OpenText Directory Services 安全漏洞

OpenText Directory Services OTDS is an information management solution from OpenText USA, Inc. integrates OpenText products and solutions with the company's enterprise directory infrastructure. A security vulnerability exists in OpenText Directory Services version 24.2 that stems from improper...

Malicious code in @mentoring-services/sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6248cce7fe3e50ce8c9fe940f959d883f287bff1a15d23813fa4dad7f960a486 The OpenSSF Package Analysis project identified '@mentoring-services/sdk' @ 10.20.0 npm as malicious. It is considered malicious because: - The...

MAL-2024-7802 Malicious code in @mentoring-services/sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6248cce7fe3e50ce8c9fe940f959d883f287bff1a15d23813fa4dad7f960a486 The OpenSSF Package Analysis project identified '@mentoring-services/sdk' @ 10.20.0 npm as malicious. It is considered malicious because: - The...

Important: Red Hat Enhancement Advisory: Red Hat Service Interconnect 1.4.7 Release rpms

This is release 1.4 of the rpms for Red Hat Service Interconnect. Red Hat Service Interconnect 1.4 introduces a service network, linking TCP and HTTP services across the hybrid cloud. A service network enables communication between services running in different network locations or sites. It allo...

VulnCheck KEV: CVE-2023-21932

Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications component: OXI. The supported version that is affected is 5.6. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle...

Security Bulletin: IBM Match 360 is vulnerable to cross-site scripting from IBM WebSphere Application Server Liberty (CVE-2024-27270)

Summary IBM Match 360 is vulnerable to cross-site scripting due to a vulnerability found in IBM WebSphere Application Server Liberty. IBM WebSphere Application Server Liberty 23.0.0.3 through 24.0.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary...

Cisco Identity Services Engine File Upload Vulnerability

Cisco Identity Services Engine Cisco ISE is an environment-aware platform ISE Identity Services Engine from Cisco. The platform collects real-time information from the network, users, and devices, and develops and enforces policies to regulate the network. A file upload vulnerability exists in th...

RICOH Printers Multiple Vulnerabilities (ricoh-2024-000003)

Multiple RICOH printers and multifunction printers are prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data v4.8.5 is affected by a arbitrary code execution in OpenSSH server [CVE-2024-6387]

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data v4.8.5 is affected by arbitrary code execution in OpenSSH server, caused by a signal handler race condition CVE-2024-6387. Open SSH is a component of a glibc library that is included in our Speech Service Runtimes, but not...

CVE-2024-41178

Exposure of temporary credentials in logs in Apache Arrow Rust Object Store objectstore crate, version 0.10.1 and earlier on all platforms using AWS WebIdentityTokens. On certain error conditions, the logs may contain the OIDC token passed to AssumeRoleWithWebIdentity...

httpd: Encoding problem in mod_proxy

A flaw was found in the modproxy module of httpd. Due to an encoding problem, specially crafted request URLs with incorrect encoding can be sent to backend services, potentially bypassing authentication...

Mozilla: Memory corruption in NSS

The Mozilla Foundation Security Advisory describes this flaw as: A mismatch between allocator and deallocator could have lead to memory corruption...

USN-6896-5: Linux kernel vulnerabilities

It was discovered that the ATA over Ethernet AoE driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. CVE-2023-6270 It was discovered that the Atheros 802.11ac...

Apache CXF Memory Consumption Vulnerability

Apache CXF is the United States Apache Apache Foundation of an open source Web services framework. The framework supports a variety of Web services standards , a variety of front-end programming APIs. Apache CXF has a memory consumption vulnerability that originates from a client-side pipeline th...

The vulnerability of the development package for integrating cloud services and communication functions in IoT devices. The Kalay SDK is a microprogramming software for video surveillance cameras such as Owlet Cam v1, Owlet Cam v2, Wyze Cam v3, and Roku Indoor Camera SE. This vulnerability stems from insufficient data authentication checks, allowing unauthorized access by intruders to protected information.

The vulnerability of the development package for integrating cloud services and communication functions in IoT devices is related to insufficient data authentication checks. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information. This vulnerabilit...

Mozilla: Memory corruption in NSS

The Mozilla Foundation Security Advisory describes this flaw as: A mismatch between allocator and deallocator could have lead to memory corruption...

Ivanti EPM Cloud Services Appliance < 4.6.0-512 Remote Code Execution

Ivanti EPM Cloud Services Appliance versions prior to 4.6.0-512 is affected by a vulnerability allowing an unauthenticated attacker to execute remote code via a specially forged request with limited permissions nobody. No source data...

The vulnerability of the Single Sign-On module for application-based SAML protocols in the Apache CloudStack software, which is used for creating, managing, and deploying infrastructure cloud services, allows a perpetrator to bypass authentication processes and gain full access to any user’s account.

The vulnerability of the Single Sign-On module for application-based SAML programs involved in creating, managing, and deploying infrastructure cloud services like Apache CloudStack relates to the bypassing of authentication processes through spoofing. Exploiting this vulnerability allows a...

PT-2024-37982 · Zhongbangkeji · Crmeb

Name of the Vulnerable Software and Affected Versions: ZhongBangKeJi CRMEB versions up to 5.4.0 Description: A critical issue has been found, affecting the function downloadImage of the file app/services/product/product/CopyTaobaoServices.php. This issue leads to deserialization and can be...

Global IT Outage Causes Travel and Service Chaos: A Comprehensive Overview

A massive IT outage is sending shockwaves across the globe, leading to significant disruptions in travel, banking, and healthcare services. The chaos originated from two distinct issues: a misconfiguration that caused a Microsoft Azure service outage and a defective update in Crowdstrike's Falcon...