5187 matches found
CVE-2024-21031
Vulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle E-Business Suite component: LOV. Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...
CVE-2024-21115
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 7.0.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise...
CVE-2024-21112
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 7.0.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise...
CVE-2024-21114
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 7.0.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise...
CVE-2024-21100
CVE-2024-21100 affects Oracle Commerce Platform (Platform component) in Oracle Commerce, specifically versions 11.3.0–11.3.2. The root cause is insufficient input validation that allows an unauthenticated attacker with network access via HTTP to compromise the platform, potentially enabling unaut...
CVE-2024-21033
The CVE-2024-21033 issue affects Oracle E-Business Suite, specifically the Oracle Complex Maintenance, Repair, and Overhaul component LOV. Affected versions are 12.2.3–12.2.13. The root cause is insufficient input validation in LOV, enabling an unauthenticated attacker with network access via HTT...
CVE-2023-45808 iTop missing silo check on extkey in console and portal
iTop is an IT service management platform. When creating or updating an object, extkey values aren't checked to be in the current user silo. In other words, by forging an http request, the user can create objects pointing to out of silo objects for example a UserRequest in an out of scope...
CVE-2024-30614
An issue in Ametys CMS v4.5.0 and before allows attackers to obtain sensitive information via exposed resources to the error scope...
CVE-2024-30614
An issue in Ametys CMS v4.5.0 and before allows attackers to obtain sensitive information via exposed resources to the error scope...
PT-2024-23521 · Unknown · Ametys Cms
Name of the Vulnerable Software and Affected Versions: Ametys CMS versions prior to 4.5.0 Description: The issue allows attackers to obtain sensitive information via exposed resources to the error scope. Recommendations: For Ametys CMS versions prior to 4.5.0, update to a version later than 4.5.0...
Ametys CMS 安全漏洞
Ametys Cms is used by the Ametys community to run large enterprise websites, blogs, Intranet and Extranet on the same server. a free open source content management system written in Java. A security vulnerability exists in Ametys CMS v4.5.0 and earlier versions. An attacker can exploit this...
CVE-2024-28917
Azure Arc-enabled Kubernetes Extension Cluster-Scope Elevation of Privilege Vulnerability...
CVE-2024-28917 Azure Arc-enabled Kubernetes Extension Cluster-Scope Elevation of Privilege Vulnerability
...
Azure Arc-enabled Kubernetes Extension Cluster-Scope Elevation of Privilege Vulnerability
...
My Maintenance Policy
I wrote a short document describing how I maintain open source projects, to link it from my global CODEOFCONDUCT, CONTRIBUTING, and SECURITY files. It talks about how I prefer issues to PRs, how I work in batches, and how I'm trigger-happy with bans. It's all about setting expectations. It got so...
CVE-2024-2228
This vulnerability allows an authenticated user to perform a Lifecycle Manager flow or other QuickLink for a target user outside of the defined QuickLink Population...
DingFlow 安全漏洞
DingFlow is DingFlow open source is committed to helping small and medium-sized intelligent office system. DingFlow v.2.0.0 version of a security vulnerability , the vulnerability stems from the system/role/list interface of the dataScope parameter SQL injection vulnerability...
Breaking it Down: A Data-Centric Security Perspective on NIST Cybersecurity Framework 2.0
On February 26, 2024, NIST released version 2.0 of the Cybersecurity Framework. This blog reviews the fundamental changes introduced in CSF 2.0 and data-centric security considerations that should be made when aligning with the new framework. As cybercriminals become more sophisticated, efficient...
SUSE CVE-2024-1442
A user with the permissions to create a data source can use Grafana API to create a data source with UID set to . Doing this will grant the user access to read, query, edit and delete all data sources within the organization...