CVE-2022-420004

CVE-2022-42004 is listed in IBM’s bulletin as part of the Jackson-Databind vulnerabilities affecting Eclipse Jetty/Jackson libraries; the entry describes a Denial of Service via Jackson Databind BeanDeserializer._deserializeFromArray, triggered by deeply nested arrays that exhaust resources. The ...

CVE-2023-358900

The connected IBM bulletin confirms CVE-2023-358900 affects IBM WebSphere Application Server traditional when shipped with IBM Intelligent Operations Center (IOC). Affected IOC versions: 1.5.0, 1.6.0, 1.6.0.1, 1.6.0.2, 1.6.0.3, and IOC for Emergency Management (Linux) 1.6.0. Remediation is to ins...

CVE-2022-237732

IBM Security Bulletin for CVE-2022-237732 (treated as CVE-2022-23773 in the IBM document) indicates an unspecified Golang Go vulnerability that may affect Watson CP4D Data Stores. Affected: all versions before IBM Cloud Pak for Data 4.7.0. Impact is not fully specified beyond the CVSS base score ...

cardozoec.org Cross Site Scripting vulnerability OBB-3552726

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

atixa.org Cross Site Scripting vulnerability OBB-3552645

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Missing Authorization

sentry is vulnerable to Missing Authorization. The vulnerability exists in the download function at debugfiles.py due to not restricting file downloads to unauthenticated users of a different project which allows an attacker to perform arbitrary file downloads of debug or artifact bundles of an...

one.mclaren.org Open Redirect vulnerability OBB-3550125

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-36826 Sentry vulnerable to improper authorization on debug and artifact file downloads

Sentry is an error tracking and performance monitoring platform. Starting in version 8.21.0 and prior to version 23.5.2, an authenticated user can download a debug or artifact bundle from arbitrary organizations and projects with a known bundle ID. The user does not need to be a member of the...

Improper authorization on debug and artifact file downloads

Impact An authenticated user can download a debug or artifact bundle from arbitrary organizations and projects with a known bundle ID. The user does not need to be a member of the organization or have permissions on the project. Patches A patch was issued to ensure authorization checks are proper...

Ivanti Releases Urgent Patch for EPMM Zero-Day Vulnerability Under Active Exploitation

Ivanti is warning users to update their Endpoint Manager Mobile EPMM mobile device management software formerly MobileIron Core to the latest version that fixes an actively exploited zero-day vulnerability. Dubbed CVE-2023-35078, the issue has been described as a remote unauthenticated API access...

PT-2023-25715 · Sentry · Sentry

Name of the Vulnerable Software and Affected Versions: Sentry versions 8.21.0 through 23.5.1 Description: An authenticated user can download a debug or artifact bundle from arbitrary organizations and projects with a known bundle ID, without needing to be a member of the organization or having...

openSUSE 15: libopenvswitch-2_14-0 / libovn-20_06-0 / openvswitch / etc (SUSE-SU-2023:2250-2)

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2250-2 advisory. - CVE-2022-4338: Fixed Integer Underflow in Organization Specific TLV bsc1206580. - CVE-2022-4337: Fixed Out-of-Bounds Read in Organization Specific...

CVE-2023-37802

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

join.unison.org.uk Cross Site Scripting vulnerability OBB-3506377

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

pilsudski.org.uk Cross Site Scripting vulnerability OBB-3504825

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Four Must-haves to Strengthen Your Endpoint Security

To combat complexity and achieve optimal security outcomes, there are four key factors an organization should consider when evaluating their endpoint security...

CVE-2021-34475

Microsoft Edge Chromium-based Elevation of Privilege Vulnerability...

CVE-2023-31222

Deserialization of untrusted data in Microsoft Messaging Queuing Service in Medtronic's Paceart Optima versions 1.11 and earlier on Windows allows an unauthorized user to impact a healthcare delivery organization’s Paceart Optima system cardiac device causing data to be deleted, stolen, or...

Deserialization of untrusted data

Deserialization of untrusted data in Microsoft Messaging Queuing Service in Medtronic's Paceart Optima versions 1.11 and earlier on Windows allows an unauthorized user to impact a healthcare delivery organization’s Paceart Optima system cardiac device causing data to be deleted, stolen, or...

CVE-2023-31222 Medtronic Paceart MSMQ Deserialization of Untrusted Data

Deserialization of untrusted data in Microsoft Messaging Queuing Service in Medtronic's Paceart Optima versions 1.11 and earlier on Windows allows an unauthorized user to impact a healthcare delivery organization’s Paceart Optima system cardiac device causing data to be deleted, stolen, or...