CVE-2026-26416

CVE-2026-26416 認可バイパスの脆弱性による権限昇格 脆弱性の概要 Tata Consultancy Services TCS – Cognix Recon Client v3.0 において、権限昇格の脆弱性が特定されました。 この問題により、認証済みユーザーが細工したAPIリクエストを操作することで、定義されたロール境界を越えて権限を昇格させることが可能でした。 この脆弱性は、ロールベースのアクセス制御（RBAC）ロジックにおける検証の不十分さに起因し、予測可能なオブジェクト識別子が認可検証メカニズムをバイパスできる状態でした。 技術的分類（CWE） CWE-269 –...

CVE-2026-26417

CVE-2026-26417 パスワードリセット機能におけるアクセス制御の欠陥 脆弱性の概要 Tata Consultancy Services TCS – Cognix Recon Client v3.0 において、アクセス制御の欠陥が特定されました。 この問題により、認証済みユーザーが適切な認可検証なしに細工したAPIリクエストを送信することで、任意のユーザーアカウントのパスワードをリセットすることが可能となりました。 この脆弱性は、パスワードリセットワークフローにおける所有権検証の不備と認可チェックの欠如に起因します。 技術的分類 CWE CWE-862 – 認可の欠如 CWE-6...

CVE-2026-26418

CVE-2026-26418 Web APIにおける認証・認可の欠如 脆弱性の概要 Tata Consultancy Services TCS – Cognix Recon Client v3.0 のWeb API層において、認証・認可の欠如に関する脆弱性が特定されました。 特定の公開APIエンドポイントが適切な認証・認可制御を実施しておらず、適切な検証なしにアプリケーション機能へのリモートアクセスが可能となっていました。 技術的分類 CWE CWE-306 – 重要な機能に対する認証の欠如 CWE-862 – 認可の欠如 影響を受けるエンドポイント...

EUVD-2025-1540

Malicious code in bioql PyPI...

CVE-2025-0202

A vulnerability was found in TCS BaNCS 10. It has been classified as problematic. This affects an unknown part of the file /REPORTS/REPORTSSHOWFILE.jsp. The manipulation of the argument FilePath leads to file inclusion. The real existence of this vulnerability is still doubted at the moment...

SUSE CVE-2024-56649

In the Linux kernel, the following vulnerability has been resolved: net: enetc: Do not configure preemptible TCs if SIs do not support Both ENETC PF and VF drivers share enetcsetuptcmqprio to configure MQPRIO. And enetcsetuptcmqprio calls enetcchangepreemptibletcs to configure preemptible TCs...

CVE-2025-0202

A vulnerability was found in TCS BaNCS 10. It has been classified as problematic. This affects an unknown part of the file /REPORTS/REPORTSSHOWFILE.jsp. The manipulation of the argument FilePath leads to file inclusion. The real existence of this vulnerability is still doubted at the moment...

CVE-2025-0202

CVE-2025-0202 concerns TCS BaNCS 10, where the vulnerability relates to the FILE PATH parameter in the REPORTS/REPORTS_SHOW_FILE.jsp file. The root cause is manipulation of the FilePath argument that can lead to file inclusion. The real existence of this vulnerability is still doubted according t...

CVE-2025-0202 TCS BaNCS REPORTS_SHOW_FILE.jsp file inclusion

A vulnerability was found in TCS BaNCS 10. It has been classified as problematic. This affects an unknown part of the file /REPORTS/REPORTSSHOWFILE.jsp. The manipulation of the argument FilePath leads to file inclusion. The real existence of this vulnerability is still doubted at the moment...

CVE-2025-0202 TCS BaNCS REPORTS_SHOW_FILE.jsp file inclusion

A vulnerability was found in TCS BaNCS 10. It has been classified as problematic. This affects an unknown part of the file /REPORTS/REPORTSSHOWFILE.jsp. The manipulation of the argument FilePath leads to file inclusion. The real existence of this vulnerability is still doubted at the moment...

PT-2025-3775 · Tata Consultancy Services · Tcs Bancs

Name of the Vulnerable Software and Affected Versions: TCS BaNCS version 10 Description: A vulnerability was found in TCS BaNCS, affecting an unknown part of the file /REPORTS/REPORTS SHOW FILE.jsp. The manipulation of the FilePath argument leads to file inclusion. The real existence of this...

Unspecified vulnerability in Linux kernel (CNVD-2025-01678)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from an issue in the net/enetc driver that does not check for SI support when configuring preemptive TCs. No...

CVE-2022-48652 ice: Fix crash by keep old cfg when update TCs more than queues

In the Linux kernel, the following vulnerability has been resolved: ice: Fix crash by keep old cfg when update TCs more than queues There are problems if allocated queues less than Traffic Classes. Commit a632b2a4c920 "ice: ethtool: Prohibit improper channel config for DCB" already disallow setti...

myapp.tcs.com Cross Site Scripting vulnerability OBB-3494054

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2023-17953 · Google · Android Kernel

Name of the Vulnerable Software and Affected Versions: Android kernel Description: The issue is related to a heap buffer overflow in the BuildSetTcsFci function of protocolmiscbuilder.cpp, which could lead to a possible out of bounds read. This may result in local information disclosure without...

SUSE CVE-2020-24330

An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges instead of by the tss user, it fails to drop the root gid privilege when no longer needed...

tcs-org.tw Cross Site Scripting vulnerability OBB-2897172

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

tcsbiosciences.co.uk Cross Site Scripting vulnerability OBB-2144253

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

CentOS 8 : trousers (CESA-2021:1627)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:1627 advisory. - trousers: fails to drop the root gid privilege when no longer needed CVE-2020-24330 - trousers: tss user still has read and write access to the...

Denial of Service Vulnerability in Zhejiang Zhongcheng TCS-900 Security Instrumentation System

SCU9020 is the controller of TCS-900 Safety Instrumentation System of Zhejiang Zhongguang, which can be configured by the Ethernet communication module in TCS-900 Safety Instrumentation System. A denial of service vulnerability exists in the TCS-900 Safety Instrumented System of Zhejiang...