2441 matches found
CVE-2024-20873
Improper input validation vulnerability in caminfo driver prior to SMR Jun-2024 Release 1 allows local privileged attackers to write out-of-bounds memory...
RHEL 7 : chrony (Unpatched Vulnerability)
The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - chrony: missing key check allows impersonation between authenticated peers VU357792 CVE-2016-1567 - A fla...
CVE-2024-29824
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code. Recent assessments: cdelafuente-r7 at July 23, 2024 8:10am UTC reported: Ivanti Endpoint Manager EPM versions 2022 SU5 a...
The vulnerability of the Object-Store Profiler Command Handler component of the operating system in Clustered Data ONTAP storage systems allows a hacker to gain unauthorized access to protected information.
The vulnerability of the Object-Store Profiler Command Handler component in the operating system of Clustered Data ONTAP storage systems relates to the disclosure of information during data transmission. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected...
CVE-2023-43844
Aten PE6208 2.3.228 and 2.4.232 have default credentials for the privileged web interface account. The user is not asked to change the credentials after first login. If not changed, attackers can log in to the web interface and gain administrator privileges...
PT-2024-13143 · Aten · Aten Pe6208
Name of the Vulnerable Software and Affected Versions: Aten PE6208 versions 2.3.228 through 2.4.232 Description: The issue concerns default credentials for the privileged telnet account. These credentials are not changed after the first login, allowing attackers to log in to the telnet console an...
CVE-2024-5273
Jenkins Report Info Plugin 1.2 and earlier does not perform path validation of the workspace directory while serving report files, allowing attackers with Item/Configure permission to retrieve Surefire failures, PMD violations, Findbugs bugs, and Checkstyle errors on the controller file system by...
Unspecified Vulnerability in Zoho ManageEngine PAM360
ZOHO ManageEngine PAM360 is a complete PAM software from ZOHO, Inc. It provides complete privileged access security for your IT infrastructure. A security vulnerability exists in Zoho ManageEngine PAM360 version 6601, which stems from allowing a low-privileged user to perform administrative...
CVE-2024-29851
Veeam Backup Enterprise Manager allows high-privileged users to steal NTLM hash of Enterprise manager service account...
kernel: netfilter: xtables out-of-bounds read in u32_match_it()
A flaw was found in the Netfilter subsystem in the Linux kernel. The xtu32 module did not validate the fields in the xtu32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds read by setting the size fields with a value beyond the array boundaries, leading to a cra...
kernel: netfilter: nftables out-of-bounds read in nf_osf_match_one()
A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnlosfaddcallback function did not validate the user mode controlled optnum field. This flaw allows a local privileged CAPNETADMIN attacker to trigger an out-of-bounds read, leading to a crash or information disclosure...
Ivanti Endpoint Manager Mobile 安全漏洞
Ivanti Endpoint Manager Mobile Ivanti EPMM is a mobile management software engine from Ivanti Corporation, USA. A security vulnerability exists in Ivanti Endpoint Manager Mobile EPMM versions prior to 12.1.0.0, which originates from an SQL injection in the web component that allows an authenticat...
Cross Site Scripting (XSS)
drupal/core is vulnerable to Cross Site Scripting XSS. The vulnerability is due to Drupal configurations using the WYSIWYG CKEditor, which can be exploited by an attacker with content creation or editing capabilities to target users with access to CKEditor, including site admins with privileged...
Submariner Operator 安全漏洞
Submariner Operator is a Submariner open source for installing Submariner components on Kubernetes clusters. A security vulnerability exists in Submariner Operator, which stems from unnecessary role-based access control privileges that allow a privileged attacker to steal service account tokens a...
CVE-2024-31476
Multiple authenticated command injection vulnerabilities exist in the command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system...
CVE-2024-27108 Non privileged access to critical file vulnerability in GE HealthCare EchoPAC products
Non privileged access to critical file vulnerability in GE HealthCare EchoPAC products...
CVE-2024-27108 Non privileged access to critical file vulnerability in GE HealthCare EchoPAC products
Non privileged access to critical file vulnerability in GE HealthCare EchoPAC products...
CVE-2024-31485
A vulnerability has been identified in CPCI85 Central Processing/Communication All versions V5.30, SICORE Base system All versions V1.3.0. The web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated...
Database Connection String Disclosure
Most of the web applications rely on a database to provide features to their users. In secure designs, consuming these private or cloud databases will require authentication like username and password based credentials. Developers sometimes hard code such data in various places of their...
Wings 代码问题漏洞
Wings is the server control interface for Pterodactyl Panel. A security vulnerability exists in versions of Wings prior to 1.11.12, which arises from the ability of a user with privileged access to the game server to bypass previously implemented access controls, allowing an attacker to access...