OESA-2024-2545 haproxy security update

HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones. Security Fixes: Inconsistent...

CVE-2024-11834 Arbitrary File Write via PTRAC Import

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in PlexTrac allows arbitrary file writes.This issue affects PlexTrac: from 1.61.3 before 2.8.1...

USN-7153-1 php7.0, php7.2 vulnerability

It was discovered that PHP incorrectly handled long string inputs in two database drivers. An attacker could possibly use this issue to write files in locations they would not normally have access to. CVE-2024-11236...

PT-2024-17642 · Sourcecodester · Sourcecodester Kortex Lite Advocate Office Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Kortex Lite Advocate Office Management System version 1.0 Description: A problem has been found in the system, affecting some unknown functionality of the file /control/client data.php. The manipulation of the id argument leads...

PT-2024-16697 · WordPress · Members – Membership & User Role Editor Plugin

Name of the Vulnerable Software and Affected Versions: Members – Membership & User Role Editor Plugin versions up to, and including, 3.2.10 Description: The issue allows unauthenticated attackers to extract sensitive data from posts restricted to higher-level roles, such as administrators, via th...

Unauthorized Resource Access

github.com/rancher/steve is vulnerable to Unauthorized Resource Access. The vulnerability is due to improper authorization checks, allowing users with minimal generic permissions to access and watch restricted resources...

CVE-2024-32732

Under certain conditions SAP BusinessObjects Business Intelligence platform allows an attacker to access information which would otherwise be restricted.This has low impact on Confidentiality with no impact on Integrity and Availability of the application...

PT-2024-9727 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.21 and earlier Description: The issue is a DOM-based Cross-Site Scripting XSS vulnerability that could allow an attacker to execute arbitrary code in the context of the victim's browser. This occurs when...

PT-2024-16767 · WordPress · Simple Restrict

Name of the Vulnerable Software and Affected Versions: Simple Restrict plugin for WordPress versions up to, and including, 1.2.7 Description: The issue allows unauthenticated attackers to extract sensitive data from posts restricted to higher-level roles, such as administrators, via the WordPress...

SAP NetWeaver Application Server 安全漏洞

SAP NetWeaver Application Server is an application server from SAP, Germany. A security vulnerability exists in SAP NetWeaver Application Server that originates from allowing an authenticated attacker to craft a Remote Function Call RFC request to a restricted destination, which could be used to...

SAP BusinessObjects Business Intelligence Platform 安全漏洞

SAP BusinessObjects Business Intelligence Platform is a complete business analytics platform from SAP. The platform combines market-leading SAP data integration products, data management products, and business intelligence BI products to eliminate system integration challenges and quickly and...

PT-2024-10222 · Document Foundation +5 · Libreoffice +5

Name of the Vulnerable Software and Affected Versions: LibreOffice versions 24.8 through 24.8.3 Description: The issue is related to an improper limitation of a pathname to a restricted directory, allowing absolute path traversal. An attacker can write to arbitrary locations, albeit suffixed with...

The vulnerability of the 2N Access Commander access control tool lies in the incorrect limitation of the path name for the restricted access catalog, allowing a intruder to execute arbitrary code.

The vulnerability of the 2N Access Commander access control system lies in the incorrect limitation of the path name to the restricted catalog. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary code...

GO-2024-3313 Restricted TLS certificate privilege escalation when in PKI mode in github.com/canonical/lxd

Restricted TLS certificate privilege escalation when in PKI mode in github.com/canonical/lxd...

PT-2024-13810 · Unknown · Registrationmagic

Name of the Vulnerable Software and Affected Versions: RegistrationMagic versions 5.2.3.0 and earlier Description: The issue is related to a missing authorization vulnerability in Metagauss User Registration Forms RegistrationMagic, which allows the exploitation of incorrectly configured access...

CVE-2024-6219

Mark Laing discovered in LXD's PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its restrictions not honoured...

UBUNTU-CVE-2024-6219

Mark Laing discovered in LXD's PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its restrictions not honoured...

The vulnerability of the application programming interface of the Trellix Enterprise Security Manager (ESM) system, which allows a threat actor to circumvent security restrictions.

The vulnerability of the application programming interface of the Trellix Enterprise Security Manager ESM system for monitoring, analyzing, and managing security threats is related to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability could allow ...

CVE-2024-6219

Mark Laing discovered in LXD's PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its restrictions not honoured...

CVE-2024-6219

Mark Laing discovered in LXD's PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its restrictions not honoured...