Security update for virtualbox (important)

openSUSE Security Update: Security update for virtualbox Announcement ID: openSUSE-SU-2024:0364-1 Rating: important References: 1231225 1231735 1231736 1231737 1231738 Cross-References: CVE-2024-21248 CVE-2024-21259 CVE-2024-21263 CVE-2024-21273 Affected Products: openSUSE Backports SLE-15-SP6...

Internet Bug Bounty: Secrets not masked in UI when sensitive variables are set via Airflow cli

A vulnerability was discovered in Apache Airflow where sensitive variables set using the Airflow CLI were not properly masked in the UI, specifically in the Audit logs page. This issue was addressed in the 2.10.3 release of Apache Airflow...

Devtron SQL injection vulnerability

Devtron is a Kubernetes cloud-native tool integration platform open-sourced by Devtron. A SQL injection vulnerability exists in Devtron prior to version 0.7.2, which stems from an authenticated user being able to execute malicious SQL queries via the CreateUser interface...

Huawei HarmonyOS/EMUI Cross-Border Access Vulnerability

Huawei EMUI and Huawei HarmonyOS are both products of the Chinese company Huawei Huawei.Huawei EMUI is a mobile operating system based on Android development.Huawei HarmonyOS is an operating system. Provides a full-scenario distributed operating system based on a microkernel. An out-of-bounds...

Firefox Screenshot Data Compromise

The vulnerability in the Firefox web browser’s screenshot creation function is related to an incorrect limitation on the visible layers of the user interface. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of data...

CVE-2024-20525

A vulnerability in the web-based management interface of Cisco ISE could allow an unauthenticated, remote attacker to conduct an XSS attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An...

CVE-2024-20538

CVE-2024-20538 concerns Cisco Identity Services Engine (ISE) web-based management interface. Documents confirm a cross-site scripting (XSS) vulnerability in the ISE web UI caused by insufficient input validation, enabling an unauthenticated, remote attacker to entice a user to click a crafted lin...

CVE-2024-20511 Cisco Unified Communications Manager Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Communications Manager Unified CM and Cisco Unified Communications Manager Session Management Edition Unified CM SME could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user o...

CVE-2024-20504 Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance Stored Cross-Site Scripting Vulnerabilities

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface...

CVE-2024-34677

Exposure of sensitive information in System UI prior to SMR Nov-2024 Release 1 allow local attackers to make malicious apps appear as legitimate...

Cisco IP Phone Cross-site Scripting Vulnerability

The Cisco IP Phone is a hardware device from Cisco, Inc. IP Phone that provides calling capabilities. The Cisco IP Phone suffers from a cross-site scripting vulnerability that stems from the affected device's WebUI not properly validating user-supplied input. An authenticated, remote attacker cou...

TwinCAT Package Manager Arbitrary Command Execution

The vulnerability of the TwinCAT Package Manager’s user interface is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows an attacker to execute arbitrary commands...

IBM Maximo Application Suite Cross-site Scripting Vulnerabilities

IBM Maximo Application Suite is a single platform for intelligent asset management, monitoring, maintenance, computer vision, security and reliability from International Business Machines IBM. A cross-site scripting vulnerability exists in IBM Maximo Application Suite. The vulnerability stems fro...

Cisco IP Phone information leakage vulnerability

Cisco IP Phone is a hardware device from the American company Cisco Cisco. IP Phone that provides calling capabilities. The Cisco IP Phone suffers from an information disclosure vulnerability that stems from improper storage of sensitive information in the Web UI of the Session Initiation Protoco...

Cisco IP Phone Cross-site Scripting Vulnerability

Cisco IP Phone is a hardware device from the American company Cisco Cisco. IP Phone that provides calling capabilities. The Cisco IP Phone suffers from a cross-site scripting vulnerability that stems from the affected device's WebUI not properly validating user-supplied input. An authenticated,...

Huawei HarmonyOS and Huawei EMUI security vulnerabilities

Huawei EMUI and Huawei HarmonyOS are both products of the Chinese company Huawei Huawei.Huawei EMUI is a mobile operating system based on Android development.Huawei HarmonyOS is an operating system. Provides a full-scenario distributed operating system based on a microkernel. Huawei HarmonyOS and...

Huawei HarmonyOS and EMUI security vulnerabilities

Huawei EMUI is a mobile operating system developed based on Android.Huawei HarmonyOS is an operating system. Provides a full-scene distributed operating system based on a microkernel. A launcherAnyWhere vulnerability exists in the Huawei HarmonyOS and EMUI account module, which can be exploited b...

RHEL 5 : Red Hat Certificate System 8 (RHSA-2017:2560)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:2560 advisory. Red Hat Certificate System is a complete implementation of an enterprise software system designed to manage enterprise public key infrastructure PKI...

CVE-2024-41745

IBM CICS TX Standard is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

PT-2024-29551 · Ibm · Ibm Cics Tx Standard

Name of the Vulnerable Software and Affected Versions: IBM CICS TX Standard affected versions not specified Description: The issue allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI, potentially altering the intended functionality and leading to credentials...