Siemens SINEC Security Monitor

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...

CVE-2024-47563: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability has been identified in SINEC Security Monitor All versions V4.9.0. The affected application does not properly validate a file path that is supplied to an endpoint intended to create CSR files. This could allow an unauthenticated remote attacker to create files in writable...

PT-2024-8132

Name of the Vulnerable Software and Affected Versions: Siemens SINEC Security Monitor versions prior to V4.9.0 Description: A vulnerability has been identified in the Siemens SINEC Security Monitor application, where it does not properly neutralize special elements in user input to the...

CVE-2024-47565: Permissive List of Allowed Inputs

A vulnerability has been identified in SINEC Security Monitor All versions V4.9.0. The affected application does not properly validate that user input complies with a list of allowed values. This could allow an authenticated remote attacker to compromise the integrity of the configuration of the...

CVE-2024-47562: Improper Neutralization of Special Elements used in a Command

A vulnerability has been identified in SINEC Security Monitor All versions V4.9.0. The affected application does not properly neutralize special elements in user input to the ssmctl-client command. This could allow an authenticated, lowly privileged local attacker to execute privileged commands i...

CVE-2024-47553: Improper Neutralization of Argument Delimiters in a Command

A vulnerability has been identified in SINEC Security Monitor All versions V4.9.0. The affected application does not properly validate user input to the ssmctl-client command. This could allow an authenticated, lowly privileged remote attacker to execute arbitrary code with root privileges on the...

CVE-2024-38097: Improper Link Resolution Before File Access

Azure Monitor Agent Elevation of Privilege Vulnerability...

CLSA-2024-1728297353 kernel: Fix of 5 CVEs

drm/amd/pm: fix the Out-of-bounds read warning CVE-2024-46731 - hwmon: w83627ehf Fix underflows seen when writing limit attributes CVE-2024-46756 - hwmon: lm95234 Fix underflows seen when writing limit attributes CVE-2024-46758 - hwmon: nct6775-core Fix underflows seen when writing limit...

com.cloudbees.plugins:build-flow-plugin (0.18), com.companyline.hall.jenkins:hall-jenkins (>=1.0, <=1.2) +35 more potentially affected by CVE-2024-47803 via org.jenkins-ci.main:jenkins-core (1.509.1)

org.jenkins-ci.main:jenkins-core MAVEN version 1.509.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.cloudbees.plugins:build-flow-plugin 0.18 - com.companyline.hall.jenkins:hall-jenkins =1.0...

org.jenkins-ci.main:jenkins-test-harness (1.468), org.jenkins-ci.main:jenkins-war (1.468) +7 more potentially affected by CVE-2024-47803 via org.jenkins-ci.main:jenkins-core (1.468)

org.jenkins-ci.main:jenkins-core MAVEN version 1.468 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.468 - org.jenkins-ci.main:jenkins-war 1.468 -...

CVE-2024-9158

A stored cross site scripting vulnerability exists in Nessus Network Monitor where an authenticated, privileged local attacker could inject arbitrary code into the NNM UI via the local CLI...

CVE-2024-9158

A stored cross site scripting vulnerability exists in Nessus Network Monitor where an authenticated, privileged local attacker could inject arbitrary code into the NNM UI via the local CLI...

CVE-2024-9158 XSS

A stored cross site scripting vulnerability exists in Nessus Network Monitor where an authenticated, privileged local attacker could inject arbitrary code into the NNM UI via the local CLI...

CVE-2024-9158

CVE-2024-9158 is a stored cross-site scripting vulnerability in Nessus Network Monitor (NNM). The available connected sources confirm: an authenticated, privileged local attacker can inject arbitrary code into the NNM UI via the local CLI. Affected software is Nessus Network Monitor prior to vers...

CVE-2024-9158 XSS

A stored cross site scripting vulnerability exists in Nessus Network Monitor where an authenticated, privileged local attacker could inject arbitrary code into the NNM UI via the local CLI...

Nessus cross-site scripting vulnerabilities

Tenable Network Security Nessus is an open source system vulnerability scanner from Tenable Network Security. Nessus suffers from a cross-site scripting vulnerability that stems from Nessus Network Monitor being susceptible to a stored cross-site scripting attack, where an authenticated,...

PT-2024-39461 · Tenable · Nessus Network Monitor

Name of the Vulnerable Software and Affected Versions: Nessus Network Monitor versions 6.4.1 and earlier Description: A stored cross site scripting vulnerability exists in Nessus Network Monitor where an authenticated, privileged local attacker could inject arbitrary code into the NNM UI via the...

CVE-2024-9158: Improper Neutralization of Input During Web Page Generation

A stored cross site scripting vulnerability exists in Nessus Network Monitor where an authenticated, privileged local attacker could inject arbitrary code into the NNM UI via the local CLI...

CVE-2024-8552

The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enableshop function in all versions up to, and including, 5.0.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

CVE-2024-8552 Download Monitor <= 5.0.9 - Missing Authorization to Authenticated (Subscriber+) Shop Enable

The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enableshop function in all versions up to, and including, 5.0.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...