PT-2024-36782 · Redcap · Redcap

Name of the Vulnerable Software and Affected Versions: REDCap versions 14.9.6 through 15.0.0 Description: The issue is related to a security flaw in the Notes section of calendar events in REDCap, exposing users to a Cross-Site Request Forgery CSRF attack. An attacker can exploit this by luring...

PT-2024-34639 · Ibm · Ibm I

Name of the Vulnerable Software and Affected Versions: IBM i versions 7.3 through 7.5 Description: The issue is related to server-side request forgery SSRF, which may allow an authenticated attacker to send unauthorized requests from the system. This could potentially lead to network enumeration ...

CGA-HMVH-96M2-WCRJ

Bulletin has no description...

PT-2024-17761 · Emlog Pro · Emlog Pro

Name of the Vulnerable Software and Affected Versions: Emlog Pro versions up to 2.4.1 Description: A vulnerability was found in Emlog Pro, affecting unknown code of the file /admin/user.php. The manipulation of the keyword argument leads to cross-site scripting. The attack can be initiated...

PT-2024-53: Reading arbitrary files via API in PT Application Inspector (PT AI)

The vulnerability was identified in PT Application Inspector PT AI, versions 4.4.0 - 4.9.0 inlusevely. The discovered vulnerability allows an attacker with network access to PT AI to read source code files of other users' projects. The vulnerability can be used for privilege escalation...

Delta Electronics DTM Soft

RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize network exposure for all control...

Tibbo AggreGate Network Manager

RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to achieve code execution on the affected device. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize network...

Hitachi Energy RTU500 series CMU

RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. CISA reminds organizations to perform...

CVE-2024-56128

A flaw was found in Apache Kafka's implementation of the Salted Challenge Response Authentication Mechanism SCRAM, which did not fully adhere to the requirements of RFC 5802. Specifically, as per RFC 5802, the server must verify that the nonce sent by the client in the second message matches the...

CVE-2024-56128

Incorrect Implementation of Authentication Algorithm in Apache Kafka's SCRAM implementation. Issue Summary: Apache Kafka's implementation of the Salted Challenge Response Authentication Mechanism SCRAM did not fully adhere to the requirements of RFC 5802 1. Specifically, as per RFC 5802, the serv...

CVE-2024-56128 Apache Kafka: SCRAM authentication vulnerable to replay attacks when used without encryption

Incorrect Implementation of Authentication Algorithm in Apache Kafka's SCRAM implementation. Issue Summary: Apache Kafka's implementation of the Salted Challenge Response Authentication Mechanism SCRAM did not fully adhere to the requirements of RFC 5802 1. Specifically, as per RFC 5802, the serv...

CVE-2024-56128 Apache Kafka: SCRAM authentication vulnerable to replay attacks when used without encryption

Incorrect Implementation of Authentication Algorithm in Apache Kafka's SCRAM implementation. Issue Summary: Apache Kafka's implementation of the Salted Challenge Response Authentication Mechanism SCRAM did not fully adhere to the requirements of RFC 5802 1. Specifically, as per RFC 5802, the serv...

CVE-2024-56128

CVE-2024-56128 affects Apache Kafka SCRAM authentication. Root cause: SCRAM server nonce verification against the server’s first message was not performed per RFC 5802, enabling plaintext-snooping scenarios if SCRAM is used over non-TLS. Impact: exploitation requires access to plaintext SCRAM exc...

PT-2024-9675

Name of the Vulnerable Software and Affected Versions Fortinet FortiWLM versions 8.5.0 through 8.5.4 Fortinet FortiWLM versions 8.6.0 through 8.6.5 Description A relative path traversal vulnerability in Fortinet FortiWLM allows an attacker to execute unauthorized code or commands via specially...

Exploit for CVE-2024-44765

CVE-2024-44765https://nvd.nist.gov/vuln/detail/CVE-2024-447...

DEBIAN-CVE-2024-54677

Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.9.97. The following versions were EOL at...

ThreatQuotient ThreatQ Platform

RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to perform remote code execution. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize network exposure for all...

Apache Tomcat 10.1.0.M1 < 10.1.34 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 10.1.34. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat10.1.34security-10 advisory. - Time-of-check Time-of-use TOCTOU Race Condition vulnerability during JSP compilation in Apache Tomc...

PT-2025-25327 · Oracle +2 · Oracle +2

Name of the Vulnerable Software and Affected Versions: XWiki versions prior to 15.10.16 XWiki versions prior to 16.4.7 XWiki versions prior to 16.10.2 Description: The issue allows execution of any SQL query in Oracle using functions like DBMS XMLGEN or DBMS XMLQUERY. This is due to the XWiki que...

CVE-2024-12698

An incomplete fix for ose-olm-catalogd-container was issued for the Rapid Reset Vulnerability CVE-2023-39325/CVE-2023-44487 where only unauthenticated streams were protected, not streams created by authenticated sources. Mitigation Red Hat Product Security does not have any mitigation...