CVE-2022-43939

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2 (including 8.3.x) suffer from an authentication- bypass vulnerability due to security restrictions that use non-canonical URL paths. This CVE (CVE-2022-43939) allows bypassing authorization decisions for certain...

The vulnerability of the software platforms for developing and managing Magento Open Source and Adobe Commerce online stores lies in the lack of authentication procedures, which allow attackers to circumvent existing security restrictions.

The vulnerability of the software platforms for developing and managing Magento Open Source and Adobe Commerce online stores is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow a malicious actor to circumvent existing security restrictions remotely...

Design/Logic Flaw

Nextcloud richdocuments is a Nextcloud app integrating the office suit Collabora Online. In affected versions the secure view feature of the rich documents app can be bypassed by using unprotected internal API endpoint of the rich documents app. It is recommended that the Nextcloud Office app...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security restrictions bypass in Golang Go (CVE-2022-41716)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security restrictions bypass in Golang Go caused by improper checking for invalid environment variable values in syscall CVE-2022-41716. Golang Go is included as an operator as part of the Base OS used by o...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security restrictions bypass in Amazon AWS S3 Crypto SDK for GoLang (CVE-2020-8912)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security restrictions bypass in Amazon AWS S3 Crypto SDK for GoLang caused by a flaw in the in-band key negotiation. CVE-2020-8912. Amazon AWS S3 Crypto SDK for GoLang is included as part of the Base OS...

Security Bypass

spring-webmvc is vulnerable to Security Bypass. The vulnerability exists because using "" as a pattern in spring security configuration with the mvcRequestMatcher which creates a mismatch in pattern matching between Spring Security and Spring MVC and the potential for a security bypass...

Security Bulletin: Security bypass vulnerability in SAN Volume Controller and Storwize Family (CVE-2014-0094)

Summary Apache Struts ParametersInterceptor security bypass Vulnerability Details CVEID: CVE-2014-0094 DESCRIPTION: Apache Struts could allow a remote attacker to bypass security restrictions, caused by an error in ParametersInterceptor. An attacker could exploit this vulnerability using the clas...

Security Bulletin: Multiple vulnerabilities in Apache Tomcat affect SAN Volume Controller, Storwize family and FlashSystem V9000 products

Summary Vulnerabilities in the Apache Tomcat component affect the management GUI of SAN Volume Controller, Storwize family and FlashSystem V9000 products. The CLI interface is unaffected. The CVEs are CVE-2016-6796 CVE-2016-6816 CVE-2016-6817. Vulnerability Details CVEID: CVE-2016-6796 DESCRIPTIO...

Security Bulletin: OpenSSL vulnerability in Lenovo SAN Volume Controller and Storwize Family (CVE-2014-0224)

Summary Security Bulletin: Security bypass vulnerability in SAN Volume Controller and Storwize Family CVE-2014-0094 Vulnerability Details Security Bulletin --- Summary --- Security vulnerability in OpenSSL Vulnerability Details --- CVEID: CVE-2014-0224 DESCRIPTION : SSL/TLS MITM vulnerability An...

Security Bulletin: Multiple vulnerabilities in Apache Tomcat affect IBM SAN Volume Controller and Storwize Family

Summary Vulnerabilities in the Apache Tomcat component affect the product's management GUI. The CLI interface is unaffected. The CVEs are CVE-2015-5345 CVE-2015-5346 CVE-2015-5351 CVE-2016-0706 CVE-2016-0714 CVE-2016-0763 CVE-2015-5174. Vulnerability Details CVEID: CVE-2015-5345 DESCRIPTION: Apac...

Spring Framework is vulnerable to security bypass via mvcRequestMatcher pattern mismatch

Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass...

GHSA-7PHW-CXX7-Q9VQ Spring Framework is vulnerable to security bypass via mvcRequestMatcher pattern mismatch

Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass...

Sielco Analog FM Transmitter 2.12 Improper Access Control Change Admin Password

Summary Sielco designs and produces FM radio transmitters for professional broadcasting. The in-house laboratory develops standard and customised solutions to meet all needs. Whether digital or analogue, each product is studied to ensure reliability, resistance over time and a high standard of...

Sielco Analog FM Transmitter 2.12 'id' Cookie Brute Force Session Hijacking

Summary Sielco designs and produces FM radio transmitters for professional broadcasting. The in-house laboratory develops standard and customised solutions to meet all needs. Whether digital or analogue, each product is studied to ensure reliability, resistance over time and a high standard of...

KLA48708 DoS vulnerability in Mozilla Thunderbird

Denial of service vulnerability was found in Mozilla Thunderbird. Malicious users can exploit this vulnerability to cause denial of service. Original advisories MFSA2023-12 Related products Mozilla-Thunderbird CVE list CVE-2023-28427 critical Solution Update to the latest version Download...

The vulnerability of Adobe Experience Manager’s content and media data management system, related to the redirection of URLs to unreliable websites, allows attackers to circumvent security restrictions.

The vulnerability of the Adobe Experience Manager content and media data management system lies in the redirection of URLs to an unreliable website. Exploiting this vulnerability can allow a malicious actor to bypass security restrictions remotely...

The vulnerability of Adobe Experience Manager’s content and media data management system, related to the redirection of URLs to unreliable websites, allows attackers to circumvent security restrictions.

The vulnerability of the Adobe Experience Manager content and media data management system lies in the redirection of URLs to an unreliable website. Exploiting this vulnerability can allow a malicious actor to bypass security restrictions remotely...

The vulnerability of Adobe Experience Manager’s content and media data management system, related to the redirection of URLs to unreliable websites, allows attackers to circumvent security restrictions.

The vulnerability of the Adobe Experience Manager content and media data management system lies in the redirection of URLs to an unreliable website. Exploiting this vulnerability can allow a malicious actor to bypass security restrictions remotely...

DEBIAN-CVE-2023-20860

Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass...

UBUNTU-CVE-2023-20860

Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass...