executed on the...
PT-2024-31666 · Intersafe +1 · Intersafe Webfilter +1
Name of the Vulnerable Software and Affected Versions: Alps System Integration products affected versions not specified InterSafe WebFilter affected versions not specified Description: A cross-site request forgery CSRF issue allows a remote unauthenticated attacker to hijack the authentication of...
JVN#05579230: Multiple Alps System Integration products and the OEM products vulnerable to cross-site request forgery
Multiple Alps System Integration products and the OEM products contain a cross-site request forgery vulnerability CWE-352. Impact If a user views a malicious page while logged in, unintended operations may be performed. Solution Update the software or apply the workaround Update the software to t...
SUSE-SU-2024:3151-1 Security update for buildah
This update for buildah fixes the following issues: Update to version 1.35.4: Bump to Buildah v1.35.4 CVE-2024-3727 updates bsc1224117 integration test: handle new labels in 'bud and test --unsetlabel' Bump go-jose CVE-2024-28180 Bump ocicrypt and go-jose CVE-2024-28180 Update to version 1.35.3:...
Exploit for Cross-site Scripting in Goanother Another_Redis_Desktop_Manager
Another Redis Desktop Manager PoC A Proof-Of-Concept for CVE-2...
Kibana 8.15.1 Security Update (ESA-2024-27, ESA-2024-28)
Kibana arbitrary code execution via YAML deserialization in Amazon Bedrock Connector ESA-2024-27 A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. This issue only affects users that use Elastic...
Wordfence Intelligence Weekly WordPress Vulnerability Report (August 26, 2024 to September 1, 2024)
Did you know Wordfence runs a Bug Bounty Program for all WordPress plugin and themes at no cost to vendors? Through October 7th, 2024, XSS vulnerabilities in all plugins and themes with =1,000 Active Installs are in scope for all researchers. In addition, through October 14th, 2024, researchers c...
Security Bulletin: IBM Integration Bus for z/OS is vulnerable to a denial of service due to Apache Tomcat (CVE-2024-34750)
Summary IBM Integration Bus for z/OS is vulnerable to a denial of service due to Apache Tomcat CVE-2024-34750. This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details CVEID:CVE-2024-34750 DESCRIPTION: Apache Tomcat is vulnerable to a denial of service, cause...
PT-2024-5984 · Elastic · Kibana
Name of the Vulnerable Software and Affected Versions: Kibana affected versions not specified Description: A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. A successful attack requires a malicious us...
CVE-2024-45076
IBM webMethods Integration 10.15 could allow an authenticated user to upload and execute arbitrary files which could be executed on the underlying operating system...
CVE-2024-45074
IBM webMethods Integration 10.15 could allow an authenticated user to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system...
