CVE-2023-22593

IBM Robotic Process Automation for Cloud Pak is affected by a Redis container misconfiguration that may grant elevated privileges. Affected versions are 21.0.1–21.0.7.3 and 23.0.0–23.0.3. The issue stems from security misconfiguration in the Redis container, with potential for elevated privileges...

CVE-2023-22593 IBM Robotic Process Automation for Cloud Pak security configuration

IBM Robotic Process Automation for Cloud Pak 21.0.1 through 21.0.7.3 and 23.0.0 through 23.0.3 is vulnerable to security misconfiguration of the Redis container which may provide elevated privileges. IBM X-Force ID: 244074...

CVE-2023-22593 IBM Robotic Process Automation for Cloud Pak security configuration

IBM Robotic Process Automation for Cloud Pak 21.0.1 through 21.0.7.3 and 23.0.0 through 23.0.3 is vulnerable to security misconfiguration of the Redis container which may provide elevated privileges. IBM X-Force ID: 244074...

CVE-2023-34098 Dependency configuration exposed in Shopware

Shopware is an open source e-commerce software. Due to an incorrect configuration in the .htaccess file, the configuration file of the Javascript could be read in production environments themes/package-lock.json. With this information, the specific Shopware version in a deployment might be...

PT-2023-24670 · Shopware · Shopware

Name of the Vulnerable Software and Affected Versions: Shopware versions prior to 5.7.18 Description: The issue arises from an incorrect configuration in the .htaccess file, allowing the configuration file of Javascript dependencies to be read in production environments, specifically the...

IBM Robotic Process Automation 安全漏洞

IBM Robotic Process Automation is a robotic process automation product from International Business Machines IBM. can help you automate more business and IT processes at scale with the ease and speed of traditional RPA. A security vulnerability exists in IBM Robotic Process Automation for Cloud Pa...

PT-2023-5442 · Ibm · Ibm Robotic Process Automation For Cloud Pak

Name of the Vulnerable Software and Affected Versions: IBM Robotic Process Automation for Cloud Pak versions 21.0.1 through 21.0.7.3 IBM Robotic Process Automation for Cloud Pak versions 23.0.0 through 23.0.3 Description: The issue is related to security misconfiguration of the Redis container,...

Shopware 信息泄露漏洞

Shopware is a set of open source e-commerce software from the German company Shopware. An information disclosure vulnerability exists in Shopware versions prior to 5.7.18, which stems from an incorrect configuration in the htaccess file, which can read the Javascript configuration file...

IBM Robotic Process Automation 安全漏洞

IBM Robotic Process Automation is a robotic process automation product from International Business Machines IBM. helps you automate more business and IT processes at scale with the ease and speed of traditional RPA. A security vulnerability exists in IBM Robotic Process Automation that stems from...

Security Bulletin: IBM Robotic Process Automation for Cloud Pak is vulnerable to security misconfiguration which may result in elevated privileges (CVE-2023-22593).

Summary IBM Robotic Process Automation for Cloud Pak is vulnerable to security misconfiguration of the Redis container which may provide elevated privileges CVE-2023-22593. This bulletin identifies the security fixes to apply to address this vulnerability. Vulnerability Details CVEID:CVE-2023-225...

ISC BIND 安全漏洞

ISC BIND is a suite of open source software that implements the DNS protocol from the US company ISC. A security vulnerability exists in ISC BIND 9 that stems from improperly restricted cache configuration, which can be exploited by an attacker to cause a denial of service condition...

WordPress Upload Resume Plugin <= 1.2.0 is vulnerable to Bypass Vulnerability

Software Upload Resume Type Plugin Vulnerable versions = 1.2.0 Fixed in N/A OWASP Top 10 A6: Security Misconfiguration Classification Bypass Vulnerability CVE CVE-2023-2751 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 2d3996abc94c Credits Yakshita Sharma Required...

URLs have always been a great hiding place for threat actors

Welcome to this weeks edition of the Threat Source newsletter. Talos recent blog post on the dangers posed by the newly released ".zip" top-level domain TLD recently outlined how threat actors could create real URLs that look like file names and trick users into clicking on their links. .Zip and...

CXF: directory listing / code exfiltration

A vulnerability was found in Apache CXF that could allow an attacker to perform a remote directory listing or code exfiltration. This issue only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to ...

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin <= 1.5.66 is vulnerable to Bypass Vulnerability

Software Unlimited Elements For Elementor Free Widgets, Addons, Templates Type Plugin Vulnerable versions = 1.5.66 Fixed in 1.5.67 OWASP Top 10 A6: Security Misconfiguration Classification Bypass Vulnerability CVE CVE-2023-33930 Patch priority Low CVSS severity Low 9.1 Developer Unlimited Element...

WordPress Zephyr Project Manager Plugin <= 3.3.93 is vulnerable to Cross Site Request Forgery (CSRF)

Software Zephyr Project Manager Type Plugin Vulnerable versions = 3.3.93 Fixed in 3.3.94 OWASP Top 10 A6: Security Misconfiguration Classification Cross Site Request Forgery CSRF CVE CVE-2023-34373 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 598837ada134 Credits...

SAP NetWeaver 跨站脚本漏洞

SAP NetWeaver is a set of service-oriented integrated application platform from SAP, which provides a development environment for SAP applications. The platform provides a development and runtime environment for SAP applications, and ABAP is an application server that runs in NetWeaver and is bas...

GO-2023-1792 Insecure wildcard CORS policy in github.com/rs/cors

The CORS handler actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompatible with the CORS security design, and could lead to CORS misconfiguration security problems...

WordPress Uncanny Toolkit for LearnDash Plugin <= 3.6.4.3 is vulnerable to Open Redirection

Software Uncanny Toolkit for LearnDash Type Plugin Vulnerable versions = 3.6.4.3 Fixed in 3.6.4.4 OWASP Top 10 A6: Security Misconfiguration Classification Open Redirection CVE CVE-2023-34020 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID 28ec371a8b3f Credits Mika Require...

PUB-A-216854451

In multiple functions of PasspointXmlUtils.java, there is a possible authentication misconfiguration due to a logic error in the code. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...