IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 have a vulnerability where a remote authenticated attacker can bypass security restrictions due to the absence of the X-Content-Type-Options header, which allows MIME type sniffing. This vulnerability has a medium severity with a CVSS score of 5.4. No patch or remediation information is provided.
IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 contain a vulnerability that allows a remote authenticated attacker to perform HTTP response splitting due to improper neutralization of HTTP headers. This flaw can be exploited to manipulate HTTP responses, potentially leading to web cache poisoning or cross-user attacks. The vulnerability has a medium severity rating with a CVSS score of 4.3.
IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 contain a vulnerability where TLS certificate validation is improperly implemented. This flaw could allow an attacker to perform a man-in-the-middle attack and obtain sensitive information. The vulnerability has a medium severity rating with a CVSS score of 5.9.
vtenext versions prior to 25.02.2 contain an SQL injection vulnerability in the modules/Fax/EditView.php component. This flaw allows authenticated users with low privileges to inject SQL via a crafted fieldname parameter. Exploitation can lead to unauthorized reading of database contents, including sensitive password reset tokens, enabling account takeover of other users.
IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 contain a vulnerability where remote authenticated attackers can obtain sensitive information. This occurs due to error messages that expose internal implementation details. The vulnerability has a medium severity with a CVSS score of 4.3.
IBM MQ versions 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD contain a vulnerability that allows an authenticated attacker to execute arbitrary code on consumer applications. This occurs due to insecure deserialization of ObjectMessage payloads.
IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 have a vulnerability that allows a remote authenticated attacker to bypass security restrictions due to the absence of a Content Security Policy header. This issue has a low severity rating and does not impact system integrity or availability.
IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 contain a vulnerability that allows a local attacker to cause a denial of service by consuming resources uncontrollably. The issue does not impact confidentiality or integrity but affects availability. The vulnerability has a low severity score and no known exploits in the wild. No patch or remediation information is currently provided.
IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 contain a vulnerability that allows a remote authenticated attacker to bypass security restrictions due to improper access control. The flaw impacts the integrity of the system but does not affect confidentiality or availability. No patch or remediation information is currently provided.
vtenext versions prior to 25.02.2 have a vulnerability where the PHPSESSID session identifier is disclosed via the Touch web service endpoint. This exposure allows attackers who can execute scripts within the vtenext origin, such as through cross-site scripting (XSS), to bypass the HttpOnly flag and hijack authenticated sessions.
A critical authentication bypass vulnerability exists in Linksys E5350 version 1.0.00.037 in the Setup Wizard component. The flaw is triggered by manipulating the wizard_router_pwd argument in the save_settings function of /wizard/apply.cgi. This vulnerability can be exploited remotely without authentication, potentially allowing full compromise. Public exploit code is available, but the vendor has not responded or issued a patch.
Sonatype Nexus Repository 3 contains a vulnerability where it does not require realm administration permission when a user creates a Rut Auth capability. This allows a user with only the capability creation permission to enable header-based authentication, enabling remote clients to authenticate as any existing user, including administrators, without credentials.
The WPO365 | LOGIN (wpo365-login) plugin before version 45.2 has an authentication bypass vulnerability due to a capture-replay flaw. This occurs because the anti-replay check in the Saml2_Service::check_message_id() function does not persist processed SAML message IDs, allowing attackers to reuse a valid SAMLResponse multiple times within its validity window to log in as the victim, including administrators.
vtenext versions prior to 25.02.2 have a reflected cross-site scripting (XSS) vulnerability in the HomeWidgetBlockList.php module. This flaw arises because unsanitized widgetId keys from the widgetInfoList JSON parameter are echoed back, allowing attackers to inject malicious HTML/JavaScript. Exploitation requires a logged-in user to submit a crafted POST request, which then executes JavaScript in the victim's session.
vtenext versions before 25.02.2 have a vulnerability where the CSRF protection mechanism can be bypassed. The function csrf_check() in include/utils/VteCsrf.php does not validate the __csrf_token for non-POST requests, allowing attackers to trick logged-in users into executing state-changing GET requests. This can lead to unauthorized actions performed with the user's privileges.
Sonatype Nexus Repository 3 has a vulnerability where it exposes the signing passphrase of an APT or YUM repository through an internal REST endpoint. This exposure occurs even to user accounts with only read privileges for administering the repository, without requiring edit privileges.
Sonatype Nexus Repository 3 Pro has a vulnerability where it does not verify the local account status when users authenticate via configured SAML or OAuth2/OpenID Connect identity providers. This allows users whose local accounts are disabled or locked to regain access if they have valid credentials at the identity provider, receiving a new session with their assigned roles.
Sonatype Nexus Repository 3 has an authorization bypass vulnerability where a user with valid credentials and add or edit privileges on a group repository can add a repository they are not authorized to access. This allows the user to read content from that unauthorized repository via the group repository. Anonymous users can only exploit this if explicitly granted the necessary privileges by an administrator.
Sonatype Nexus Repository 3 has a SQL injection vulnerability in the optional "Reindex Search Tables By Pattern" task. This task is only available if the non-default setting nexus.reindex.search.by.pattern.visible is enabled. A user with the nexus:tasks:create privilege can supply a crafted filter condition that is executed as SQL, allowing modification of the Nexus database.
Sonatype Nexus Repository 3 has a vulnerability where an account with only read privileges on a YUM proxy or group repository can obtain the private signing key of that repository. This key allows the holder to sign repository metadata, potentially compromising repository integrity. The vulnerability does not require edit privileges, only read access.