5184 matches found
BIT-ENVOY-2023-35942 Envoy's gRPC access log crash caused by the listener draining
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, gRPC access loggers using listener's global scope can cause a use-after-free crash when the listener is drained. Versions 1.27.0, 1.26.4, 1.25.9,...
BIT-CONCOURSE-2022-31683
Concourse 7.x.y prior to 7.8.3 and 6.x.y prior to 6.7.9 contains an authorization bypass issue. A Concourse user can send a request with body including :teamname=team2 to bypass team scope check to gain access to certain resources belong to any other team...
NIST Cybersecurity Framework 2.0
NIST has released version 2.0 of the Cybersecurity Framework: The CSF 2.0, which supports implementation of the National Cybersecurity Strategy, has an expanded scope that goes beyond protecting critical infrastructure, such as hospitals and power plants, to all organizations in any sector. It al...
Microsoft boosts its Microsoft 365 Insider Builds on Windows Bounty Program with higher awards and an expanded scope
Starting today, we are doubling the maximum bounty award for the Microsoft 365 Insider Bug Bounty Program to $30,000 USD for high impact scenarios, such as unauthenticated non-sandboxed code execution with no user interaction. We are also expanding the scope of our bounty program to include more...
CVE-2024-27089
Rejected reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not in the allowed scope of that CNA's CVE ID assignments...
PT-2024-21640 · Undefined · Undefined
Name of the Vulnerable Software and Affected Versions: No vulnerable software or affected versions specified. Description: A candidate was withdrawn by its CNA due to being out of scope for their CVE ID assignments. Recommendations: At the moment, there is no information about a newer version tha...
CVE-2024-25288
SLIMS Senayan Library Management Systems 9 Bulian v9.6.1 is vulnerable to SQL Injection via pop-scope-vocabolary.php...
Sql injection
SLIMS Senayan Library Management Systems 9 Bulian v9.6.1 is vulnerable to SQL Injection via pop-scope-vocabolary.php...
CVE-2024-25288
SLIMS Senayan Library Management Systems 9 Bulian v9.6.1 is vulnerable to SQL Injection via pop-scope-vocabolary.php...
SLiMS 9 Bulian Security Vulnerability
SLiMS 9 Bulian is a free and open source software from the SLiMS community in Indonesia. It is used for library resource management e.g. books, journals, digital files and other library materials and administration. A security vulnerability exists in SLiMS 9 Bulian version v9.6.1, which stems fro...
PT-2024-20862 · Slims · Slims
Name of the Vulnerable Software and Affected Versions: SLIMS Senayan Library Management Systems 9 Bulian version 9.6.1 Description: The issue is related to SQL Injection via the pop-scope-vocabolary.php file. This allows for potential exploitation. No information is provided about the estimated...
Mozilla: IDOR on Delete Email address features
An insecure direct object reference vulnerability was found in a web application which allowed users to delete email addresses in other users' accounts by manipulating identifiers. The issue was mitigated by adding proper access controls on the delete operation...
zephyr Security Breach
Zephyr is an extensible real-time operating system RTOS open-sourced by the Zephyr Project. A security vulnerability exists in zephyr 3.5 and earlier versions, which stems from the removerxfilter function being out of scope...
CVE-2024-20986
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server...
CVE-2024-20958
Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite component: Engineering Change Order. Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Installed...
CVE-2024-20941
Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite component: HTML UI. Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Installed Base. Successful...
PT-2024-20761 · Typo3 · Typo3
Name of the Vulnerable Software and Affected Versions: TYPO3 versions prior to 8.7.57 ELTS TYPO3 versions prior to 9.5.46 ELTS TYPO3 versions prior to 10.4.43 ELTS TYPO3 versions prior to 11.5.35 LTS TYPO3 versions prior to 12.4.11 LTS TYPO3 versions prior to 13.0.1 Description: The TYPO3-specifi...
kernel: sctp: fail if no bound addresses can be used for a given scope
A memory leak flaw was found in the Linux kernel's Stream Control Transmission Protocol. This issue may occur when a user starts a malicious networking service and someone connects to this service. This could allow a local user to starve resources, causing a denial of service...