CVE-2024-51127

CVE-2024-51127 affects hornetq-core-client in Red Hat JBoss EAP 7.x. The flaw in HornetQ’s createTempFile path allows arbitrary file overwrite or access to sensitive information. Red Hat advisories RHSA-2025:16668, RHSA-2025:16667 and RHSA-2025:3467 indicate this issue is addressed in EAP 7.1.12,...

CVE-2024-51127

An issue in the createTempFile method of hornetq v2.4.9 allows attackers to arbitrarily overwrite files or access sensitive information...

CVE-2024-51127

An issue in the createTempFile method of hornetq v2.4.9 allows attackers to arbitrarily overwrite files or access sensitive information...

CVE-2024-48270

An issue in the component /logins of oasys v1.1 allows attackers to access sensitive information via a burst attack...

Arbitrary File Read Vulnerability in KingPortal Development System Client of Beijing Asia Control Technology Development Co.

Beijing Asian Control Technology Development Co., Ltd. is a high-tech enterprise of automation software platform. There is an arbitrary file reading vulnerability in the client side of KingPortal development system of Beijing Asian Control Technology Development Co., Ltd, which can be exploited b...

ROS-20241029-12

A vulnerability in the Podman OCI container management and startup software tool is related to bugs in the option bind-propagation of the Dockerfile RUN --mount instruction. Exploitation of the vulnerability could allow an attacker to gain access to sensitive information...

Weak Password Vulnerability in the ERP System of Shanghai Qiwang Information Technology Co.

Ltd. is a company that specializes in providing high-end intelligent manufacturing management solutions for the packaging and printing industry. Ltd. ERP system has a weak password vulnerability, which can be exploited by attackers to obtain sensitive information...

CVE-2024-20403

A vulnerability in the web-based management interface of Cisco Firepower Management Center FMC Software could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface of an affected device. This vulnerability is due to insufficient...

CVE-2024-20377

CVE-2024-20377 concerns Cisco Firepower Management Center (FMC) web-based management interface. A stored XSS vulnerability arises from improper validation of user-supplied input, enabling an authenticated, remote attacker to lure a user into clicking a crafted link, which could execute arbitrary ...

CVE-2024-20300

CVE-2024-20300 affects Cisco Firepower Management Center (FMC) Software, targeting the web-based management interface. The issue is caused by insufficient validation of user-supplied input in the FMC web UI, enabling an authenticated, remote attacker to perform a cross-site scripting (XSS) attack...

CVE-2024-20512

CVE-2024-20512 concerns Cisco Unified Contact Center Management Portal (Unified CCMP). The vulnerability is a reflected cross-site scripting (XSS) flaw in the web-based management interface caused by improper validation of user input. An unauthenticated, remote attacker can lure a user to click a...

CVE-2024-46887

The web server of affected devices do not properly authenticate user request to the '/ClientArea/RuntimeInfoData.mwsl' endpoint. This could allow an unauthenticated remote attacker to gain knowledge about current actual and configured maximum cycle times as well as about configured maximum...

Information Disclosure

mantisbt/mantisbt is vulnerable to Information Disclosure. The vulnerability is due to inadequate validation of user permissions in handling requests, allows unprivileged, registered users to access and retrieve sensitive information about other users’ personal system profiles through crafted POS...

Information Disclosure

RestrictedPython is vulnerable to Information Disclosure. The vulnerability is due to the combination of the AttributeError.obj and the string module, which allows unauthorized access to sensitive information within the RestrictedPython execution environment...

CVE-2024-46635

An issue in the API endpoint /AccountMaster/GetCurrentUserInfo of INROAD before v202402060 allows attackers to access sensitive information via a crafted payload to the UserNameOrPhoneNumber parameter...

Improper Authorization

Mattermost is vulnerable to Improper Authorization. The vulnerability is due to inadequate authorization mechanisms when the viewing of archived channels is disabled, allowing unauthorized access to sensitive information...

Improper Access Control

Mautic is vulnerable to Improper Access Control. The vulnerability is due to the lack of mechanisms to verify user permissions during the update process via the user interface, allowing an attacker to access sensitive information...

CyberArk Identity Management Information Disclosure Vulnerability

CyberArk Identity Management is an identity management program from CyberArk Israel. CyberArk Identity Management has an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...

SQL Injection Vulnerability in KSOA, UFIDA's Enterprise Information Fusion Platform, UFIDA Network Technology Co. Ltd (CNVD-2024-39843)

The UFIDA KSOA is an enterprise-level application platform based on SOA architecture, aiming to provide comprehensive informatization solutions for enterprises. A SQL injection vulnerability exists in UFIDA Space-Time Enterprise Information Integration Platform KSOA, which can be exploited by an...

CyberArk Identity Management Information Disclosure Vulnerability (CNVD-2024-37457)

CyberArk Identity Management is an identity management program from CyberArk Israel. CyberArk Identity Management has an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...