9532, 2591 Security Vulnerabilities

RHEL 5 : libtiff (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. libtiff: Heap-based buffer over-read in bmp2tiff (CVE-2017-9117) Heap-based buffer overflow in the...

RHEL 7 : libtiff (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. libtiff: Heap-based buffer over-read in bmp2tiff (CVE-2017-9117) Heap-based buffer overflow in the...

RHEL 6 : libtiff (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. libtiff: Heap-based buffer over-read in bmp2tiff (CVE-2017-9117) Heap-based buffer overflow in the...

RHEL 6 / 7 : rh-mysql56-mysql (RHSA-2018:0587)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0587 advisory. mysql: Server: Partition unspecified vulnerability (CPU Jan 2018) (CVE-2018-2562) mysql: Server: GIS unspecified vulnerability (CPU...

CVE-2024-2591

Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/modules/book/main/bookdetail_group.php, in multiple parameters. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the...

CVE-2024-2591 SQL injection vulnerability in AMSS++

Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/modules/book/main/bookdetail_group.php, in multiple parameters. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the...

Huawei EulerOS: Security Advisory for ntp (EulerOS-SA-2023-2591)

The remote host is missing an update for the Huawei...

EulerOS 2.0 SP9 : ntp (EulerOS-SA-2023-2591)

According to the versions of the ntp package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write in the...

Cross site scripting

The Editorial Calendar WordPress plugin before 3.8.3 does not sanitise and escape its settings, allowing users with roles as low as contributor to inject arbitrary web scripts in the plugin admin panel, enabling a Stored Cross-Site Scripting vulnerability targeting higher privileged...

CVE-2022-4115

The Editorial Calendar WordPress plugin before 3.8.3 does not sanitise and escape its settings, allowing users with roles as low as contributor to inject arbitrary web scripts in the plugin admin panel, enabling a Stored Cross-Site Scripting vulnerability targeting higher privileged...

FLEX Denial Of Service

...

FLEX 1080 < 1085 Web 1.6.0 - Denial of Service

...

FLEX 1080 < 1085 Web 1.6.0 - Denial of Service Exploit

...

teampass vulnerable to code injection

In nilsteampassnet/teampass prior to 3.0.7, if two users have the same folder access, malicious users can create an item where its label field is vulnerable to HTML injection. When other users see that item, it may force them to redirect to the attacker's website or capture their data using a...

teampass vulnerable to code injection

In nilsteampassnet/teampass prior to 3.0.7, if two users have the same folder access, malicious users can create an item where its label field is vulnerable to HTML injection. When other users see that item, it may force them to redirect to the attacker's website or capture their data using a...

CVE-2023-2591

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitHub repository nilsteampassnet/teampass prior to...

CVE-2023-2591

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitHub repository nilsteampassnet/teampass prior to...

Cross site scripting

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitHub repository nilsteampassnet/teampass prior to...

CVE-2023-2591 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in nilsteampassnet/teampass

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitHub repository nilsteampassnet/teampass prior to...

TeamPass < 3.0.7 Multiple Vulnerabilities

TeamPass is prone to multiple...

Stored HTML Injection in Item Label

Description If two users have the same folder access, malicious users can create an item where its label field is vulnerable to HTML injection. When other users see that item, it may force them to redirect to the attacker's website or capture their data using a form. # Proof of Concept ```...

CVE-2023-29489

An issue was discovered in cPanel before 11.109.9999.116. XSS can occur on the cpsrvd error page via an invalid webcall ID, aka SEC-669. The fixed versions are 11.109.9999.116, 11.108.0.13, 11.106.0.18, and 11.102.0.31. Recent assessments: cbeek-r7 at October 17, 2023 7:31am UTC reported: A...

Debian: Security Advisory (DLA-716-1)

The remote host is missing an update for the...

Malicious code in controlreplace (pypi)

-= Per source details. Do not edit below this line.=- Source: checkmarx (bd99919cb7bf3d2cdbbf8b9c77d2790327b74c80e7a8e83a9433ccc7220b6b2d) EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing...

heap-buffer-overflow in function gf_m2ts_process_tdt_tot media_tools/mpegts.c

Version ``` ./MP4Box -version MP4Box - GPAC version 2.3-DEV-rev40-g3602a5ded-master (c) 2000-2023 Telecom Paris distributed under LGPL v2.1+ - http://gpac.io Please cite our work in your research: GPAC Filters: https://doi.org/10.1145/3339825.3394929 GPAC:...

Exploit for CVE-2022-20452

Android 13 introduces many enhancements in order to harden...

