CVE-2024-38890

An issue in Horizon Business Services Inc. Caterease Software 16.0.1.1663 through 24.0.1.2405 and possibly later versions allows a local attacker to perform an Authentication Bypass by Capture-replay attack due to insufficient protection against capture-replay attacks...

CVE-2024-38881

An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform a Rainbow Table Password cracking attack due to the use of one-way hashes without salts when storing user passwords...

Horizon Business Services Caterease 安全漏洞

Horizon Business Services Caterease is an event planning and catering software from Horizon Business Services, USA. A security vulnerability exists in Horizon Business Services Caterease versions 16.0.1.1663 through 24.0.1.2405 and later versions, which stems from the use of unsalted unidirection...

CVE-2024-32862

Under certain circumstances the ExacqVision Web Services does not provide sufficient protection from untrusted domains...

CVE-2024-32862

Under certain circumstances the ExacqVision Web Services does not provide sufficient protection from untrusted domains...

CVE-2024-32862

ExacqVision Web Service (Johnson Controls) is affected by CVE-2024-32862 due to a permissive Cross-domain Policy with Untrusted Domains in its CORS handling. The vulnerability impacts exacqVision Web Service versions prior to 24.06 (notably 22.12.1.0 per ICS alert) and could allow an attacker to ...

CVE-2024-32862 exacqVision CORS

Under certain circumstances the ExacqVision Web Services does not provide sufficient protection from untrusted domains...

CVE-2024-32862 exacqVision CORS

Under certain circumstances the ExacqVision Web Services does not provide sufficient protection from untrusted domains...

CVE-2024-32864

Under certain circumstances exacqVision Web Services will not enforce secure web communications HTTPS...

CVE-2024-32864

Under certain circumstances exacqVision Web Services will not enforce secure web communications HTTPS...

CVE-2024-32863

Under certain circumstances the exacqVision Web Services may be susceptible to Cross-Site Request Forgery CSRF...

CVE-2024-32863

Under certain circumstances the exacqVision Web Services may be susceptible to Cross-Site Request Forgery CSRF...

CVE-2024-32864 exacqVison - HTTPS Session Establishment

Under certain circumstances exacqVision Web Services will not enforce secure web communications HTTPS...

CVE-2024-32864 exacqVison - HTTPS Session Establishment

Under certain circumstances exacqVision Web Services will not enforce secure web communications HTTPS...

CVE-2024-32864

Summary: CVE-2024-32864 affects Johnson Controls exacqVision Web Service prior to version 24.06, where HTTPS is not enforced under certain conditions, enabling potential exposure of sensitive information via cleartext transmission (CWE-319). The vulnerability affects exacqVision Web Service versi...

CVE-2024-32863

Johnson Controls exacqVision Web Service is affected up to version 24.03 by a Cross-Site Request Forgery (CSRF) vulnerability (CVE-2024-32863). The issue allows performing state-changing operations with administrative privileges and has CVSSv3.1 base score 6.8 (vector: AV:N/AC:H/PR:N/UI:R/S:U/C:H...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to multiple Operator package issues

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to multiple Operator package issues. We have performed updates to the Operators used by our Speech Services. The following vulnerability has been addressed in this update. Please read the details for remediation...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to multiple Vim-minimal Package Issues (3)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to multiple Vim-minimal Package Issues. This package has been removed from the base image used by our Speech Services and the following vulnerabilities have been addressed. Please read the details for remediatio...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Bouncy Castle Crypto Package For Java [CVE-2024-29857]

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Bouncy Castle Crypto Package For Java, caused by improper input validation CVE-2024-29857. Bouncy Castle Crypto Package is used as a component of our Speech Java Microservices. This...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Bouncy Castle Crypto Package For Java [CVE-2024-30172]

Summary Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Bouncy Castle Crypto Package For Java, caused by an infinite loop in the Ed25519 verification code CVE-2024-30172. Bouncy Castle Crypto Package is used as a component...