2441 matches found
CVE-2024-40628 Arbitrary File Read in Ansible Playbooks in Jumpserver
JumpServer is an open-source Privileged Access Management PAM tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes, Database and RemoteApp endpoints through a web browser. An attacker can exploit the ansible playbook to read arbitrary files in the celery...
CVE-2024-40629
CVE-2024-40629 affects JumpServer PAM. An attacker can misuse an Ansible playbook to write arbitrary files, triggering remote code execution in the Celery container. The Celery container runs as root and has database access, enabling access to secrets and the possibility to create an admin JumpSe...
CVE-2024-40629 Arbitrary File Write in Ansible Playbooks leads to RCE in Jumpserver
JumpServer is an open-source Privileged Access Management PAM tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes, Database and RemoteApp endpoints through a web browser. An attacker can exploit the Ansible playbook to write arbitrary files, leading to...
CVE-2024-40629 Arbitrary File Write in Ansible Playbooks leads to RCE in Jumpserver
JumpServer is an open-source Privileged Access Management PAM tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes, Database and RemoteApp endpoints through a web browser. An attacker can exploit the Ansible playbook to write arbitrary files, leading to...
PT-2024-5028 · Unknown +2 · Jumpserver +2
Name of the Vulnerable Software and Affected Versions: JumpServer versions prior to 3.10.12 JumpServer versions prior to 4.0.0 Description: The issue is related to the JumpServer Privileged Access Management PAM tool, which provides secure access to various endpoints through a web browser. An...
PT-2024-5027 · Unknown · Jumpserver
Name of the Vulnerable Software and Affected Versions: JumpServer versions prior to 3.10.12 JumpServer versions prior to 4.0.0 Description: JumpServer is an open-source Privileged Access Management PAM tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes...
CVE-2023-4976
CVE-2023-4976 affects Pure FlashBlade. The flaw allows a local account to authenticate to the FlashBlade management interface via an unintended method, enabling privileged access to the array. The available sources (NVD/Red Hat) describe the impact as high confidentiality, integrity, and availabi...
CVE-2023-4976 FlashBlade Authentication Mechanism Vulnerability
A flaw exists in FlashBlade whereby a local account is permitted to authenticate to the management interface using an unintended method that allows an attacker to gain privileged access to the array...
PT-2024-13796 · Unknown · Purity//Fb
Name of the Vulnerable Software and Affected Versions: Purity//FB affected versions not specified Description: A flaw in the authentication mechanism allows a local account to access the management interface using an unintended method, potentially granting an attacker privileged access to the...
CVE-2024-21162
Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL...
CVE-2024-38496 Symantec Privileged Access Manager Insecure Direct Object Reference vulnerability
The vulnerability allows a malicious low-privileged PAM user to access information about other PAM users and their group memberships...
CVE-2024-38495
CVE-2024-38495 concerns Broadcom Symantec Privileged Access Management (PAM). Multiple connected sources describe a vulnerability in an authentication mechanism that allows an attacker to learn IDs of all PAM users defined in the database. The available documents do not provide product version ra...
CVE-2024-38495 Symantec Privileged Access Manager User Enumeration vulnerability
A specific authentication strategy allows a malicious attacker to learn ids of all PAM users defined in its database...
CVE-2024-38495 Symantec Privileged Access Manager User Enumeration vulnerability
A specific authentication strategy allows a malicious attacker to learn ids of all PAM users defined in its database...
CVE-2024-38493 Symantec Privileged Access Manager Reflected Cross Site Scripting vulnerability
A reflected cross-site scripting XSS vulnerability exists in the PAM UI web interface. A remote attacker able to convince a PAM user to click on a specially crafted link to the PAM UI web interface could potentially execute arbitrary client-side code in the context of PAM UI...
CVE-2024-38492 Symantec Privileged Access Manager Remote Command Execution vulnerability
This vulnerability allows an unauthenticated attacker to achieve remote command execution on the affected PAM system by uploading a specially crafted PAM upgrade file...
CVE-2024-38491 Symantec Privileged Access Manager SQL Injection vulnerability
The vulnerability allows an unauthenticated attacker to read arbitrary information from the database...
CVE-2024-38491 Symantec Privileged Access Manager SQL Injection vulnerability
The vulnerability allows an unauthenticated attacker to read arbitrary information from the database...