CVE-2024-5178 Incomplete Input Validation in SecurelyAccess API

ServiceNow has addressed a sensitive file read vulnerability that was identified in the Washington DC, Vancouver, and Utah Now Platform releases. This vulnerability could allow an administrative user to gain unauthorized access to sensitive files on the web application server. The vulnerability i...

CVE-2024-5178

CVE-2024-5178 affects ServiceNow Now Platform, where an administrative user could read sensitive files on the web application server. The vulnerability was identified in the Washington DC, Vancouver, and Utah releases and is addressed by patches and hot fixes released during the June 2024 patchin...

CVE-2024-6550

CVE-2024-6550 refers to Gravity Forms: Multiple Form Instances for WordPress. The connected Red Hat entry confirms a Full Path Disclosure in versions up to 1.1.1 caused by test files with display_errors on, allowing unauthenticated access to the web app path. Impact is Information Exposure (low c...

CVE-2024-33509

An improper certificate validation vulnerability CWE-295 in FortiWeb 7.2.0 through 7.2.1, 7.0 all versions, 6.4 all versions and 6.3 all versions may allow a remote and unauthenticated attacker in a Man-in-the-Middle position to decipher and/or tamper with the communication channel between the...

CVE-2024-33509

CVE-2024-33509 is an improper certificate validation (CWE-295) vulnerability in FortiWeb. A remote, unauthenticated attacker in a MITM position could decipher and/or tamper with the communication channel between FortiWeb and endpoints used to fetch WAF data. Affected FortiWeb versions include 6.3...

CVE-2024-30321

A vulnerability has been identified in SIMATIC PCS 7 V9.1 All versions V9.1 SP2 UC05, SIMATIC WinCC Runtime Professional V18 All versions V18 Update 5, SIMATIC WinCC Runtime Professional V19 All versions V19 Update 2, SIMATIC WinCC V7.4 All versions V7.4 SP1 Update 23, SIMATIC WinCC V7.5 All...

CVE-2024-30321

The CVE-2024-30321 issue affects Siemens SIMATIC WinCC family (PCS 7 V9.1; WinCC Runtime Professional V18/V19; WinCC V7.4/7.5/8.0) where the web interface mishandles certain requests, enabling an unauthenticated remote attacker to disclose privileged information such as users and passwords. Root ...

CVE-2024-37171

SAP Transportation Management Collaboration Portal allows an attacker with non-administrative privileges to send a crafted request from a vulnerable web application. This will trigger the application handler to send a request to an unintended service, which may reveal information about that...

Simple Online Banking System 1.0 SQL Injection Vulnerability

Exploit Title: Simple Online Banking System - SQLi Authentication Bypass Exploit Author: bRpsd Vendor Homepage: https://www.sourcecodester.com/php/14868/banking-system-using-php-free-source-code.html Software Link:...

PT-2024-4863 · Siemens · Simatic Pcs 7 +2

Name of the Vulnerable Software and Affected Versions: SIMATIC PCS 7 versions prior to V9.1 SP2 UC05 SIMATIC WinCC Runtime Professional V18 versions prior to V18 Update 5 SIMATIC WinCC Runtime Professional V19 versions prior to V19 Update 2 SIMATIC WinCC V7.4 versions prior to V7.4 SP1 Update 23...

Measuring, Communicating, and Eliminating Risk With TruRisk™ in Qualys Web Application Scanning (WAS)

In an era where cyber threats loom larger and more complex than ever, organizations demand not just defense but intelligent, cohesive strategies for managing cyber risks. With the Enterprise TruRisk Platform, Qualys reaffirmed its commitment to these needs by focusing its cybersecurity solutions ...

Simple Online Banking System 1.0 SQL Injection

Exploit Title: Simple Online Banking System - SQLi Authentication Bypass Date: 6 Jul, 2024 CVE: N/A Exploit Author: bRpsd Vendor Homepage: https://www.sourcecodester.com/php/14868/banking-system-using-php-free-source-code.html Software Link:...

RailsAdmin Security Vulnerability

RailsAdmin is a Rails engine from the US Rails team that provides an easy-to-use interface to manage your data. A security vulnerability exists in RailsAdmin that stems from incorrect escaping of the HTML title attribute...

The vulnerability of the SAP Financial Consolidation web application stems from insufficient protection of the web page structure, allowing attackers to carry out cross-site scripting attacks.

The vulnerability of the SAP Financial Consolidation web application is related to insufficient protection of the web page structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

MediaWiki 安全漏洞

MediaWiki is a suite of free and freely available web-based Wiki engines from the MediaWiki Foundation. It can be used to deploy in-house knowledge management and content management systems. MediaWiki has a security vulnerability that stems from the presence of a stored cross-site scripting XSS...

CVE-2024-5866

CVE-2024-5866 (Delinea Centrify PAS): A path traversal flaw in Centrify PAS versions prior to 23.1-HF7 can list arbitrary directories outside the web app root. The issue is mitigated by upgrading to 23.1-HF7 or later (patch available). Other details: affected product/component is Centrify PAS; ro...

CVE-2023-41923

The user management section of the web application permits the creation of user accounts with excessively weak passwords, including single-character passwords...

CVE-2023-41923 Weak Password Requirements in Kiloview P1/P2 devices

The user management section of the web application permits the creation of user accounts with excessively weak passwords, including single-character passwords...

CVE-2023-41923

CVE-2023-41923 affects Kiloview P1/P2 devices. The issue is weak password enforcement in the user management area, permitting single-character passwords. CVSS v3.1: AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N; base score 7.2 (HIGH). Connected sources describe the vulnerability as affecting Kiloview's P1/...

Security Bulletin: Vulnerability in Gunicorn affects IBM Process Mining CVE-2024-1135

Summary There is a vulnerability in Gunicorn that could allow an attacker to conduct XSS attacks on the system. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details CVEID:CVE-2024-1135 DESCRIPTION: Gunicor...