Vulnerabilities fixed in SAP products

SAP has fixed vulnerabilities in several products, including SAP, Netweaver, SAP GUI and HANA. A malicious person could exploit them to carry out attacks that can lead to the following categories of damage: Cross-Site Scripting XSS. Denial-of-Service DoS. Circumvention of security measure. Remote...

KLA62824 Multiple vulnerabilities in Microsoft Products (ESU)

Multiple vulnerabilities were found in Microsoft Products Extended Security Update. Malicious users can exploit these vulnerabilities to spoof user interface, obtain sensitive information, bypass security restrictions, gain privileges, cause denial of service, execute arbitrary code. Below is a...

SAP GUI Security Vulnerability

SAP GUI is an application from SAP, a German company. graphical user interface for SAP systems. A security vulnerability exists in the SAP GUI connector for Microsoft Edge, which arises from allowing an attacker, under certain circumstances, to access highly sensitive information that would...

PT-2024-1020 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to errors in the representation of information by the user interface in the Nearby Share feature of Windows operating systems. This can allow a remote attacker to condu...

KLA62827 Multiple vulnerabilities in Microsoft Windows

Multiple vulnerabilities were found in Microsoft Windows. Malicious users can exploit these vulnerabilities to gain privileges, obtain sensitive information, bypass security restrictions, execute arbitrary code, cause denial of service, spoof user interface. Below is a complete list of...

Huawei HarmonyOS 安全漏洞

Huawei HarmonyOS is an operating system from Huawei, a Chinese company. It provides a full-scene distributed operating system based on a microkernel.Huawei EMUI is an emotional operating system developed by Huawei based on Android Android. Huawei HarmonyOS and EMUI suffer from a parameter uncheck...

CVE-2023-50921

An issue was discovered on GL.iNet devices through 4.5.0. Attackers can invoke the adduser interface in the system module to gain root privileges. This affects A1300 4.4.6, AX1800 4.4.6, AXT1800 4.4.6, MT3000 4.4.6, MT2500 4.4.6, MT6000 4.5.0, MT1300 4.3.7, MT300N-V2 4.3.7, AR750S 4.3.7, AR750...

[SECURITY] Fedora 38 Update: podman-tui-0.15.0-1.fc38

podman-tui is a terminal user interface for Podman v4. podman-tui is using podman.socket service to communicate with podman environm ent and SSH to connect to remote podman machines...

Honor Magic UI Security Flaw

Honor Magic Ui is an Android-based mobile operating system developed by Chinese company Honor. A security vulnerability exists in Honor Magic UI, which stems from the presence of a permission assignment error vulnerability, successful exploitation of which may lead to information disclosure...

Fedora: Security Advisory (FEDORA-2023-20feb865d8)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Honor Magic UI Security Flaw

Honor Magic Ui is an Android-based mobile operating system developed by Chinese company Honor. A security vulnerability exists in Honor Magic UI, which stems from the presence of a type obfuscation vulnerability, successful exploitation of which may result in a denial of service...

Fedora: Security Advisory for podman-tui (FEDORA-2023-cb8c606fbb)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Honor Magic UI Security Flaw

Honor Magic Ui is an Android-based mobile operating system developed by Chinese company Honor. A security vulnerability exists in Honor Magic UI, which stems from the presence of a permission assignment error vulnerability, successful exploitation of which may lead to information disclosure...

CVE-2022-39822

In NOKIA NFM-T R19.9, a SQL Injection vulnerability occurs in /cgi-bin/R19.9/easy1350.pl of the VM Manager WebUI via the id or host HTTP GET parameter. An authenticated attacker is required for exploitation...

CVE-2022-39818

In NOKIA NFM-T R19.9, an OS Command Injection vulnerability occurs in /cgi-bin/R19.9/log.pl of the VM Manager WebUI via the cmd HTTP GET parameter. This allows authenticated users to execute commands, with root privileges, on the operating system...

CVE-2021-38927

IBM Aspera Console 3.4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 210322...

PT-2023-14030 · Nokia · Nokia Nfm-T

Name of the Vulnerable Software and Affected Versions: NOKIA NFM-T version R19.9 Description: An issue exists in the VM Manager WebUI under the endpoint "/cgi-bin/R19.9/viewlog.pl" via the logfile parameter, allowing a remote authenticated attacker to read arbitrary files due to an Absolute Path...

PT-2023-12342 · Ibm · Ibm Aspera Console

Name of the Vulnerable Software and Affected Versions: IBM Aspera Console version 3.4.0 Description: This issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session...

Code injection

Symbolicator is a service used in Sentry. Starting in Symbolicator version 0.3.3 and prior to version 21.12.1, an attacker could make Symbolicator send GET HTTP requests to arbitrary URLs with internal IP addresses by using an invalid protocol. The responses of those requests could be exposed via...

The vulnerability of Firefox browsers, including Firefox ESR, relates to information representation errors in the user interface, which allows attackers to carry out clickjacking attacks.

The vulnerability of Firefox browsers and Firefox ESR lies in information representation errors at the user interface level. Exploiting this vulnerability allows a remote attacker to carry out a clickjacking attack...