An issue has been discovered in GitLab EE/CE affecting all versions from 16.9.7 prior to 17.1.7, 17.2 prior to 17.2.5, and 17.3 prior to 17.3.2. An improper input validation error allows attacker to squat on accounts via linking arbitrary unclaimed provider identities when JWT authentication is conf...
AFFECTED_PRODUCTS:
GitLab Gitlab,
GitLab Gitlab,
GitLab Gitlab
An issue has been discovered in GitLab EE affecting all versions starting from 16.11 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. Due to incomplete input filtering, it was possible to inject commands into a connected Cube server.
AFFECTED_PRODUCTS:
GitLab Gitlab,
GitLab Gitlab,
GitLab Gitlab
A server-side request forgery issue has been discovered in GitLab EE affecting all versions starting from 16.8 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. It was possible for an attacker to make requests to internal resources using a custom Maven Dependency Proxy URL
AFFECTED_PRODUCTS:
GitLab Gitlab,
GitLab Gitlab,
GitLab Gitlab
A privilege escalation issue has been discovered in GitLab EE affecting all versions starting from 16.6 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. A user assigned the Admin Group Member custom role could have escalated their privileges to include other custom roles.
AFFECTED_PRODUCTS:
GitLab Gitlab,
GitLab Gitlab,
GitLab Gitlab
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.1.7, starting from 17.2 prior to 17.2.5, starting from 17.3 prior to 17.3.2 which could cause Denial of Service via sending a specific POST request.
AFFECTED_PRODUCTS:
GitLab Gitlab,
GitLab Gitlab,
GitLab Gitlab
An improper authorization flaw exists in the Ansible Automation Controller. This flaw allows an attacker using the k8S API server to send an HTTP request with a service account token mounted via `automountServiceAccountToken: true`, resulting in privilege escalation to a service account.
An issue has been discovered in GitLab affecting all versions starting from 17.1 to 17.1.7, 17.2 prior to 17.2.5 and 17.3 prior to 17.3.2. A crafted URL could be used to trick a victim to trust an attacker controlled application.
AFFECTED_PRODUCTS:
GitLab Gitlab,
GitLab Gitlab,
GitLab Gitlab
An issue was discovered in GitLab-CE/EE affecting all versions starting with 17.0 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2. An attacker as a guest user was able to access commit information via the release Atom endpoint, contrary to permissions.
AFFECTED_PRODUCTS:
GitLab Gitlab,
GitLab Gitlab,
GitLab Gitlab
An issue has been discovered discovered in GitLab EE/CE affecting all versions starting from 15.10 before 17.1.7, all versions starting from 17.2 before 17.2.5, all versions starting from 17.3 before 17.3.2 will disclose user password from repository mirror configuration.
AFFECTED_PRODUCTS:
GitLab Gitlab,
GitLab Gitlab,
GitLab Gitlab
An issue has been discovered in GitLab EE affecting all versions starting from 11.2 before 17.1.7, all versions starting from 17.2 before 17.2.5, all versions starting from 17.3 before 17.3.2. It was possible for a guest to read the source code of a private project by using group templates.
AFFECTED_PRODUCTS:
GitLab Gitlab,
GitLab Gitlab,
GitLab Gitlab
An issue has been discovered in GitLab EE affecting all versions starting from 12.9 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2. Under certain conditions an open redirect vulnerability could allow for an account takeover by breaking the OAuth flow.
AFFECTED_PRODUCTS:
GitLab Gitlab,
GitLab Gitlab,
GitLab Gitlab
An issue was discovered in GitLab-EE starting with version 13.3 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2 that would allow an attacker to modify an on-demand DAST scan without permissions and leak variables.
AFFECTED_PRODUCTS:
GitLab Gitlab,
GitLab Gitlab,
GitLab Gitlab
Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an HTML Injection issue with Stage.
AFFECTED_PRODUCTS:
Pega Infinity
Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with case type.
AFFECTED_PRODUCTS:
Pega Infinity
Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with App name.
AFFECTED_PRODUCTS:
Pega Infinity
Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows OS Command Injection.This issue affects:
 Product
Affected Versions
LoadMaster
From 7.2.55.0 to 7.2.60.0 (inclusive)
 Â
From 7.2.49.0 to 7.2.54.11 (inclusive)
 Â
7.2...
