Low: Red Hat Security Advisory: rhc security update

An update for rhc is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE lin...

CVE-2024-45068

Affected products: Hitachi Ops Center Common Services (versions 10.9.3-00 to 11.0.3-00) and Hitachi Ops Center OVA (versions 10.9.3-00 to 11.0.2-01). Issue: authentication credentials leakage due to default credentials usage, enabling potential unauthorized access. Impact: confidentiality at HIGH...

CVE-2024-45068 Authentication credentials leakage vulnerability in Hitachi Ops Center Common Services within Hitachi Ops Center OVA

Authentication credentials leakage vulnerability in Hitachi Ops Center Common Services within Hitachi Ops Center OVA. This issue affects Hitachi Ops Center Common Services: from 10.9.3-00 before 11.0.3-00; Hitachi Ops Center OVA: from 10.9.3-00 before 11.0.2-01...

Hitachi Ops Center Common Services和Hitachi Ops Center OVA 安全漏洞

Hitachi Ops Center Common Services and Hitachi Ops Center OVA are both products of Hitachi, Ltd. of Japan.Hitachi Ops Center Common Services is a component that provides Ops Center products with single sign-on capabilities and a web portal. Hitachi Ops Center OVA is a virtualization solution. A...

Kolide Agent 安全漏洞

Kolide Agent Kolide Launcher is a Kolide open source lightweight agent designed to work with Kolide's services. A security vulnerability exists in Kolide Agent that stems from the inclusion of an implementation error that could lead to elevation of privilege...

PT-2024-9574 · Ruijie · Ruijie Reyee Os

Name of the Vulnerable Software and Affected Versions: Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x Description: The issue allows attackers to force Ruijie's proxy servers to perform any request the attackers choose, potentially giving them access to internal services used by...

ROS-20241203-10

Vulnerability in the IPAuthenticationProvider component of a centralized service for maintaining configuration information and providing distributed synchronization and group services. configuration, naming, providing distributed synchronization and provisioning of group services Apache ZooKeeper...

PT-2024-9532 · Hitachi · Hitachi Ops Center Common Services +1

Name of the Vulnerable Software and Affected Versions: Hitachi Ops Center Common Services versions 10.9.3-00 through 11.0.3-00 Hitachi Ops Center OVA versions 10.9.3-00 through 11.0.2-01 Description: The issue is related to the use of default credentials in Hitachi Ops Center Common Services, whi...

CVE-2024-53990

The CVE-2024-53990 issue affects the AsyncHttpClient (AHC) library where an auto-enabled CookieStore silently replaces cookies with the same name from the cookie jar. This can cause cookies from one user to be used in another user’s requests, creating potential unauthorized data exposure in multi...

CVE-2024-53990 AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. When making any HTTP request, the automatically enabled and self-managed CookieStore aka cookie jar will silently replace explicitly defined Cookies with any that ha...

WordPress FAT Services Booking plugin <= 5.6 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Dave Jong Patchstack in WordPress Plugin FAT Services Booking versions = 5.6...

WordPress FAT Services Booking plugin <= 5.6 - Subscriber+ Site-Wide Cross Site Scripting (XSS) vulnerability

Subscriber+ Site-Wide Cross Site Scripting XSS vulnerability discovered by Dave Jong Patchstack in WordPress Plugin FAT Services Booking versions = 5.6...

CVE-2024-52503 WordPress Tailored Tools plugin <= 1.8.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Tailored Web Services Tailored Tools allows Stored XSS.This issue affects Tailored Tools: from n/a through 1.8.4...

CVE-2024-10490 Authentication bypass flaw in several mapp components

An “Authentication Bypass Using an Alternate Path or Channel” vulnerability in the OPC UA Server configuration required for B&R mapp Cockpit before 6.0, B&R mapp View before 6.0, B&R mapp Services before 6.0, B&R mapp Motion before 6.0 and B&R mapp Vision before 6.0 may be used by an...

CVE-2024-10490

The CVE-2024-10490 issue affects B&R mapp Cockpit, View, Services, Motion, and Vision prior to version 6.0, due to an Authentication Bypass in the OPC UA Server configuration. The root cause is an authentication bypass that can be triggered by an unauthenticated network-based attacker, potentiall...

Server Side Request Forgery (SSRF)

github.com/openshift/console is vulnerable to Server Side Request Forgery SSRF. The vulnerability is due to the lack of proper checks on the /api/dev-console/proxy/internet endpoint, which allows authenticated users to make arbitrary HTTP requests from the console's pod to services inside the...

PT-2024-40372 · Varnish +1 · Varnish +1

Name of the Vulnerable Software and Affected Versions: ezplatform-http-cache affected versions not specified Description: The issue is related to the BREACH vulnerability, which affects HTTP compression and can allow secrets to be extracted through carefully crafted requests. This is due to...

PT-2024-16313 · B&R · B&R Mapp Vision +5

Name of the Vulnerable Software and Affected Versions: B&R mapp Cockpit versions prior to 6.0 B&R mapp View versions prior to 6.0 B&R mapp Services versions prior to 6.0 B&R mapp Motion versions prior to 6.0 B&R mapp Vision versions prior to 6.0 Description: An "Authentication Bypass Using an...

CVE-2024-53865

zhmcclient is a pure Python client library for the IBM Z HMC Web Services API. In affected versions the Python package "zhmcclient" writes password-like properties in clear text into its HMC and API logs in the following cases: 1. The 'boot-ftp-password' and 'ssc-master-pw' properties when creati...

Cross-site Scripting (XSS)

LibreNMS is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to insufficient input validation, allowing authenticated users to inject arbitrary JavaScript through the "descr" parameter when adding a service to a device in the "Services" tab of the Device page...