CVE-2024-35143 IBM Planning Analytics Local missing authentication

IBM Planning Analytics Local 2.0 and 2.1 connects to a MongoDB server. MongoDB, a document-oriented database system, is listening on the remote port, and it is configured to allow connections without password authentication. A remote attacker can gain unauthorized access to the database. IBM...

CVE-2024-35143

CVE-2024-35143 concerns IBM Planning Analytics Local (2.0, 2.1) that connects to a MongoDB server which is exposed to remote access with no password authentication. The root cause is unauthenticated MongoDB connections enabled by the product’s configuration, allowing a remote attacker to gain una...

CVE-2024-35143 IBM Planning Analytics Local missing authentication

IBM Planning Analytics Local 2.0 and 2.1 connects to a MongoDB server. MongoDB, a document-oriented database system, is listening on the remote port, and it is configured to allow connections without password authentication. A remote attacker can gain unauthorized access to the database. IBM...

PT-2024-26336 · Mongodb +1 · Mongodb +1

Name of the Vulnerable Software and Affected Versions: IBM Planning Analytics Local versions 2.0 through 2.1 Description: The issue concerns a lack of password authentication in MongoDB connections, allowing a remote attacker to gain unauthorized access to the database. This could potentially lea...

BM SOFT BMPlanning 安全漏洞

BM SOFT BMPlanning is a powerful resource planning tool from the French company BM SOFT. A security vulnerability exists in BM SOFT BMPlanning version 1.0.0.1, which originates from the presence of a SQL injection vulnerability that allows an authenticated user to execute arbitrary SQL commands...

Matrix Tafnit 安全漏洞

Matrix Tafnit is an enterprise resource planning solution from Matrix. A security vulnerability exists in Matrix Tafnit version v8 that stems from observable response differences...

The vulnerability of the on-premise resource planning software of Microsoft Dynamics 365, related to incorrect authorization, allows a perpetrator to disclose protected information.

The vulnerability of the on-premise resource planning software for Microsoft Dynamics 365 is related to improper authorization. Exploitation of this vulnerability can allow an attacker, operating remotely, to disclose sensitive information...

CVE-2024-39594

SAP Business Warehouse - Business Planning and Simulation application does not sufficiently encode user controlled inputs, resulting in Reflected Cross-Site Scripting XSS vulnerability. After successful exploitation, an attacker can cause low impact on the confidentiality and integrity of the...

CVE-2024-39595

SAP Business Warehouse - Business Planning and Simulation application does not sufficiently encode user-controlled inputs, resulting in Stored Cross-Site Scripting XSS vulnerability. This vulnerability allows users to modify website content and on successful exploitation, an attacker can cause lo...

CVE-2024-39594

The CVE-2024-39594 entry concerns SAP Business Warehouse - Business Planning and Simulation, where the application fails to sufficiently encode user-controlled inputs, causing a Reflected Cross-Site Scripting (XSS) vulnerability. The root cause is insufficient input encoding in the affected compo...

CVE-2024-39594 [CVE-2024-39594] Multiple Cross-Site Scripting (XSS) vulnerabilities in SAP Business Warehouse - Business Planning and Simulation

SAP Business Warehouse - Business Planning and Simulation application does not sufficiently encode user controlled inputs, resulting in Reflected Cross-Site Scripting XSS vulnerability. After successful exploitation, an attacker can cause low impact on the confidentiality and integrity of the...

PT-2024-4972 · Microsoft · Dynamics 365

Name of the Vulnerable Software and Affected Versions: Microsoft Dynamics 365 On-Premises affected versions not specified Description: The issue is related to improper authorization in the local software tool for resource planning in Microsoft Dynamics 365 On-Premises. Exploitation of this issue...

PT-2024-9880 · Sap · Sap Business Warehouse - Business Planning/Simulation

Name of the Vulnerable Software and Affected Versions: SAP Business Warehouse - Business Planning and Simulation affected versions not specified Description: The issue is related to Stored Cross-Site Scripting XSS due to insufficient encoding of user-controlled inputs. This allows users to modify...

PT-2024-9861 · Sap · Sap Business Warehouse - Business Planning/Simulation

Name of the Vulnerable Software and Affected Versions: SAP Business Warehouse - Business Planning and Simulation affected versions not specified Description: The issue is related to insufficient encoding of user-controlled inputs in the SAP Business Warehouse - Business Planning and Simulation...

South Korean ERP Vendor's Server Hacked to Spread Xctdoor Malware

An unnamed South Korean enterprise resource planning ERP vendor's product update server has been found to be compromised to deliver a Go-based backdoor dubbed Xctdoor. The AhnLab Security Intelligence Center ASEC, which identified the attack in May 2024, did not attribute it to a known threat act...

CVE-2024-25053

IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, and 12.0.2 is vulnerable to improper certificate validation when using the IBM Planning Analytics Data Source Connection. This could allow an attacker to spoof a trusted entity by interfering in the communication path...

CVE-2024-25053

IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, and 12.0.2 is vulnerable to improper certificate validation when using the IBM Planning Analytics Data Source Connection. This could allow an attacker to spoof a trusted entity by interfering in the communication path...

CVE-2024-25053 IBM Cognos Analytics improper certificate validation

IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, and 12.0.2 is vulnerable to improper certificate validation when using the IBM Planning Analytics Data Source Connection. This could allow an attacker to spoof a trusted entity by interfering in the communication path...

CVE-2024-25053 IBM Cognos Analytics improper certificate validation

IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, and 12.0.2 is vulnerable to improper certificate validation when using the IBM Planning Analytics Data Source Connection. This could allow an attacker to spoof a trusted entity by interfering in the communication path...

CVE-2024-25053

The CVE-2024-25053 issue affects IBM Cognos Analytics: vulnerable in IBM Cognos Analytics 11.2.0–11.2.4 FP3 and 12.0.0–12.0.2 due to improper certificate validation when using the IBM Planning Analytics Data Source Connection, enabling an attacker to spoof a trusted entity by intercepting communi...