Traccar v5 Remote Code Execution (CVE-2024-31214 and CVE-2024-24809)

Remote Code Execution in Traccar v5.1 - v5.12. Remote code execution can be obtained by combining two vulnerabilities: A path traversal vulnerability CVE-2024-24809 and an unrestricted file upload vulnerability CVE-2024-31214. By default, the application allows self-registration, enabling any use...

JetBrains YouTrack 安全漏洞

JetBrains YouTrack is a project management tool that supports cloud hosting and local deployment, and is primarily geared towards team collaboration management, especially suitable for software development, human resources, marketing, and other scenarios. JetBrains YouTrack suffers from a securit...

CVE-2024-46978

CVE-2024-46978 concerns XWiki Platform. Public documentation confirms a vulnerability where an attacker who knows another user’s notification filter ID can enable/disable or delete that filter, potentially causing the target to miss page notifications. Root cause: insufficient privilege checks wh...

CVE-2024-45606

Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user can mute alert rules from arbitrary organizations and projects with a know rule ID. The user does not need to be a member of the organization or have permissions on the project. In our review, we...

GHSA-9JMP-J63G-8X6M Withdrawn Advisory: Lunary information disclosure vulnerability

Withdrawn Advisory This advisory has been withdrawn because the lunary npm package is connected to https://github.com/lunary-ai/lunary-js, not the https://github.com/lunary-ai/lunary repo that is discussed in this advisory. The underlying vulnerability report is still valid, but it doesn't affect...

CVE-2024-6867

An information disclosure vulnerability exists in the lunary-ai/lunary, specifically in the runs/runid/related endpoint. This endpoint does not verify that the user has the necessary access rights to the runs they are accessing. As a result, it returns not only the specified run but also all runs...

CVE-2024-6867

An information disclosure vulnerability exists in the lunary-ai/lunary, specifically in the runs/runid/related endpoint. This endpoint does not verify that the user has the necessary access rights to the runs they are accessing. As a result, it returns not only the specified run but also all runs...

CVE-2024-6867 Information Disclosure in lunary-ai/lunary

An information disclosure vulnerability exists in the lunary-ai/lunary, specifically in the runs/runid/related endpoint. This endpoint does not verify that the user has the necessary access rights to the runs they are accessing. As a result, it returns not only the specified run but also all runs...

CVE-2024-27257

IBM OpenPages 8.3 and 9.0 potentially exposes information about client-side source code through use of JavaScript source maps to unauthorized users...

CVE-2024-27257 IBM OpenPages information disclosure

IBM OpenPages 8.3 and 9.0 potentially exposes information about client-side source code through use of JavaScript source maps to unauthorized users...

CVE-2024-27257

IBM OpenPages is affected (versions 8.3 and 9.0). The issue is exposure of information about client-side source code via JavaScript source maps, enabling disclosure to unauthorized users. Root cause details indicate that source maps are not required for functionality and should be disabled or fix...

Nextcloud: Share information of Tables app is not limited to affected users

The vulnerability in the Tables app in Nextcloud allowed the sharing of information with users not affected by the vulnerability...

CVE-2024-7923 Puppet-pulpcore: an authentication bypass vulnerability exists in pulpcore

An authentication bypass vulnerability has been identified in Pulpcore when deployed with Gunicorn versions prior to 22.0, due to the puppet-pulpcore configuration. This issue arises from Apache's modproxy not properly unsetting headers because of restrictions on underscores in HTTP headers,...

The vulnerability of the GLPI system for managing requests, incidents, and inventory of computer equipment is related to improper access control, allowing unauthorized users to bypass current access restrictions.

The vulnerability of the GLPI system for managing requests, incidents, and inventory of computer equipment is related to improper access control. Exploiting this vulnerability could allow a malicious actor to bypass current access restrictions...

CVE-2024-5148 Gnome-remote-desktop: inadequate validation of session agents using d-bus methods may expose rdp tls certificate

A flaw was found in the gnome-remote-desktop package. The gnome-remote-desktop system daemon performs inadequate validation of session agents using D-Bus methods related to transitioning a client connection from the login screen to the user session. As a result, the system RDP TLS certificate and...

WordPress WP GDPR Compliance Plugin Privilege Escalation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WordPress WP GDPR Compliance Plugin Privilege Escalation', 'Description' = %q The Wordpress GDPR Compliance plugin 'Mikey Veenstra WordFence',...

NetIQ Advanced Authentication Information Disclosure Vulnerability

NetIQ Advanced Authentication is an application from NetIQ UK. It provides a more secure way to protect your sensitive information by moving away from usernames and passwords. An information disclosure vulnerability exists in NetIQ Advance Authentication versions prior to 6.3.5.1, which can be...

CVE-2024-45043 OpenTelemetry Collector AWS Firehose Receiver Authentication Bypass Vulnerability

The OpenTelemetry Collector module AWS firehose receiver is for ingesting AWS Kinesis Data Firehose delivery stream messages and parsing the records received based on the configured record type. awsfirehosereceiver allows unauthenticated remote requests, even when configured to require a key...

CVE-2024-45043 OpenTelemetry Collector AWS Firehose Receiver Authentication Bypass Vulnerability

The OpenTelemetry Collector module AWS firehose receiver is for ingesting AWS Kinesis Data Firehose delivery stream messages and parsing the records received based on the configured record type. awsfirehosereceiver allows unauthenticated remote requests, even when configured to require a key...

Slackware: Security Advisory (SSA:2024-240-02)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...