CVE-2023-52237

CVE-2023-52237 affects a wide range of Siemens RUGGEDCOM devices. The vulnerability stems from the web server; a low-privileged user can access hashes and password salts of all system users, including admins. This exposure enables offline brute-forcing of credentials. CVSS metrics in connected do...

CVE-2023-3286

A BOLA vulnerability in POST /secretaries allows a low privileged user to create a low privileged user secretary in the system. This results in unauthorized data manipulation...

CVE-2023-3289

A BOLA vulnerability in POST /services allows a low privileged user to create a service for any user in the system including admin. This results in unauthorized data manipulation...

CVE-2023-38048

A BOLA vulnerability in GET, PUT, DELETE /providers/providerId allows a low privileged user to fetch, modify or delete a privileged user provider. This results in unauthorized access and unauthorized data manipulation...

CVE-2023-3288 A BOLA vulnerability in POST /providers in EasyAppointments < 1.5.0

A BOLA vulnerability in POST /providers allows a low privileged user to create a privileged user provider in the system. This results in privilege escalation...

CVE-2023-38052

CVE-2023-38052 describes a BOLA vulnerability in the EasyAppointments API where GET, PUT, DELETE /admins/{adminId} endpoints permit a low-privileged user to fetch, modify, or delete a high-privileged admin, leading to unauthorized access and data manipulation. Multiple sources associate this with...

CVE-2023-38050 A BOLA vulnerability in GET, PUT, DELETE /webhooks/{webhookId} in EasyAppointments < 1.5.0

A BOLA vulnerability in GET, PUT, DELETE /webhooks/webhookId allows a low privileged user to fetch, modify or delete a webhook of any user including admin. This results in unauthorized access and unauthorized data manipulation...

CVE-2023-3289 A BOLA vulnerability in POST /services in EasyAppointments < 1.5.0

A BOLA vulnerability in POST /services allows a low privileged user to create a service for any user in the system including admin. This results in unauthorized data manipulation...

CVE-2023-3290

Consolidated from connected records, CVE-2023-3290 applies to EasyAppointments, specifically the vulnerability in POST /customers. The root cause is an insecure authorization check that lets a low-privileged user create another low-privileged customer, enabling unauthorized data manipulation. Rel...

CVE-2023-3287 A BOLA vulnerability in POST /admins in EasyAppointments < 1.5.0

A BOLA vulnerability in POST /admins allows a low privileged user to create a high privileged user admin in the system. This results in privilege escalation...

CVE-2023-3285 A BOLA vulnerability in POST /appointments in EasyAppointments < 1.5.0

A BOLA vulnerability in POST /appointments allows a low privileged user to create an appointment for any user in the system including admin. This results in unauthorized data manipulation...

PT-2024-12688 · Easyappointments +2 · Alextselegidis/Easyappointments +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: A BOLA vulnerability in the "GET, PUT, DELETE /customers/customerId" endpoint allows a low-privileged user to fetch, modify, or delete a customer,...

PT-2024-12344 · Easyappointments +1 · Alextselegidis/Easyappointments +1

Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: A BOLA vulnerability in the "POST /appointments" endpoint allows a low-privileged user to create an appointment for any user in the system, including administrators. This results in...

PT-2024-12686 · Easyappointments +1 · Alextselegidis/Easyappointments +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: A BOLA vulnerability in the API endpoints "GET, PUT, DELETE /admins/adminId" allows a low-privileged user to fetch, modify, or delete a high-privileged...

Apache CloudStack Code Injection Vulnerability

Apache CloudStack is a suite of Infrastructure as a Service IaaS cloud computing platforms from the Apache Foundation in the United States. The platform is primarily used to deploy and manage large networks of virtual machines. Apache CloudStack suffers from a code injection vulnerability that...

IBM Cloud Pak for Business Automation 跨站脚本漏洞

IBM Cloud Pak for Business Automation is a modular set of integrated software components from International Business Machines IBM, built for any hybrid cloud, designed to automate work and accelerate business growth. IBM Cloud Pak for Business Automation suffers from a cross-site scripting...

PT-2024-27629 · Ibm · Ibm Cloud Pak For Business Automation

Name of the Vulnerable Software and Affected Versions: IBM Cloud Pak for Business Automation versions 18.0.0 through 23.0.2 Description: This issue allows a privileged user to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials...

AZL-60070 CVE-2024-6505 affecting package qemu for versions less than 6.2.0-24

A flaw was found in the virtio-net device in QEMU. When enabling the RSS feature on the virtio-net network card, the indirectionstable data within RSS becomes controllable. Setting excessively large values may cause an index out-of-bounds issue, potentially resulting in heap overflow access. This...

CVE-2024-6505 Qemu-kvm: virtio-net: queue index out-of-bounds access in software rss

A flaw was found in the virtio-net device in QEMU. When enabling the RSS feature on the virtio-net network card, the indirectionstable data within RSS becomes controllable. Setting excessively large values may cause an index out-of-bounds issue, potentially resulting in heap overflow access. This...

CVE-2024-6505 Qemu-kvm: virtio-net: queue index out-of-bounds access in software rss

A flaw was found in the virtio-net device in QEMU. When enabling the RSS feature on the virtio-net network card, the indirectionstable data within RSS becomes controllable. Setting excessively large values may cause an index out-of-bounds issue, potentially resulting in heap overflow access. This...