AFFECTED_PRODUCTS:
Progress Loadmaster,
Progress Loadmaster,
Progress Loadmaster
... (+1)
Local Privilege Escalation in AVG Internet Security v24 on Windows allows a local unprivileged user to escalate privileges to SYSTEM via COM-Hijacking.
AFFECTED_PRODUCTS:
Avg Internet Security
CVE-2024-45826 IMPACT
Due to improper input validation, a path traversal and remote code execution vulnerability exists when the ThinManager® processes a crafted POST request. If exploited, a user can install an executable file.
AFFECTED_PRODUCTS:
Rockwellautomation Thinmanager,
Rockwellautomation Thinmanager
CVE-2024-45825 IMPACT
A denial-of-service vulnerability exists in the affected products. The vulnerability occurs when a malformed CIP packet is sent over the network to the device and results in a major nonrecoverable fault causing a denial-of-service.
AFFECTED_PRODUCTS:
Rockwellautomation 5015 U8ihft Firmware,
Rockwellautomation 5015 U8ihft Firmware
CVE-2024-45823 IMPACT
An
authentication bypass vulnerability exists in the affected product. The
vulnerability exists due to shared secrets across accounts and could allow a threat
actor to impersonate a user if the threat actor is able to enumerate additional
information required during authenti...
AFFECTED_PRODUCTS:
Rockwellautomation Factorytalk Batch View
ESP-NOW Component provides a connectionless Wi-Fi communication protocol. An Out-of-Bound (OOB) vulnerability was discovered in the implementation of the ESP-NOW group type message because there is no check for the addrs_num field of the group type message. This can result in memory corruption relat...
ESP-NOW Component provides a connectionless Wi-Fi communication protocol. An replay attacks vulnerability was discovered in the implementation of the ESP-NOW because the caches is not differentiated by message types, it is a single, shared resource for all kinds of messages, whether they are broadca...
AFFECTED_PRODUCTS:
Espressif Esp Now
CVE-2024-45824 IMPACT
A remote
code vulnerability exists in the affected products. The vulnerability occurs
when chained with Path Traversal, Command Injection, and XSS Vulnerabilities
and allows for full unauthenticated remote code execution. The link in the
mitigations section below contains pa...
AFFECTED_PRODUCTS:
Rockwellautomation Factorytalk View
No-IP Dynamic Update Client (DUC) v3.x uses cleartext credentials that may occur on a command line or in a file. NOTE: the vendor's position is that cleartext in /etc/default/noip-duc is recommended and is the intentional behavior.
SolarWinds Access Rights Manager (ARM) was found to be susceptible to a remote code execution vulnerability. If exploited, this vulnerability would allow an authenticated user to abuse the service, resulting in remote code execution.
AFFECTED_PRODUCTS:
Solarwinds Access Rights Manager
SolarWinds Access Rights Manager (ARM) was found to contain a hard-coded credential authentication bypass vulnerability. If exploited, this vulnerability would allow access to the RabbitMQ management console.
We thank Trend Micro Zero Day Initiative (ZDI) for its ongoing partnership in coordinating...
AFFECTED_PRODUCTS:
Solarwinds Access Rights Manager
Deserialization of untrusted data can occur in versions 2.4.0 or newer of the Cleanlab project, enabling a maliciously crafted datalab.pkl file to run arbitrary code on an end user’s system when the data directory is loaded.
A cross-site scripting (XSS) vulnerability exists in all versions of the MindsDB platform, enabling the execution of a JavaScript payload whenever a user enumerates an ML Engine, database, project, or dataset containing arbitrary JavaScript code within the web UI.
AFFECTED_PRODUCTS:
Mindsdb Mindsdb
Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when using ‘finetune’ on it.
AFFECTED_PRODUCTS:
Mindsdb Mindsdb
Deserialization of untrusted data can occur in versions 23.10.3.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when a ‘describe’ query is run on it.
AFFECTED_PRODUCTS:
Mindsdb Mindsdb
Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when used for a prediction.
AFFECTED_PRODUCTS:
Mindsdb Mindsdb
Deserialization of untrusted data can occur in versions 23.3.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded model to run arbitrary code on the server when interacted with.
AFFECTED_PRODUCTS:
Mindsdb Mindsdb
An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is installed on the server. For databases created with the SharePoint engine, an ‘INSERT’ query can be used for list item creation. If such a query...
