CVE-2023-47112

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In affected versions access to two URLs used in both Rundeck Open Source and Process Automation products could allow authenticated users to access the URL path, which provides a list of job names and...

Authorization

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In affected versions access to two URLs used in both Rundeck Open Source and Process Automation products could allow authenticated users to access the URL path, which would allow access to view or...

CVE-2023-47112

CVE-2023-47112 affects Rundeck (Open Source and Process Automation). Vulnerable behavior: authenticated users can access two endpoints that reveal job names and groups for any project without proper authorization. Root cause: missing/insufficient authorization checks on specific URLs (e.g., /cont...

CVE-2023-48222 Authenticated users can view or delete jobs they do not have authorization for in Rundeck

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In affected versions access to two URLs used in both Rundeck Open Source and Process Automation products could allow authenticated users to access the URL path, which would allow access to view or...

CVE-2023-48222

Summary (CVE-2023-48222) : Rundeck Open Source and Process Automation products are affected prior to version 4.17.3 . The issue allows authenticated users to access two URLs and view or delete jobs without proper authorization checks, via endpoints such as http(s)://[host]/context/rdJob/ and http...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.13.22 bug fix and security update

Red Hat OpenShift Container Platform release 4.13.22 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.13. Red Hat Product Security has rated this update as having a...

Trend Micro Apex One Local File Inclusion Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Apex One. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Apex One we...

The vulnerability of the SolarWinds Orion Platform’s network monitoring software lies in its deserialization mechanism flaws, which allows a hacker to execute arbitrary commands from the web console.

The vulnerability of the SolarWinds Orion Platform’s network monitoring software is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow a remote attacker to execute arbitrary commands from the web console...

CVE-2023-33228

The SolarWinds Network Configuration Manager was susceptible to the Exposure of Sensitive Information Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to obtain sensitive information...

Information disclosure

The SolarWinds Network Configuration Manager was susceptible to the Exposure of Sensitive Information Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to obtain sensitive information...

CVE-2023-33228 SolarWinds Network Configuration Manager Sensitive Information Disclosure Vulnerability

The SolarWinds Network Configuration Manager was susceptible to the Exposure of Sensitive Information Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to obtain sensitive information...

PT-2023-24233 · Solarwinds · Solarwinds Network Configuration Manager

Name of the Vulnerable Software and Affected Versions: SolarWinds Network Configuration Manager affected versions not specified Description: The issue allows users with administrative access to the SolarWinds Web Console to obtain sensitive information. Recommendations: At the moment, there is no...

CVE-2023-33228: Missing Encryption of Sensitive Data

The SolarWinds Network Configuration Manager was susceptible to the Exposure of Sensitive Information Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to obtain sensitive information...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.14.0 security and extras update

Red Hat OpenShift Container Platform release 4.14.0 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.14. Red Hat Product Security has rated this update as having a security impact of...

CVE-2023-35794

An issue was discovered in Cassia Access Controller 2.1.1.2303271039. The Web SSH terminal endpoint spawned console can be accessed without authentication. Specifically, there is no session cookie validation on the Access Controller; instead, there is only Basic Authentication to the SSH console...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.12.40 security and extras update

Red Hat OpenShift Container Platform release 4.12.40 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.12. Red Hat Product Security has rated this update as having a security impact of...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.13.18 security update

Red Hat OpenShift Container Platform release 4.13.18 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, whi...

CVE-2023-42787

A client-side enforcement of server-side security CWE-602 vulnerability in Fortinet FortiManager version 7.4.0 and before 7.2.3 and FortiAnalyzer version 7.4.0 and before 7.2.3 may allow a remote attacker with low privileges to access a privileged web console via client side code execution...

CVE-2023-42787

A client-side enforcement of server-side security CWE-602 vulnerability in Fortinet FortiManager version 7.4.0 and before 7.2.3 and FortiAnalyzer version 7.4.0 and before 7.2.3 may allow a remote attacker with low privileges to access a privileged web console via client side code execution...

CVE-2023-42787

A client-side enforcement of server-side security CWE-602 vulnerability in Fortinet FortiManager version 7.4.0 and before 7.2.3 and FortiAnalyzer version 7.4.0 and before 7.2.3 may allow a remote attacker with low privileges to access a privileged web console via client side code execution...