CVE-2022-48197

Reflected cross-site scripting (XSS) exists in Sandbox examples in the YUI2 repository. The download distributions, TreeView component and the YUI Javascript library overall are not affected. NOTE: This vulnerability only affects products that are no longer supported by the...

Huawei EulerOS: Security Advisory for shim (EulerOS-SA-2022-2591)

The remote host is missing an update for the Huawei...

EulerOS Virtualization 3.0.6.0 : shim (EulerOS-SA-2022-2591)

According to the versions of the shim package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : shim: Buffer overflow when loading crafted EFI images (CVE-2022-28737) Note that Tenable Network Security has extracted the preceding...

Malicious code in dreactbvotstrap (npm)

-= Per source details. Do not edit below this line.=- Source: ghsa-malware (25072ffb584a022ee2d41ab37e2543607c059094ef2e102bfc14c3477db1db75) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Amazon Linux AMI : libtiff (ALAS-2022-1625)

The version of libtiff installed on the remote host is prior to 4.0.3-35.38. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2022-1625 advisory. Integer overflow in the writeBufferToSeparateStrips function in tiffcrop.c in LibTIFF before 4.0.7 allows remote...

Code injection

A vulnerability classified as critical has been found in TEM FLEX-1085 1.6.0. Affected is an unknown function of the file /sistema/flash/reboot. The manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be...

CVE-2022-2591

A vulnerability classified as critical has been found in TEM FLEX-1085 1.6.0. Affected is an unknown function of the file /sistema/flash/reboot. The manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be...

SUSE: Security Advisory (SUSE-SU-2022:2591-1)

The remote host is missing an update for...

CVE-2022-2591 TEM FLEX-1085 reboot denial of service

A vulnerability classified as critical has been found in TEM FLEX-1085 1.6.0. Affected is an unknown function of the file /sistema/flash/reboot. The manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be...

SUSE SLES15 Security Update : xen (SUSE-SU-2022:2591-1)

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2591-1 advisory. Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated user to potentially...

Medium: libtiff

Issue Overview: Integer overflow in the writeBufferToSeparateStrips function in tiffcrop.c in LibTIFF before 4.0.7 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted tif file. (CVE-2016-9532) A flaw was found in libtiff. Due to a memory allocation failure in...

new packages: setroubleshoot

An update is available for setroubleshoot. This update affects Rocky Linux 9. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

Amazon Linux 2 : libtiff (ALAS-2022-1780)

The version of libtiff installed on the remote host is prior to 4.0.3-35. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1780 advisory. Integer overflow in the writeBufferToSeparateStrips function in tiffcrop.c in LibTIFF before 4.0.7 allows remote...

Medium: libtiff

Issue Overview: Integer overflow in the writeBufferToSeparateStrips function in tiffcrop.c in LibTIFF before 4.0.7 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted tif file. (CVE-2016-9532) A flaw was found in libtiff. Due to a memory allocation failure in...

Rocky Linux 8 : edk2 (RLSA-2021:2591)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2021:2591 advisory. A heap overflow in LzmaUefiDecompressGetInfo function in EDK II. (CVE-2021-28211) Note that Nessus has not tested for this issue but has instead relied only on...

Mageia: Security Advisory (MGASA-2017-0028)

The remote host is missing an update for...

Mageia: Security Advisory (MGASA-2016-0388)

The remote host is missing an update for...

Huawei EulerOS: Security Advisory for libldb (EulerOS-SA-2021-2591)

The remote host is missing an update for the Huawei...

EulerOS 2.0 SP3 : libldb (EulerOS-SA-2021-2591)

According to the versions of the libldb packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in samba. Spaces used in a string around a domain name (DN), while supposed to be ignored, can cause invalid DN strings with...

Oracle WebLogic Server Administration Console - Remote Code Execution

The Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services) versions 0.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0 contain an easily exploitable vulnerability that allows unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic...

SUSE: Security Advisory (SUSE-SU-2021:2591-1)

The remote host is missing an update for...

openSUSE 15 Security Update : qemu (openSUSE-SU-2021:2591-1)

The remote SUSE Linux SUSE15 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:2591-1 advisory. QEMU 5.0.0 has a heap-based Buffer Overflow in flatview_read_continue in exec.c because hw/sd/sdhci.c mishandles a write operation in...

SUSE SLES15 Security Update : qemu (SUSE-SU-2021:2591-1)

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2591-1 advisory. QEMU 5.0.0 has a heap-based Buffer Overflow in flatview_read_continue in exec.c because hw/sd/sdhci.c mishandles a write...

openSUSE: Security Advisory for qemu (openSUSE-SU-2021:2591-1)

The remote host is missing an update for...