AFFECTED_PRODUCTS:
Mindsdb Mindsdb
An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is installed on the server. For databases created with the SharePoint engine, an ‘INSERT’ query can be used for site column creation. If such a que...
AFFECTED_PRODUCTS:
Mindsdb Mindsdb
An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is installed on the server. For databases created with the SharePoint engine, an ‘INSERT’ query can be used for list creation. If such a query is s...
AFFECTED_PRODUCTS:
Mindsdb Mindsdb
An arbitrary code execution vulnerability exists in versions 23.12.4.0 up to 24.7.4.1 of the MindsDB platform, when the ChromaDB integration is installed on the server. If a specially crafted ‘INSERT’ query containing Python code is run against a database created with the ChromaDB engine, the code w...
AFFECTED_PRODUCTS:
Mindsdb Mindsdb
An arbitrary code execution vulnerability exists in versions 23.11.4.2 up to 24.7.4.1 of the MindsDB platform, when one of several integrations is installed on the server. If a specially crafted ‘UPDATE’ query containing Python code is run against a database created with the specified integration en...
AFFECTED_PRODUCTS:
Mindsdb Mindsdb
An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate integration is installed on the server. If a specially crafted ‘SELECT WHERE’ clause containing Python code is run against a database created with the Weaviate engine, the...
AFFECTED_PRODUCTS:
Mindsdb Mindsdb
Authorization Bypass Through User-Controlled Key vulnerability in Utarit Information SoliClub allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SoliClub: before 4.4.0 for iOS, before 5.2.1 for Android.
AFFECTED_PRODUCTS:
Utarit Soliclub,
Utarit Soliclub
Authorization Bypass Through User-Controlled Key, Missing Authorization vulnerability in Utarit Information SoliClub allows Retrieve Embedded Sensitive Data.
This issue affects SoliClub: before 4.4.0 for iOS, before 5.2.1 for Android.
AFFECTED_PRODUCTS:
Utarit Soliclub,
Utarit Soliclub
An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its multilabel classification tasks handle provided CSV files. If a user creates a multilabel classification task using a maliciously crafted CSV file containing Python cod...
AFFECTED_PRODUCTS:
Refuel Autolabel
An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its classification tasks handle provided CSV files. If a victim user creates a classification task using a maliciously crafted CSV file containing Python code, the code wil...
AFFECTED_PRODUCTS:
Refuel Autolabel
Possible Insertion of Sensitive Information into Log File Vulnerability
in Identity Manager has been discovered in
OpenTextâ„¢
Identity Manager REST Driver. This impact version before 1.1.2.0200.
AFFECTED_PRODUCTS:
Netiq Identity Manager Rest Driver
Possible
External Service Interaction attack
in eDirectory has been discovered in
OpenText™ eDirectory. This impact all version before 9.2.6.0000.
AFFECTED_PRODUCTS:
Microfocus Edirectory
Possible
External Service Interaction attack
in eDirectory has been discovered in
OpenText™ eDirectory. This impact all version before 9.2.6.0000.
AFFECTED_PRODUCTS:
Microfocus Edirectory
Possible Cross-Site Scripting (XSS) Vulnerability
in eDirectory has been discovered in
OpenTextâ„¢ eDirectory 9.2.5.0000.
AFFECTED_PRODUCTS:
Microfocus Edirectory
Possible Insertion of Sensitive Information into Log File Vulnerability
in eDirectory has been discovered in
OpenTextâ„¢ eDirectory 9.2.4.0000.
AFFECTED_PRODUCTS:
Microfocus Edirectory
Possible NLDAP Denial of Service attack Vulnerability
in eDirectory has been discovered in
OpenTextâ„¢
eDirectory before 9.2.4.0000.
AFFECTED_PRODUCTS:
Microfocus Edirectory
A vulnerability identified in OpenTextâ„¢
Identity Manager AzureAD Driver that allows logging of sensitive information into log file. This impacts all versions before 5.1.4.0
AFFECTED_PRODUCTS:
Opentext Identity Manager Azuread Driver
Possible
Improper Neutralization of Input During Web Page Generation Vulnerability
in eDirectory has been discovered in
OpenTextâ„¢ eDirectory 9.2.3.0000.
AFFECTED_PRODUCTS:
Microfocus Edirectory