4074 matches found
Vulnerability in License Server and Snap-in for Desktop Studio, aka Heartbleed
Secure Configuration of Licensing Heartbleed Update In response to the recent Heartbleed vulnerability in OpenSSL CVE-2014-0160 Citrix released a security advisory, CTX140605, advising customers of its potential effects on some Citrix Licensing components. As part of the Citrix response to this...
The vulnerability of the WSDL query processor in the “Update Service” software allows a attacker to gain read access to local files.
The vulnerability of the WSDL query processor in the “Update Service” software is related to an incorrect limitation on the path name to the directory. Exploiting this vulnerability could allow a malicious actor to gain read access to local files...
Microsoft WS-Discovery Security Vulnerability
Microsoft WS-Discovery is a web-based protocol from Microsoft Corporation USA. A security vulnerability exists in Microsoft WS-Discovery. An attacker has exploited the vulnerability to cause a denial of service on the system. The following products and editions are affected:Windows 10 Version 180...
CVE-2024-4836
Web services managed by Edito CMS Content Management System in versions from 3.5 through 3.25 leak sensitive data as they allow downloading configuration files by an unauthenticated user. The issue in versions 3.5 - 3.25 was removed in releases which dates from 10th of January 2014. Higher versio...
CVE-2024-4836 LFI in sites managed by Edito CMS
Web services managed by Edito CMS Content Management System in versions from 3.5 through 3.25 leak sensitive data as they allow downloading configuration files by an unauthenticated user. The issue in versions 3.5 - 3.25 was removed in releases which dates from 10th of January 2014. Higher versio...
CVE-2024-4836
Edito CMS Web services expose a sensitive data leak in versions 3.5–3.25 by allowing unauthenticated download of configuration files. The issue was fixed in releases after January 10, 2014; higher versions were never affected. Remediation: update to a version later than 3.25. No exploitation deta...
CVE-2024-4836 LFI in sites managed by Edito CMS
Web services managed by Edito CMS Content Management System in versions from 3.5 through 3.25 leak sensitive data as they allow downloading configuration files by an unauthenticated user. The issue in versions 3.5 - 3.25 was removed in releases which dates from 10th of January 2014. Higher versio...
PT-2024-28699 · Internet2 · Grouper For Web Services +1
Name of the Vulnerable Software and Affected Versions: Internet2 Grouper versions prior to 5.6 Grouper for Web Services versions prior to 4.13.1 Description: The issue allows authentication bypass when LDAP authentication is used in certain ways. This is related to the...
CVE-2024-39848
Internet2 Grouper before 5.6 allows authentication bypass when LDAP authentication is used in certain ways. This is related to internet2.middleware.grouper.ws.security.WsGrouperLdapAuthentication and the use of the UyY29r password for the M3vwHr account. This also affects "Grouper for Web Service...
CVE-2024-39848
Internet2 Grouper versions prior to 5.6 and Grouper for Web Services before 4.13.1 are vulnerable to an authentication bypass when LDAP authentication is used in specific ways. The root cause is located in the internet2.middleware.grouper.ws.security.WsGrouperLdapAuthentication class and involves...
Malicious code in aws-upload (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in aws-blue_green_deploy (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in Be.Vlaanԁeren.Basіsregisters.Aws.DistrіbuteԁMutex (NuGet)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in Be.Vlaaոderen.Basisregisters.Aws.DistribսtedS3Cache (NuGet)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in aws-ecs-devops-using-aws-cdk (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in @terraform-aws-github-runner/aws-powertools-util (npm)
--- -= Per source details. Do not edit below this line.=-...
The vulnerability of Apache CXF web services arises from insufficient validation of user input data, allowing attackers to execute SSRF attacks.
The vulnerability of Apache CXF web services arises due to insufficient validation of data entered by users through Aegis DataBinding. Exploiting this vulnerability can allow a malicious actor to perform an SSRF attack remotely...
CVE-2023-46674
A flaw was found in elasticsearch-hadoop that allowed the unsafe deserialization of Java objects from Hadoop or spark configuration properties that could have been modified by authenticated users. Unsafe deserialization may impact integrity by allowing an attacker to modify unexpected objects or...
Malicious code in aws-public (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b192498364ed7190f44f00a98983087f969407bd217eadfed1c6353335eda7f7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2024-37163 SkyScrape Secure API Requests
SkyScrape is a GUI Dashboard for AWS Infrastructure and Managing Resources and Usage Costs. SkyScrape's API requests are currently unsecured HTTP requests, leading to potential vulnerabilities for the user's temporary credentials and data. This affects version 1.0.0...