Fedora 38 : python-aiohttp (2024-0ddda4c691)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-0ddda4c691 advisory. Security update for CVE-2024-23334 and CVE-2024-23829 https://github.com/aio-libs/aiohttp/releases/tag/v3.9.2...

Fedora 39 : python-aiohttp (2024-f249b74f03)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-f249b74f03 advisory. Security update for CVE-2024-23334 and CVE-2024-23829 https://github.com/aio-libs/aiohttp/releases/tag/v3.9.2...

CVE-2024-23334 vulnerabilities

Vulnerabilities for packages: py3-cassandra-medusa, py3-aiohttp, checkov...

CVE-2024-23334 vulnerabilities

Vulnerabilities for packages: py3-aiohttp, py3-cassandra-medusa, checkov, py3.13-scanner-test-libraries-aiohttp...

CVE-2024-23334

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'followsymlinks' can be used to determine whether to follow symboli...

CVE-2024-23334

CVE-2024-23334 affects aiohttp when used as a web server with static routes and follow_symlinks=True, where reading a file isn’t validated against the static root. The vulnerability enables directory traversal to access arbitrary files; PoC and multiple advisories reference this behavior in versi...

CVE-2024-23334 aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'followsymlinks' can be used to determine whether to follow symboli...

CVE-2022-23334

creationtimestamp| type| source ---|---|--- 2023-01-30 18:36:12+00:00| seen| https://t.me/cibsecurity/57165...

CVE-2022-23334

The Robot application in Ip-label Newtest before v8.5R0 was discovered to use weak signature checks on executed binaries, allowing attackers to have write access and escalate privileges via replacing NEWTESTREMOTEMANAGER.EXE...

CVE-2022-23334

The CVE-2022-23334 vulnerability affects Ip-label Newtest’s Robot application prior to version 8.5R0. The issue is weak signature checks on binaries before execution, enabling an attacker to gain write access and escalate privileges by replacing NEWTESTREMOTEMANAGER.EXE. Affected software is Ip-l...

CVE-2020-23334

creationtimestamp| type| source ---|---|--- 2021-08-18 02:16:13+00:00| seen| https://t.me/cibsecurity/27471...

CVE-2020-23334

A WRITE memory access in the AP4NullTerminatedStringAtom::AP4NullTerminatedStringAtom component of Bento4 version 06c39d9 can lead to a segmentation fault...

CVE-2020-23334

Affected software: Bento4 (open-source C library for MP4 handling). Vulnerable component: AP4_NullTerminatedStringAtom. Root cause: A WRITE memory access in AP4_NullTerminatedStringAtom::AP4_NullTerminatedStringAtom can cause a segmentation fault. Impact: crashes (segmentation fault) reported for...

Security Bulletin: A security vulnerability in Node.js lodash module affects IBM Cloud Pak for Multicloud Management Managed Service

Summary A security vulnerability in Node.js lodash module affects IBM Cloud Pak for Multicloud Management Managed Service. Vulnerability Details CVEID: CVE-2021-23337 DESCRIPTION: Node.js lodash module could allow a remote authenticated attacker to execute arbitrary commands on the system, caused...

CVE-2021-23334

creationtimestamp| type| source ---|---|--- 2021-02-11 14:42:21+00:00| published-proof-of-concept| https://t.me/cibsecurity/23429...

UBUNTU-CVE-2021-23334

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

CVE-2021-23334

...

CVE-2021-23334

CVE-2021-23334 is described in IBM security bulletins as a Node.js static-eval module vulnerability (code injection via FunctionExpressions/TemplateLiterals) leading to remote code execution with high impact (C:H/I:H/A:H). Affected product: IBM Cloud Pak for Multicloud Management Infrastructure M...