CVE-2024-29834 Apache Pulsar: Improper Authorization For Namespace and Topic Management Endpoints

This vulnerability allows authenticated users with produce or consume permissions to perform unauthorized operations on partitioned topics, such as unloading topics and triggering compaction. These management operations should be restricted to users with the tenant admin role or superuser role. A...

CVE-2024-29834

A flaw was discovered in Apache Pulsar. This issue may allow an authenticated user with produce or consume permissions to perform unauthorized operations on partitioned topics, such as unloading topics and triggering compaction. Additionally, the authenticated user could read, create, modify, and...

CVE-2024-1973

By leveraging the vulnerability, lower-privileged users of Content Manager can manipulate Content Manager clients to elevate privileges and perform unauthorized operations...

CVE-2024-1973 Elevation of privileges vulnerability

By leveraging the vulnerability, lower-privileged users of Content Manager can manipulate Content Manager clients to elevate privileges and perform unauthorized operations...

CVE-2024-1973

CVE-2024-1973 affects OpenText Content Manager. The issue arises from insecure privilege management, allowing lower-privileged users to manipulate Content Manager clients to elevate privileges and perform unauthorized operations. Reported affected versions include Content Manager 10.0, 10.1, 23.3...

BMC Control-M Security Vulnerability

BMC Control-M is an application from BMC Corporation. Simplifies application and data workflow orchestration locally or as a service. A security vulnerability exists in BMC Control-M versions 9.0.20 and 9.0.21, which stems from an improper authorization issue in the report management and creation...

Mitel MiContact Center Business Security Breach

Mitel MiContact Center Business is an all-media contact center platform from Mitel. The platform is used in customer communication, production management and other scenarios. A security vulnerability exists in Mitel MiContact Center Business version 10.0.0.4 and prior versions, which originated...

Logic flaws exist in KingFusion control integration full configuration platform of Beijing Asian Control Technology Development Co.

Ltd. is a high-tech industrial automation and informatization software platform enterprise founded in 1997. A logic flaw exists in the KingFusion integrated control and full configuration platform of Beijing Asian Control Technology Development Co., Ltd. that can be exploited by attackers to obta...

IBM Storage Defender Privilege Mismanagement Vulnerability

IBM Storage Defender is a solution from International Business Machines IBM that provides end-to-end data resiliency. A privilege mismanagement vulnerability exists in IBM Storage Defender Connection Manager, which stems from a Resiliency Service that could allow a privileged user to perform...

PT-2025-2395 · Apache · Apache Cassandra

Name of the Vulnerable Software and Affected Versions: Apache Cassandra versions 4.0.2 through 5.0.2 Description: A local attacker without access to the Apache Cassandra process or configuration files can manipulate the RMI registry to perform a man-in-the-middle attack. This allows the attacker ...

Cisco Expressway Series Cross-Site Request Forgery Vulnerability (CNVD-2025-06741)

Cisco Expressway Series is an American Cisco software for accessing devices outside the firewall. A cross-site request forgery vulnerability exists in Cisco Expressway Series, which can be exploited by an attacker to obtain sensitive information or perform unauthorized operations...

IBM QRadar SOAR Plug-in 访问控制错误漏洞

The IBM SOAR QRadar Plugin is a tool from International Business Machines IBM used to provide bi-directional messaging between IBM Security QRadar SIEM and QRadar SOAR. An access control error vulnerability exists in the IBM SOAR QRadar Plugin App, which could be exploited by an attacker to perfo...

Logic flaw vulnerability in Damon Database Management System (DM8) of Wuhan Damon Database Co.

Damon database management system DM8 is a new generation of large-scale general-purpose relational database, fully supports SQL standards and mainstream programming language interfaces/development frameworks. Ltd. Damon Database Management System DM8 suffers from a logic flaw vulnerability, which...

Oracle E-Business Suite Security Vulnerability

Oracle E-Business Suite E-Business Suite is a set of fully integrated global business management software from Oracle Oracle. The software provides customer relationship management, service management, financial management and other functions. A security vulnerability exists in Oracle Common...

Security Vulnerabilities in Selected Oracle Products

Oracle Java SE and Oracle GraalVM are both products of Oracle Corporation.Oracle Java SE is a product for developing and deploying Java applications for desktops, servers, and embedded devices and real-time environments.Oracle GraalVM is a set of on-the-fly compilers written in the Java language...

Oracle Outside In Technology Security Vulnerability

Oracle Outside In Technology is a suite of software development kits SDKs from Oracle Corporation that provide developers with a comprehensive solution for extracting, normalizing, cleaning, converting, and viewing content in 600 unstructured file formats. A security vulnerability exists in Oracl...

GHSA-8H2X-GR2C-C275 CubeFS leaks magic secret key when starting Blobstore access service

A vulnerability was found in CubeFS that could allow users to read sensitive data from the logs which could allow them escalate privileges. CubeFS leaks configuration keys in plaintext format in the logs. These keys could allow anyone to carry out operations on blobs that they otherwise do not ha...

IBM QRadar WinCollect Agent Code Issue Vulnerability

IBM QRadar WinCollect Agent is an agent program from International Business Machines IBM for collecting and sending Windows event logs. A code issue vulnerability exists in IBM QRadar WinCollect Agent versions 10.0 through 10.1.7 that stems from improper coding. An attacker could exploit the...

Grid Plus < 1.3.3 - Subscriber+ Grid Layout Creation/Deletion/Update

Description The plugin does not properly implement capability checks on the 'gridplussavelayoutcallback' and 'gridplusdeletecallback' functions, leading to unauthorized creation, deletion and update of grid layout by any authenticated users, such as subscriber...

CVE-2023-5728

During garbage collection extra operations were performed on a object that should not be. This could have led to a potentially exploitable crash. This vulnerability affects Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4.1...