Splunk Enterprise 安全漏洞

Splunk Enterprise is a suite of data collection and analytics software from Splunk, Inc. in the United States. A security vulnerability exists in Splunk Enterprise versions 9.3.x prior to 9.3.1, 9.2.x prior to 9.2.3, and 9.1.x prior to 9.1.6, which stems from the possibility of exposing sensitive...

ABB Cylon Aspect 3.08.00 (sslCertAjax.php) Remote Code Execution

Summary ASPECT is an award-winning scalable building energy management and control solution designed to allow users seamless access to their building data through standard building protocols including smart devices. Description The ABB BMS/BAS controller suffers from an authenticated OS command...

PT-2024-7164

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 9.3.1 Splunk Enterprise versions prior to 9.2.3 Splunk Enterprise versions prior to 9.1.6 Description The software potentially exposes sensitive HTTP parameters to the internal index if the REST Calls log...

Splunk Enterprise 9.1.0 < 9.1.6, 9.2.0 < 9.2.3, 9.3.0 < 9.3.1 (SVD-2024-1008)

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2024-1008 advisory. - In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6, the software potentially exposes sensitive HTTP parameters to th...

PT-2024-33242 · Automatic Systems Maintenance · Slimlane

Name of the Vulnerable Software and Affected Versions: Automatic Systems Maintenance SlimLane affected versions not specified Description: An issue in Automatic Systems Maintenance SlimLane allows a remote attacker to obtain sensitive information via the Racine and FileName parameters in the...

UTCMS 代码问题漏洞

UTCMS is a content management system built on the UT framework by the individual developer of usaltool. A code issue vulnerability exists in UTCMS V9 that stems from mishandling of parameters, leading to deserialization...

CVE-2024-47074 Dataease PostgreSQL Data Source JDBC Connection Parameters Not Verified Leads to Deserialization Vulnerability

DataEase is an open source data visualization analysis tool. In Dataease, the PostgreSQL data source in the data source function can customize the JDBC connection parameters and the PG server target to be connected. In backend/src/main/java/io/dataease/provider/datasource/JdbcProvider.java,...

CVE-2024-42018

An issue was discovered in Atos Eviden SMC xScale before 1.6.6. During initialization of nodes, some configuration parameters are retrieved from management nodes. These parameters embed credentials whose integrity and confidentiality may be important to the security of the HPC configuration...

DataEase 代码问题漏洞

DataEase is an open source data visualization and analysis tool from DataEase Open Source. Used to help users quickly analyze data and insight into business trends , so as to achieve business improvement and optimization . A code issue vulnerability exists in versions prior to DataEase v1.18.25...

CVE-2024-9803

A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been classified as problematic. This affects an unknown part of the file blooddetails.php. The manipulation of the argument Availibility leads to cross site scripting. It is possible to initiate the attack remotel...

WordPress TI WooCommerce Wishlist plugin <= 2.9.0 - Unauthenticated SQL Injection via lang parameters vulnerability

Unauthenticated SQL Injection via lang parameters vulnerability discovered by John Castro in WordPress Plugin TI WooCommerce Wishlist versions = 2.9.0...

MediaWiki 安全漏洞

MediaWiki is a suite of free and freely available web-based Wiki engines from the Wikimedia USA Foundation. It can be used to deploy in-house knowledge management and content management systems. A security vulnerability exists in MediaWiki versions prior to 1.39.5 and 1.40.x prior to 1.40.1, whic...

Anteeo WMS 安全漏洞

Anteeo WMS is a fully functional data center from Anteeo WMS, Inc. A security vulnerability exists in Anteeo WMS versions prior to 4.7.34, which stems from the presence of a SQL injection vulnerability that allows an unauthenticated attacker to execute arbitrary SQL commands via username paramete...

CVE-2024-45919

A security flaw has been discovered in Solvait version 24.4.2 that allows an attacker to elevate their privileges. By manipulating the Request ID and Action Type parameters in /AssignToMe/SetAction, an attacker can bypass approval workflows leading to unauthorized access to sensitive information ...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through the discriminantFormula and r1Formula processes due to improper user input sanitization. An attacker can execute arbitrary JavaScript code by injecting malicious input into the POST parameters used in...

Mecha CMS 安全漏洞

Mecha CMS is a Mecha open source flat file content management system for minimalists. A security vulnerability exists in Mecha CMS version 3.0.0 that stems from vulnerability to directory traversal attacks. An attacker can construct cookies and URIs that bypass user identity checks and then pass...

The vulnerability of the ring-buffer component in the Linux operating system’s kernel allows a hacker to gain unauthorized access to confidential information within the system.

The vulnerability of the ring-buffer component in the Linux operating system’s kernel is related to insufficient protection of service data when processing request parameters. Exploiting this vulnerability can allow an attacker to gain unauthorized access to confidential information within the...

CVE-2024-45919

A security flaw has been discovered in Solvait version 24.4.2 that allows an attacker to elevate their privileges. By manipulating the Request ID and Action Type parameters in /AssignToMe/SetAction, an attacker can bypass approval workflows leading to unauthorized access to sensitive information ...

Saltcorn 路径遍历漏洞

Saltcorn is an extensible open source no-code database application builder from Saltcorn Open Source. A path traversal vulnerability exists in Saltcorn that stems from POST parameters that are not validated or cleaned up...

CVE-2024-45919

CVE-2024-45919 affects Solvait 24.4.2. The vulnerability arises from a flaw in the /AssignToMe/SetAction endpoint where manipulating Request ID and Action Type can bypass approval workflows, enabling privilege escalation and potential access to sensitive data or fraudulent approvals. Connected so...