CVE-2024-21832: Improper Control of Generation of Code

A potential JSON injection attack vector exists in PingFederate REST API data stores using the POST method and a JSON request body...

PT-2024-19081

Name of the Vulnerable Software and Affected Versions PingFederate affected versions not specified Description A potential JSON injection attack vector exists in PingFederate REST API data stores using the POST method and a JSON request body. Recommendations At the moment, there is no information...

GeoServer's Server Status shows sensitive environmental variables and Java properties

GeoServer's Server Status page and REST API at /geoserver/rest/about/status lists all environment variables and Java properties to any GeoServer user with administrative rights as part of those modules' status message. These variables/properties can also contain sensitive information, such as...

GHSA-J59V-VGCR-HXVF GeoServer's Server Status shows sensitive environmental variables and Java properties

GeoServer's Server Status page and REST API at /geoserver/rest/about/status lists all environment variables and Java properties to any GeoServer user with administrative rights as part of those modules' status message. These variables/properties can also contain sensitive information, such as...

CVE-2024-34696

GeoServer is an open source server that allows users to share and edit geospatial data. Starting in version 2.10.0 and prior to versions 2.24.4 and 2.25.1, GeoServer's Server Status page and REST API lists all environment variables and Java properties to any GeoServer user with administrative...

CVE-2024-34696 GeoServer's Server Status shows sensitive environmental variables and Java properties

GeoServer is an open source server that allows users to share and edit geospatial data. Starting in version 2.10.0 and prior to versions 2.24.4 and 2.25.1, GeoServer's Server Status page and REST API lists all environment variables and Java properties to any GeoServer user with administrative...

CVE-2024-34696

Geoserver CVE-2024-34696 describes exposure of environment variables and Java system properties via the Server Status page and REST API, accessible to administrators. The issue affects GeoServer 2.10.0 up to versions before 2.24.4 and 2.25.1, where environment data (e.g., database passwords, API ...

CVE-2024-34696 GeoServer's Server Status shows sensitive environmental variables and Java properties

GeoServer is an open source server that allows users to share and edit geospatial data. Starting in version 2.10.0 and prior to versions 2.24.4 and 2.25.1, GeoServer's Server Status page and REST API lists all environment variables and Java properties to any GeoServer user with administrative...

CVE-2024-34696

GeoServer is an open source server that allows users to share and edit geospatial data. Starting in version 2.10.0 and prior to versions 2.24.4 and 2.25.1, GeoServer's Server Status page and REST API lists all environment variables and Java properties to any GeoServer user with administrative...

PT-2024-26113

Name of the Vulnerable Software and Affected Versions GeoServer versions 2.10.0 through 2.24.3 GeoServer versions 2.25.0 Description The issue concerns GeoServer's Server Status page and REST API, which list all environment variables and Java properties to any GeoServer user with administrative...

CVE-2024-34696: Exposure of Sensitive Information to an Unauthorized Actor

GeoServer is an open source server that allows users to share and edit geospatial data. Starting in version 2.10.0 and prior to versions 2.24.4 and 2.25.1, GeoServer's Server Status page and REST API lists all environment variables and Java properties to any GeoServer user with administrative...

Security Bulletin: IBM MQ is affected by a password disclosure vulnerability (CVE-2024-35156)

Summary IBM MQ has addressed a password disclosure vulnerability in the IBM MQ REST API. Vulnerability Details CVEID:CVE-2024-35156 DESCRIPTION: IBM MQ could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This informatio...

Malicious code in azure-rest-api-specs-tests (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-1799 Malicious code in azure-rest-api-specs-tests (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-1798 Malicious code in azure-rest-api-specs-eng-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 34ba9e800ce9823b7e1b4b90d47a87eafdfb783d616caa8a69bf93f55ee0a9b5 The OpenSSF Package Analysis project identified 'azure-rest-api-specs-eng-tools' @ 1.0.1 npm as malicious. It is considered malicious because: -...

Malicious code in azure-rest-api-specs-eng-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 34ba9e800ce9823b7e1b4b90d47a87eafdfb783d616caa8a69bf93f55ee0a9b5 The OpenSSF Package Analysis project identified 'azure-rest-api-specs-eng-tools' @ 1.0.1 npm as malicious. It is considered malicious because: -...

CVE-2024-5639

The User Profile Picture plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.6.1 via the 'restapichangeprofileimage' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

PT-2024-36810

Name of the Vulnerable Software and Affected Versions User Profile Picture plugin for WordPress versions up to, and including, 2.6.1 Description The issue allows authenticated attackers with Author-level access and above to update the profile picture of any user due to missing validation on a...

CVE-2024-3605

The WP Hotel Booking plugin for WordPress is vulnerable to SQL Injection via the 'roomtype' parameter of the /wphb/v1/rooms/search-rooms REST API endpoint in all versions up to, and including, 2.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

CVE-2024-3605 WP Hotel Booking <= 2.1.0 - Unauthenticated SQL Injection

The WP Hotel Booking plugin for WordPress is vulnerable to SQL Injection via the 'roomtype' parameter of the /wphb/v1/rooms/search-rooms REST API endpoint in all versions up to, and including, 2.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...