29509 matches found
Security Bulletin: The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities disclosed in IBM Semeru Runtime
Summary The IBM SPSS Collaboration and Deployment Services using BM SDK, Java Technology Edition Quarterly CPU - Jan 2024 -Includes Oracle July 2024 CPU plus CVE-2024-27267. These vulnerabilities are addressed. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes...
Security Bulletin: The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities disclosed in IBM Semeru Runtime
Summary The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities disclosed in IBM Semeru Runtime Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products| Versions ---|--- SPSS...
D-Link Routers Incorrect Use Of Privileged APIs (CVE-2024-11068)
The D-Link DSL6740C modem has an Incorrect Use of Privileged APIs vulnerability, allowing unauthenticated remote attackers to modify any userâs password by leveraging the API, thereby granting access to Web, SSH, and Telnet services using that userâs account. Note that Nessus has not tested f...
Rapid7 Extends AWS Support to Include Coverage for Newly-Launched Resource Control Policies (RCPs)
In today’s cloud-first world, security and innovation go hand-in-hand. Rapid7 is excited to announce our support for Amazon Web Services’ AWS new Resource Control Policies RCPs, a powerful tool designed to bolster security controls for organizations using AWS infrastructure. As a launch partner f...
Ivanti Cloud Services Appliance < 4.6 patch 519 Path Traversal
Ivanti Cloud Services Appliance version prior to 4.6 patch 5.19 are affected by a vulnerability allowing an unauthenticated remote attacker to access restricted functionality via a specially crafted request No source data...
Exploit for Unrestricted Upload of File with Dangerous Type in Avaya Aura_Device_Services
CVE-2023-3722 Python POC for CVE-2023-3722 Avaya Aura Device S...
CVE-2024-51633
Cross-Site Request Forgery CSRF vulnerability in ivycat Simple Page Specific Sidebars page-specific-sidebars allows Stored XSS.This issue affects Simple Page Specific Sidebars: from n/a through = 2.14.1...
CVE-2024-50549
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Steven Nolles Bonway Static Block Editor bonway-static-block-editor allows DOM-Based XSS.This issue affects Bonway Static Block Editor: from n/a through = 1.1.0...
CVE-2024-51633
CVE-2024-51633 describes a CSRF-driven Stored XSS in WordPress plugin Simple Page Specific Sidebars (affected versions: up to 2.14.1). The vulnerability arises from CSRF in the plugin that can lead to stored XSS content. Public sources confirm the vulnerability exists through 2.14.1, with patch s...
CVE-2024-50549 WordPress Bonway Static Block Editor plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Steven Nolles Bonway Static Block Editor bonway-static-block-editor allows DOM-Based XSS.This issue affects Bonway Static Block Editor: from n/a through = 1.1.0...
CVE-2024-50549
CVE-2024-50549 is a DOM-based Cross-Site Scripting (XSS) vulnerability in WordPress plugin Bonway Static Block Editor, affecting versions up to 1.1.0 (designated as n/a through 1.1.0). The issue, described as Improper Neutralization of Input During Web Page Generation, has a CVSS v3.1 base score ...
Qualys TRU Uncovers Five Local Privilege Escalation Vulnerabilities in needrestart
The Qualys Threat Research Unit TRU has identified five Local Privilege Escalation LPE vulnerabilities within the needrestart component, which is installed by default on Ubuntu Server. These vulnerabilities can be exploited by any unprivileged user to gain full root access without requiring user...
The vulnerability in the web interface of the Cisco Identity Services Engine (ISE) management platform allows a perpetrator to gain read, modify, or delete access to data.
The vulnerability in the web interface of the Cisco Identity Services Engine ISE management platform relates to an incorrect restriction on the path name to the restricted catalog. Exploiting this vulnerability could allow a malicious actor to gain read, modify, or delete access to data by sendin...
The vulnerability in the web interface of the Cisco Identity Services Engine (ISE) management platform allows a perpetrator to perform cross-site scripting attacks.
The vulnerability in the web interface of the Cisco Identity Services Engine ISE management platform relates to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...
The vulnerability in the web interface of the Cisco Identity Services Engine (ISE) management platform allows a perpetrator to perform cross-site scripting attacks.
The vulnerability in the web interface of the Cisco Identity Services Engine ISE management platform relates to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...
PT-2024-34777 · Ivycat Web Services · Ivycat Web Services Simple Page Specific Sidebars
Name of the Vulnerable Software and Affected Versions: IvyCat Web Services Simple Page Specific Sidebars versions through 2.14.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS in IvyCat Web Services Simple Page Specific Sidebars. Recommendations:...
The vulnerability in the web interface of the Cisco Identity Services Engine (ISE) management platform allows a perpetrator to circumvent security restrictions and increase their privileges.
The vulnerability of the Cisco Identity Services Engine ISE’s web management interface is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and enhance their privileges by sending specially crafted HTTP...
The vulnerability of the NSS application library for application development in Firefox web browser and Thunderbird email client involves unlimited memory allocation. This allows attackers to access confidential data, compromise its integrity, and cause service failures.
The vulnerability of the NSS application library for application development in the Firefox web browser and Thunderbird email client involves the allocation of unlimited memory. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and...
CVE-2021-1132
A vulnerability in the API subsystem and in the web-management interface of Cisco Network Services Orchestrator NSO could allow an unauthenticated, remote attacker to access sensitive data. This vulnerability exists because the web-management interface and certain HTTP-based APIs do not properly...
CVE-2021-1132
A vulnerability in the API subsystem and in the web-management interface of Cisco Network Services Orchestrator NSO could allow an unauthenticated, remote attacker to access sensitive data. This vulnerability exists because the web-management interface and certain HTTP-based APIs do not properly...