Siemens多款产品 缓冲区错误漏洞

S7 PCT Port Configuration Tool is a PC-based software for parameterizing Siemens IO link master modules and third-party IO link devices.Security Configuration Tool SCT is an engineering software for security devices such as the SCALANCE-S or CP 443- 1Advanced.SIMATIC Automation Tool allows...

CVE-2024-32114 Apache ActiveMQ: Jolokia and REST API were not secured with default configuration

In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context where the Jolokia JMX REST API and the Message REST API are located. It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker using Jolokia J...

The vulnerability of UEFI (BIOS) in HP workstations allows a hacker to elevate their privileges, execute arbitrary code, or cause system failures.

The vulnerability of HP workstation BIOS microprogramming software is related to security configuration errors. Exploiting this vulnerability can allow a malicious actor to enhance their privileges, execute arbitrary code, or cause service failures...

CVE-2024-22178

A file write vulnerability exists in the OAS Engine Save Security Configuration functionality of Open Automation Software OAS Platform V19.00.0057. A specially crafted series of network requests can lead to arbitrary file creation or overwrite. An attacker can send a sequence of requests to trigg...

CVE-2024-22178

A file write vulnerability exists in the OAS Engine Save Security Configuration functionality of Open Automation Software OAS Platform V19.00.0057. A specially crafted series of network requests can lead to arbitrary file creation or overwrite. An attacker can send a sequence of requests to trigg...

PT-2024-19257 · Open Automation · Open Automation Software Oas Platform

Name of the Vulnerable Software and Affected Versions: Open Automation Software OAS Platform version 19.00.0057 Description: A file write issue exists in the OAS Engine Save Security Configuration functionality. This can be triggered by a specially crafted series of network requests, leading to...

Open Automation Software OAS Platform OAS Engine Save Security Configuration file write vulnerability

Talos Vulnerability Report TALOS-2024-1951 Open Automation Software OAS Platform OAS Engine Save Security Configuration file write vulnerability April 3, 2024 CVE Number CVE-2024-22178 SUMMARY A file write vulnerability exists in the OAS Engine Save Security Configuration functionality of Open...

Vulnerability fixed in Flexera Software FlexNet Publisher

Flexera Software has fixed a vulnerability in FlexNet Publisher. A local malicious person could exploit the vulnerability to grant itself elevated privileges and execute code with elevated privileges. To exploit the vulnerability, a malicious party must load a specially prepared SSL configuration...

The vulnerability of the Code Integrity protection function of the Hypervisor-protected Code Integrity mechanism in the Windows operating system allows attackers to circumvent existing security restrictions.

The vulnerability of the Code Integrity protection function of the Hypervisor-protected Code Integrity mechanism in the Windows operating system is related to security configuration errors. Exploiting this vulnerability can allow an attacker to circumvent existing security restrictions...

The vulnerability in the implementation of the Kerberos network protocol for Windows operating systems allows attackers to circumvent security restrictions.

The vulnerability of the Kerberos network protocol implementation in Windows operating systems is related to security configuration errors. Exploiting this vulnerability can allow a malicious actor to bypass security restrictions remotely...

SSH-Private-Key-Looting-Wordlists - A Collection Of Wordlists To Aid In Locating Or Brute-Forcing SSH Private Key File Names

SSH Private Key Looting Wordlists. A Collection Of Wordlists To Aid In Locating Or Brute-Forcing SSH Private Key File Names. LFI for Lateral Movement? Gain SSH Access? ?file=../../../../../../../../home/user/.ssh/idrsa ?file=../../../../../../../../home/user/.ssh/idrsa-cert SSH Private Key...

Deserialization of untrusted data

Hertzbeat is a real-time monitoring system. At the interface of /define/yml, SnakeYAML is used as a parser to parse yml content, but no security configuration is used, resulting in a YAML deserialization vulnerability. Version 1.4.1 fixes this vulnerability...

The vulnerability of the Windows operating system’s kernel, which allows a hacker to bypass security restrictions

The vulnerability of the Windows operating system’s kernel is related to security configuration errors. Exploiting this vulnerability can allow a hacker to bypass security restrictions...

CVE-2023-6152

A user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration option "verifyemailenabled" will only validate email only on sign up...

Microsoft Edge’s vulnerability, related to security configuration errors, allows a hacker to bypass the sandbox protection mechanism and execute arbitrary code.

The vulnerability of Microsoft Edge relates to errors in security settings when processing HTML content. Exploiting this vulnerability allows a malicious actor to bypass sandbox protections and execute arbitrary code using a specially created file or web page...

The vulnerability of the isolated Sandbox software environment in the macOS operating system allows a intruder to gain unauthorized access to removable storage devices.

The vulnerability of the isolated Sandbox software environment in the macOS operating system is related to security configuration errors. Exploiting this vulnerability can allow a malicious individual to gain unauthorized access to removable storage devices...

Design/Logic Flaw

IBM Security Access Manager Container IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1 could allow a local user to escalate their privileges due to an improper security configuration. IBM X-Force ID: 254767...

CVE-2023-31005 IBM Security Access Manager Container privilege escalation

IBM Security Access Manager Container IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1 could allow a local user to escalate their privileges due to an improper security configuration. IBM X-Force ID: 254767...

CVE-2023-31005 IBM Security Access Manager Container privilege escalation

IBM Security Access Manager Container IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1 could allow a local user to escalate their privileges due to an improper security configuration. IBM X-Force ID: 254767...

BIT-LIFERAY-2023-33949

In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.2 and earlier the default configuration does not require users to verify their email address, which allows remote attackers to create accounts using fake email addresses or email addresses which they don't control. The portal property...