[SECURITY] [DLA 4082-1] ruby2.7 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4082-1 [email protected] https://www.debian.org/lts/security/ Bastien Roucariès March 10, 2025 https://wiki.debian.org/LTS -...

PT-2025-10597

ParsedReport CompletenessMedium 10-03-2025 GreyNoise Detects Mass Exploitation of Critical PHP-CGI Vulnerability CVE-2024-4577, Signaling Broad Campaign https://www.greynoise.io/blog/mass-exploitation-critical-php-cgi-vulnerability-cve-2024-457 Report completeness: Medium Threats: Cobalt strike...

CVE-2025-2097

CVE-2025-2097 affects TOTOLINK EX1800T (firmware 9.1.0cu.2112_B20220316). The vulnerability lies in the function setRptWizardCfg in /cgi-bin/cstecgi.cgi where manipulating the loginpass parameter causes a stack-based buffer overflow. Reports indicate the attack can be initiated remotely and that ...

CVE-2025-2095

A vulnerability classified as critical has been found in TOTOLINK EX1800T 9.1.0cu.2112B20220316. This affects the function setDmzCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ip leads to os command injection. It is possible to initiate the attack remotely. The exploit has...

Denial Of Service (DoS)

CGI is vulnerable to Denial of Service DoS. The vulnerability is due to the lack of a length limit on raw cookie values in the CGI::Cookie.parse method, allowing excessively large cookies to consume system resources...

PHP-CGI RCE Flaw Exploited in Attacks on Japan's Tech, Telecom, and E-Commerce Sectors

Threat actors of unknown provenance have been attributed to a malicious campaign predominantly targeting organizations in Japan since January 2025. "The attacker has exploited the vulnerability CVE-2024-4577, a remote code execution RCE flaw in the PHP-CGI implementation of PHP on Windows, to gai...

[SECURITY] Fedora 41 Update: man2html-1.6-39.g.fc41

man2html is a man page to HTML converter. This package contains CGI scripts that allow you to view, browse, and search man pages using a web server...

CVE-2025-2096: Improper Neutralization of Special Elements used in an OS Command

A vulnerability classified as critical was found in TOTOLINK EX1800T 9.1.0cu.2112B20220316. This vulnerability affects the function setRebootScheCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument mode/week/minute/recHour leads to os command injection. The attack can be initiat...

CVE-2025-2097: Stack-based Buffer Overflow

A vulnerability, which was classified as critical, has been found in TOTOLINK EX1800T 9.1.0cu.2112B20220316. This issue affects the function setRptWizardCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument loginpass leads to stack-based buffer overflow. The attack may be initiat...

CVE-2025-2095: Improper Neutralization of Special Elements used in an OS Command

A vulnerability classified as critical has been found in TOTOLINK EX1800T 9.1.0cu.2112B20220316. This affects the function setDmzCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ip leads to os command injection. It is possible to initiate the attack remotely. The exploit has...

PT-2025-10131

Name of the Vulnerable Software and Affected Versions TOTOLINK EX1800T version 9.1.0cu.2112 B20220316 Description A critical issue has been found in TOTOLINK EX1800T, affecting the function setRptWizardCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument loginpass leads to a...

PT-2025-10125

Name of the Vulnerable Software and Affected Versions TOTOLINK EX1800T version 9.1.0cu.2112 B20220316 Description A critical vulnerability was found in TOTOLINK EX1800T, affecting the function setRebootScheCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the arguments mode, week, minute,...

PT-2025-10124

Name of the Vulnerable Software and Affected Versions TOTOLINK EX1800T version 9.1.0cu.2112 B20220316 Description A critical vulnerability has been found in TOTOLINK EX1800T. This affects the function setDmzCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ip leads to os...

PT-2025-10123

Name of the Vulnerable Software and Affected Versions TOTOLINK EX1800T version 9.1.0cu.2112 B20220316 Description A critical issue was found in the setWiFiExtenderConfig function of the /cgi-bin/cstecgi.cgi file. The manipulation of the apcliKey/key argument leads to os command injection. This...

CVE-2025-2094: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was found in TOTOLINK EX1800T 9.1.0cu.2112B20220316. It has been rated as critical. Affected by this issue is the function setWiFiExtenderConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument apcliKey/key leads to os command injection. The attack may be launche...

Regular Expression Denial Of Service (ReDoS)

CGI is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to inefficient regular expression processing in the UtilescapeElement method, allowing an attacker to cause denial of service through excessive backtracking with crafted input...

Linux Distros Unpatched Vulnerability : CVE-2025-27219

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service DoS vulnerability. The method does...

Medium: php8.2

Issue Overview: The upstream advisory describes this issue as follows: A memory-related vulnerability in PHP's filter handling system, particularly when processing input with convert.quoted-printable-decode filters, leads to a segmentation fault. This vulnerability is triggered through specific...

Medium: php8.3

Issue Overview: The upstream advisory describes this issue as follows: A memory-related vulnerability in PHP's filter handling system, particularly when processing input with convert.quoted-printable-decode filters, leads to a segmentation fault. This vulnerability is triggered through specific...

Internet Bug Bounty: [CVE-2025-27220] ReDoS in CGI::Util#escapeElement

The cgi gem contains a vulnerability in the CGI::UtilescapeElement method that is susceptible to Regular Expression Denial of Service ReDoS. This vulnerability has been assigned the CVE identifier CVE-2025-27220. Users are advised to upgrade the cgi gem to address this issue...