CVE-2024-44760

Incorrect access control in the component /servlet/SnoopServlet of Shenzhou News Union Enterprise Management System v5.0 through v18.8 allows attackers to access sensitive information regarding the server...

CVE-2024-22217

A Server-Side Request Forgery SSRF vulnerability in Terminalfour before 8.3.19 allows authenticated users to use specific features to access internal services including sensitive information on the server that Terminalfour runs on...

UBUNTU-CVE-2024-21127

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DDL. Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

SAP NetWeaver AS Information Disclosure Vulnerability

SAP NetWeaver AS is an SAP web application server from SAP. It not only provides network services, but also is the basic platform for SAP software. An information disclosure vulnerability exists in SAP NetWeaver AS Java GP-CORE version 7.5, which arises from an unauthenticated user being able to...

The vulnerability of the export plugin for Better PDF Exporter, a data processing center for Atlassian Jira Server and Data Center, allows a hacker to view arbitrary PDF files.

The vulnerability of the Better PDF Exporter plugin for exporting PDF files from Atlassian Jira Server and Data Center lies in insufficient testing of server-side requests. Exploiting this vulnerability could allow attackers to view arbitrary PDF files...

PT-2024-1525 · Oracle +8 · Mysql Server +7

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.35 and prior MySQL Server versions 8.2.0 and prior Description: The issue is related to insufficient input validation in the Server: DDL component of Oracle MySQL Server. It allows a high-privileged attacker with...

EFACEC UC 500 Information Disclosure Vulnerability

EFACEC UC 500 is a solution from EFACEC Portugal that provides an integrated and flexible communication gateway, automation platform and HMI solution for utility and industrial applications. The EFACEC UC 500 suffers from an information disclosure vulnerability that originates from the possibilit...

PT-2023-8109 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to a lack of protection for service data in the Windows operating system's DHCP server service. This can be exploited by a remote attacker to disclose protected...

CVE-2023-20272

A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to upload malicious files to the web root of the application. This vulnerability is due to insufficient file input validation. An attacker could exploit this...

SUSE CVE-2020-14641

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Security: Roles. Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successf...

PT-2023-5878 · Dexma · Dexgate

Name of the Vulnerable Software and Affected Versions: No specific software name and version are mentioned in the provided descriptions. Description: The affected product is vulnerable to an exposure of sensitive information to an unauthorized actor, which may allow an attacker to create maliciou...

The vulnerability of the Atlassian Confluence Server web server and the Confluence Data Center’s date center, related to errors in access management, allows a perpetrator to trigger a service failure.

The vulnerability of the Atlassian Confluence Server web server and the Confluence Data Center are related to errors in access management. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...

CVE-2023-40726

A vulnerability has been identified in QMS Automotive All versions V12.39. The affected application server responds with sensitive information about the server. This could allow an attacker to directly access the database...

New Python Variant of Chaes Malware Targets Banking and Logistics Industries

Banking and logistics industries are under the onslaught of a reworked variant of a malware called Chaes. "It has undergone major overhauls: from being rewritten entirely in Python, which resulted in lower detection rates by traditional defense systems, to a comprehensive redesign and an enhanced...

GX Software XperienCentral 安全漏洞

GX Software XperienCentral is a CMS from GX Software. A security vulnerability exists in GX Software XperienCentral version 10.36.0 and prior versions, which stems from a vulnerability that allows an unauthorized attacker to bypass security filters and place unauthorized data on the server...

CVE-2023-35927 Nextcloud system addressbooks can be modified by malicious trusted server

NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 and Nextcloud Enterprise Server versions 21.0.0 until 21.0.9.12, 22.0.0 until 22.2.10.12, 23.0.0 until...

CVE-2023-33518

emoncms v11 and later was discovered to contain an information disclosure vulnerability which allows attackers to obtain the web directory path and other information leaked by the server via a crafted web request...

Xibo 安全漏洞

Xibo is an open source content management system from Xibo Digital Signage. A security vulnerability exists in Xibo versions prior to 3.0.0 through 3.3.5, which originates from a stack trace being printed when called with missing or invalid parameters, which can be exploited by an attacker to vie...

The vulnerability of the programming software for PLCs (programmable logic controllers), namely EcoStruxure Control Expert, and the automation system for technological processes, EcoStruxure Process Expert, allows a intruder to gain unauthorized access to SMTP account data.

The vulnerability of the programming software for PLCs programmable logic controllers, as well as the EcoStruxure Process Expert automation system, is related to insufficient protection for registration data. Exploiting this vulnerability could allow attackers to gain unauthorized access to SMTP...

SAP NetWeaver AS Java Licensing Issue Vulnerability (CNVD-2023-28121)

SAP NetWeaver AS Java is a German SAP SAP company provides a Java runtime environment for the application server. The product is mainly used to develop and run Java EE applications. An authorization issue vulnerability exists in SAP NetWeaver AS Java version 7.50, which stems from a failure to...