CVE Vulnerability Catalog

IBM System Storage DS8000 in versions DS8A00 R10.1, DS8A00 R10.0, and DS8900F R9.4 may allow a local user with authorized CCW update permissions to delete or corrupt backups due to missing authorization in IBM Safeguarded Copy / GDPS Logical corruption protection mechanisms.

IBM Db2 Intelligence Center 1.1.0, 1.1.1, 1.1.2 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of server-side security mechanisms.

IBM API Connect 10.0.8.0 through 10.0.8.5, and 10.0.11.0 could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the application.

IBM Concert versions 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information from allocated memory due to improper clearing of heap memory.

IBM Concert (versions 1.0.0 through 2.1.0) is vulnerable to a stack-based buffer overflow due to improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system.

W wyniku niebezpiecznego ładowania bibliotek w oprogramowaniu Eaton UPS Companion, atakujący z dostępem do pakietu oprogramowania może wykonać dowolny kod. Problem bezpieczeństwa został naprawiony w najnowszej wersji EUC dostępnej w centrum pobierania Eaton.

The Eaton UPS Companion software installer has a vulnerability related to improper quotation in search paths, which could lead to arbitrary code execution by an attacker with access to the file system. This issue has been fixed in the latest version of EUC.

Nieprawidłowa autoryzacja plików bibliotecznych w instalatorze oprogramowania Eaton UPS Companion może prowadzić do wykonania dowolnego kodu przez atakującego mającego dostęp do pakietu oprogramowania. Problem bezpieczeństwa został naprawiony w najnowszej wersji EUC dostępnej w centrum pobierania Eaton.

The DVP-12SE device transmits sensitive information in cleartext over Modbus/TCP. Lack of encryption may expose confidential data.

Nozomi Networks Labs discovered that validation of incoming XML messages is inadequate, which could allow an attacker to perform XSS on the user's browser. The manufacturer has released a patch; refer to the manufacturer's report for details.

In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS.

Nozomi Networks Labs discovered a vulnerability in Device Manager involving a hardcoded encryption key for sensitive information. An attacker can use the key to decrypt sensitive information. The manufacturer has released a patch firmware.

Nozomi Networks Labs discovered a vulnerability in camera video analytics due to improper input validation. This could allow an attacker to execute specific commands on the user's host PC. The manufacturer has released patch firmware.

Cybersecurity Nozomi Networks Labs has discovered inadequate permission management for camera guest account. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds.

The camera's client service does not perform certificate validation, a vulnerability found by Nozomi Networks Labs. The manufacturer has released patch firmware.

In Gitea before 1.21.2, an anonymous user can visit a private user's project. This flaw violates privacy and may lead to unauthorized access to information.

Gitea before version 1.22.2 mishandles the propagation of token scope for access control within one of its own package registries.

Gitea before 1.21.8 inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order. This flaw may allow tracking of user activity.

Zidentyfikowano podatność w simstudioai sim do wersji 0.5.27, która dotyczy nieznanego kodu w pliku apps/sim/lib/auth/internal.ts komponentu CRON Secret Handler. Manipulacja argumentem INTERNAL_API_SECRET prowadzi do niewłaściwej autoryzacji, co umożliwia zdalne przeprowadzenie ataku.

Gitea before 1.22.2 allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text.