PT-2024-34370 · Watcharr · Watcharr

Name of the Vulnerable Software and Affected Versions: Watcharr versions 1.43.0 and below Description: A vulnerability in a weak JWT token allows attackers to perform privilege escalation using a crafted JWT token. This issue is not limited to privilege escalation but also affects all functions...

A Hacker's Guide to Password Cracking

Defending your organization's security is like fortifying a castle—you need to understand where attackers will strike and how they'll try to breach your walls. And hackers are always searching for weaknesses, whether it's a lax password policy or a forgotten backdoor. To build a stronger defense,...

CVE-2024-51504

When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authentication implemented in ZooKeeper Admin Server. Default configuration of client's IP address detection in IPAuthenticationProvider, which...

The vulnerability of the Widget API component of the JetBrains YouTrack software tool allows a hacker to perform cross-site scripting attacks.

The vulnerability of the Widget API component of the JetBrains YouTrack software suite relates to the lack of security measures for protecting the website structure. Exploiting this vulnerability could allow attackers to perform cross-site scripting attacks...

The vulnerability of the Hub Settings component of the JetBrains software for project and task management, YouTrack, allows a hacker to perform cross-site scripting attacks.

The vulnerability of the Hub Settings component in the JetBrains YouTrack project and task management software is related to the lack of protective measures for the website structure. Exploiting this vulnerability could allow attackers to perform cross-site scripting attacks...

The vulnerability of software solutions for optimizing production processes in Location Intelligence lies in the insufficient limitation on authentication attempts, allowing attackers to carry out attacks using brute-force methods.

The vulnerability of software for optimizing production processes in Location Intelligence is related to insufficient restrictions on authentication attempts. Exploiting this vulnerability allows an attacker to carry out an attack using brute-force methods...

The vulnerability of the CI/CD application integration and delivery system provided by JetBrains TeamCity, due to the lack of measures taken to protect the website structure, allows attackers to perform cross-site scripting attacks.

The vulnerability of the Continuous Integration and Deployment Application Delivery system CI/CD of TeamCity exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks by utilizing the...

The vulnerability of software for optimizing production processes in Location Intelligence, related to weak password requirements, allows attackers to gain access to confidential data.

The vulnerability of software for optimizing production processes in Location Intelligence is related to weak password requirements. Exploiting this vulnerability can allow attackers to access confidential data...

GHSA-FPM5-2WCJ-VFR7 codechecker authentication method confusion vulnerability allows logging in as the built-in root user from an external service

Summary Authentication method confusion allows logging in as the built-in root user from an external service. The built-in root user is generated in a weak manner, cannot be disabled, and has universal access. Details Until CodeChecker version 6.24.1 there was an auto-generated super-user account...

CVE-2024-10082

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication method confusion allows logging in as the built-in root user from an external service. The built-in root user up until 6.24.1 is generated in a weak manner, cannot...

The vulnerability of the /etc/defnodes/S30setnode.sh component of D-Link DSL-6740C router software allows a hacker to increase their privileges.

The vulnerability of the /etc/defnodes/S30setnode.sh component of D-Link DSL-6740C router software is related to the use of weak password requirements. Exploiting this vulnerability allows a malicious actor to gain increased privileges remotely...

Security Bulletin: IBM Sterling Control Center is vulnerable to IBM Semeru Runtime Quarterly CPU - Apr 2024 - Includes OpenJDK Apr 2024 CPU

Summary IBM Semeru Runtime Quarterly CPU - Apr 2024 is affecting Sterling Control Center v6.2.1 and v6.3.1. Vulnerability Details CVEID:CVE-2024-21085 DESCRIPTION: An unspecified vulnerability in Java SE related to the VM component could allow a remote attacker to cause low availability impacts...

freeradius: forgery attack

A vulnerability in the RADIUS Remote Authentication Dial-In User Service protocol allows attackers to forge authentication responses when the Message-Authenticator attribute is not enforced. This issue arises from a cryptographically insecure integrity check using MD5, enabling attackers to spoof...

CVE-2024-51556 Sensitive Information Disclosure Vulnerability in Wave 2.0

This vulnerability exists in the Wave 2.0 due to insufficient encryption of sensitive data received at the API response. An authenticated remote attacker could exploit this vulnerability by manipulating API input parameters through API request URL/payload leading to unauthorized access to sensiti...

CVE-2024-51556

The CVE-2024-51556 entry concerns Wave 2.0 with an issue where sensitive data is insufficiently encrypted in API responses. The vulnerability enables an authenticated remote attacker to manipulate API input parameters via the request URL/payload, potentially leading to unauthorized access to othe...

freeradius: forgery attack

A vulnerability in the RADIUS Remote Authentication Dial-In User Service protocol allows attackers to forge authentication responses when the Message-Authenticator attribute is not enforced. This issue arises from a cryptographically insecure integrity check using MD5, enabling attackers to spoof...

Brokerage Wave 加密问题漏洞

Brokerage Wave is a frontend product from Brokerage, Inc. An encryption issue vulnerability exists in Brokerage Wave version 2.0, which stems from weak encryption of sensitive data received at the API response, which could allow an attacker to manipulate the parameter userid via the API request U...

CVE-2024-51398

Altai Technologies Ltd Altai X500 Indoor 22 802.11ac Wave 2 AP web Management Weak password leakage in the background may lead to unauthorized access, data theft, and network attacks, seriously threatening network security...

CVE-2024-39650

Missing Authorization vulnerability in WPWeb Elite WooCommerce PDF Vouchers allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WooCommerce PDF Vouchers: from n/a through 4.9.4...

PT-2024-30375 · Unknown · Wptravelly

Name of the Vulnerable Software and Affected Versions: WpTravelly versions 1.7.7 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by ACLs. Recommendations: For versions 1.7.7 and earlier, update t...