CVE-2024-22196

CVE-2024-22196 affects nginx-ui (Go) where OrderAndPaginate uses user-controlled query parameters (order and sort_by via DefaultQuery) to build SQL order clauses, enabling SQL injection via crafted requests. Multiple connected sources confirm the vulnerability is exploitable through the GET /api/...

CVE-2024-22196 Authenticated (user role) SQL injection in `OrderAndPaginate` (GHSL-2023-270)

Nginx-UI is an online statistics for Server Indicators​​ Monitor CPU usage, memory usage, load average, and disk usage in real-time. This issue may lead to information disclosure. By using DefaultQuery, the "desc" and "id" values are used as default values if the query parameters are not set. Thu...

CVE-2024-22197 Authenticated (user role) remote command execution by modifying `nginx` settings (GHSL-2023-269)

Nginx-ui is online statistics for Server Indicators​​ Monitor CPU usage, memory usage, load average, and disk usage in real-time. The Home Preference page exposes a small list of nginx settings such as Nginx Access Log Path and Nginx Error Log Path. However, the API also exposes testconfigcmd,...

Oracle Linux 9 : ipa (ELSA-2024-0141)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-0141 advisory. 4.10.2-5.0.1 - Resolves: 2242828 Invalid CSRF protection CVE-2023-5455 Tenable has extracted the preceding description block directly from the Oracle Linux...

Nginx-UI SQL Injection Vulnerability

Nginx UI is a WebUI for Nginx by Jacky personal developer . Nginx UI versions prior to 2.0.0.beta.9 have a SQL injection vulnerability that can be exploited by an attacker to perform SQL injection via the OrderAndPaginate parameter...

GHSA-449P-3H89-PW88 vulnerabilities

Vulnerabilities for packages: bom, scorecard, gitsign, gitness, nuclei, pulumi-kubernetes-operator, src-fingerprint, go-licenses, goreleaser...

RHEL 9 : .NET 6.0 (RHSA-2024:0156)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0156 advisory. .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR...

RHEL 9 : ipa (RHSA-2024:0141)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0141 advisory. Red Hat Identity Management IdM is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based...

RHEL 9 : nss (RHSA-2024:0107)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0107 advisory. Network Security Services NSS is a set of libraries designed to support the cross-platform development of security-enabled client and server...

Oracle Linux 9 : squid (ELSA-2024-0071)

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2024-0071 advisory. - squid: Denial of Service in SSL Certificate validation CVE-2023-46724 - squid: NULL pointer dereference in the gopher protocol code CVE-2023-46728 -...

RHEL 9 : ipa (RHSA-2024:0142)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0142 advisory. Red Hat Identity Management IdM is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based...

RHEL 9 : .NET 8.0 (RHSA-2024:0152)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0152 advisory. .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR...

CVE-2019-17091

creationtimestamp| type| source ---|---|--- 2024-01-09 17:12:04+00:00| seen| https://t.me/ctinow/165135...

RHSA-2024:0093

creationtimestamp| type| source ---|---|--- 2024-01-09 16:17:19+00:00| seen| https://t.me/ctinow/165093...

Moderate: Red Hat Security Advisory: Red Hat Single Sign-On 7.6.6 security update on RHEL 9

New Red Hat Single Sign-On 7.6.6 packages are now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

usspeed.de Cross Site Scripting vulnerability OBB-3830669

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

luftfahrtwelt.de Cross Site Scripting vulnerability OBB-3830633

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

impuls-verschleisstechnik.de Cross Site Scripting vulnerability OBB-3830620

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

geismar-eichsfeld.de Cross Site Scripting vulnerability OBB-3830609

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

vipino-wein.de Cross Site Scripting vulnerability OBB-3830550

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...