9935 matches found
SPIP information leakage vulnerability
SPIP is a Web-based content distribution system used primarily for online collaboration. A security vulnerability exists in SPIP, which stems from a web-based system or product that does not properly restrict access to resources from unauthorized roles. An unauthenticated attacker could use this...
SAP Business Objects Business Intelligence Platform information leakage vulnerability
SAP Business Objects Business Intelligence Platform is a suite of business intelligence software and enterprise performance solutions from SAP, Germany. The product features report generation, analytics, and data visualization. An information disclosure vulnerability exists in SAP Business Object...
Icinga Web 2 < 2.8.6, 2.9.x < 2.9.6 Multiple Vulnerabilities
Icinga Web 2 is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:icinga:icingaweb2";...
Design/Logic Flaw
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Installations of Icinga 2 with the IDO writer enabled are affected. If you use service custom variables in role restrictions, and you regularly decommission service objects, users with said roles may...
UBUNTU-CVE-2022-24714
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Installations of Icinga 2 with the IDO writer enabled are affected. If you use service custom variables in role restrictions, and you regularly decommission service objects, users with said roles may...
CVE-2022-24714
CVE-2022-24714 affects Icinga Web 2 installations with the IDO writer enabled. The vulnerability stems from using service custom variables in role restrictions, which can allow users with specific roles to access a collection of content, if those roles granted access to hosts via at least one ser...
CVE-2022-24398
SAP BusinessObjects BI Platform versions 4.2 (420) and 4.3 (430) are affected by an information disclosure vulnerability under certain conditions that can be exploited by an authenticated attacker to access restricted information. The issue is documented across multiple sources as CVE-2022-24398....
CVE-2022-24398
Under certain conditions SAP Business Objects Business Intelligence Platform - versions 420, 430, allows an authenticated attacker to access information which would otherwise be restricted...
CVE-2022-24282
A vulnerability has been identified in SINEC NMS All versions = V1.0.3 V2.0, SINEC NMS All versions V1.0.3, SINEMA Server V14 All versions. The affected system allows to upload JSON objects that are deserialized to Java objects. Due to insecure deserialization of user-supplied content by the...
CVE-2022-24398: Exposure of Sensitive Information to an Unauthorized Actor
Under certain conditions SAP Business Objects Business Intelligence Platform - versions 420, 430, allows an authenticated attacker to access information which would otherwise be restricted...
CVE-2022-24282: Deserialization of Untrusted Data
A vulnerability has been identified in SINEC NMS All versions = V1.0.3 V2.0, SINEC NMS All versions V1.0.3, SINEMA Server V14 All versions. The affected system allows to upload JSON objects that are deserialized to Java objects. Due to insecure deserialization of user-supplied content by the...
PT-2022-16673
Name of the Vulnerable Software and Affected Versions SAP Business Objects Business Intelligence Platform versions 420, 430 Description The issue allows an authenticated attacker to access restricted information under certain conditions. Recommendations For versions 420 and 430, at the moment,...
PT-2022-1911
Name of the Vulnerable Software and Affected Versions Firefox versions prior to 98 Firefox ESR versions prior to 91.7 Thunderbird versions prior to 91.7 Description The issue is related to a use-after-free error when handling HTML content, specifically in the context of SVG objects. This can lead...
CVE-2022-24282
A vulnerability has been identified in SINEC NMS All versions = V1.0.3 V2.0, SINEC NMS All versions V1.0.3, SINEMA Server V14 All versions. The affected system allows to upload JSON objects that are deserialized to Java objects. Due to insecure deserialization of user-supplied content by the...
CVE-2022-24282
CVE-2022-24282 affects Siemens SINEC NMS and SINEMA Server V14. The vulnerability is due to insecure deserialization of user-supplied JSON objects into Java objects, allowing a privileged attacker to execute arbitrary code on the device with root privileges. Affected versions of SINEC NMS include...
Threat landscape for industrial automation systems, H2 2021
2021 is the second year we have spent living and working in the pandemic. By 2021 everyone got used to pandemic limitations – industrial organization employees and IT security professionals and threat actors. If we compare the numbers from 2020 and 2021, we see that 2021 looks more stable,...
Microsoft Excel Remote Code Execution Vulnerability
A remote code execution vulnerability exists in Microsoft Excel when the software fails to properly handle objects in memory...
MariaDB CONNECT Storage Engine Use-After-Free Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16207.
...
PT-2022-13065
Name of the Vulnerable Software and Affected Versions Fuchsia affected versions not specified Description An issue exists in Fuchsia where VMO data can be modified through access to copy-on-write snapshots, allowing a local attacker to modify objects in the VMO that they do not have permission to...
Xerte Cross-Site Scripting Vulnerability
Xerte is an open source software from The Xerte Project community in the UK. Used to create learning objects. Xerte has a security vulnerability that stems from a site scripting XSS vulnerability in The Xerte Project via the link parameter in print.php. No details of the vulnerability are current...