14583 matches found
CVE-2024-38346
CVE-2024-38346 affects Apache CloudStack’s cluster service that runs on an unauthenticated port (default 9090). The provided documents describe a code-injection vulnerability enabling remote code execution on targeted hypervisors and CloudStack management server hosts, potentially leading to comp...
CVE-2024-38346 Apache CloudStack: Unauthenticated cluster service port leads to remote execution
The CloudStack cluster service runs on unauthenticated port default 9090 that can be misused to run arbitrary commands on targeted hypervisors and CloudStack management server hosts. Some of these commands were found to have command injection vulnerabilities that can result in arbitrary code...
CVE-2024-39864 Apache CloudStack: Integration API service uses dynamic port when disabled
The CloudStack integration API service allows running its unauthenticated API server usually on port 8096 when configured and enabled via integration.api.port global setting for internal portal integrations and for testing purposes. By default, the integration API service port is disabled and is...
PT-2024-37698 · Red Hat · Openshift Console
Name of the Vulnerable Software and Affected Versions: OpenShift Console affected versions not specified Description: A flaw was found in OpenShift Console, allowing a Server Side Request Forgery SSRF attack to occur if an attacker supplies all or part of a URL to the server to query. The server,...
PT-2024-20224 · Unknown · Lukas Bach
Name of the Vulnerable Software and Affected Versions: Lukas Bach yana version 1.0.16 Description: The issue is related to Cross Site Scripting XSS via src/electron-main.ts. Recommendations: For version 1.0.16, update to a version that is 1.0.16 or later to resolve the issue. As a temporary...
The vulnerability of Sonatype Nexus Repository Manager lies in the improper restriction of the path name to the restricted directory. This allows attackers to disclose protected information.
The vulnerability of Sonatype Nexus Repository Manager is related to incorrect restrictions on the path to the restricted-access catalog. Exploiting this vulnerability could allow a malicious actor to disclose protected information...
PT-2024-22004 · Unknown · Eskooly Free Online School Management
Name of the Vulnerable Software and Affected Versions: Eskooly Free Online School management Software versions 3.0 and earlier Description: An issue in the User Account Management component of the authentication mechanism allows a remote attacker to escalate privileges. Recommendations: For...
PT-2024-28634 · Evmos · Evmos
Name of the Vulnerable Software and Affected Versions: Evmos versions prior to 19.0.0 Description: The issue allows a user to create a vesting account with a 3rd party account as funder without its permission. This is possible because the authorization checked in the code is for the...
U.S. Dept Of Defense: Restrict any user from Login to their account
A security vulnerability was discovered where an attacker could change their email address to the victim's email, effectively restricting the victim from accessing their account. The vulnerability stemmed from improper authentication on the "Update Profile" functionality of the website...
CBL Mariner 2.0 Security Update: fuse (CVE-2018-10906)
The version of fuse installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2018-10906 advisory. - In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction bypass when...
PT-2024-37650 · Playsms · Playsms
Name of the Vulnerable Software and Affected Versions: playSMS version 1.4.3 Description: A vulnerability was found in the Template Handler component, specifically in the file /index.php?app=main&inc=feature firewall&op=firewall list. The manipulation of the id argument leads to injection. The...
CBL Mariner 2.0 Security Update: kubernetes (CVE-2023-5408)
The version of kubernetes installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-5408 advisory. - A privilege escalation flaw was found in the node restriction admission plugin of the kubernetes api serv...
PT-2024-5149
Name of the Vulnerable Software and Affected Versions: Artifex Ghostscript versions prior to 10.03.1 Artifex Ghostscript version 10.02.1 and earlier Description: The issue is related to incorrect restriction of the directory path name with limited access. Exploitation can allow a remote attacker ...
CVE-2024-20895
Improper access control in Dar service prior to SMR Jul-2024 Release 1 allows local attackers to bypass restriction for calling SDP features...
CVE-2024-20895
Improper access control in Dar service prior to SMR Jul-2024 Release 1 allows local attackers to bypass restriction for calling SDP features...
CVE-2024-20895
CVE-2024-20895 affects Samsung Mobile devices’ Dar service, where improper access control allows a local attacker to bypass restrictions on calling SDP features. The issue is tied to Dar service prior to SMR Jul-2024 Release 1 and has been addressed by updating to SMR Jul-2024 Release 1 or later....
CVE-2024-20895
Improper access control in Dar service prior to SMR Jul-2024 Release 1 allows local attackers to bypass restriction for calling SDP features...
PT-2024-18037 · Unknown · The Post Grid – Shortcode
Name of the Vulnerable Software and Affected Versions: The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid plugin versions up to, and including, 7.7.1 Description: The issue is related to Stored Cross-Site Scripting via the section title tag attribute due to insufficient...