GHSA-G77X-44XX-532M Denial of Service condition in Next.js image optimization

Impact The image optimization feature of Next.js contained a vulnerability which allowed for a potential Denial of Service DoS condition which could lead to excessive CPU consumption. Not affected: - The next.config.js file is configured with images.unoptimized set to true or images.loader set to...

PT-2024-33263 · Unknown · Opencanary

Name of the Vulnerable Software and Affected Versions: OpenCanary versions prior to 0.9.4 Description: OpenCanary, a multi-protocol network honeypot, directly executed commands taken from its config file. Where the config file is stored in an unprivileged user directory but the daemon is executed...

PT-2024-31526 · Helmholz +2 · Rex100 +4

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: An unauthenticated local attacker can gain admin privileges by deploying a config file due to improper input validation. No information is provided abou...

MOXA Service 安全漏洞

MOXA Service is a hardware device infrastructure service from China MOXA MOXA. A security vulnerability exists in MOXA Service, which stems from a lack of authentication during command sending and could allow an attacker to execute specific commands, resulting in unauthorized configuration file...

PT-2024-7542 · Unknown · Workstation

Name of the Vulnerable Software and Affected Versions: WorkstationST affected versions not specified Description: The issue is related to a lack of authentication for a critical function in the OPC server. This could allow a remote attacker to read or overwrite files on the configuration server...

PT-2024-39361 · 123Solar · 123Solar

Name of the Vulnerable Software and Affected Versions: jeanmarc77 123solar version 1.8.4.5 Description: A critical issue exists in the software, affecting an unknown part of the file config/config invt1.php. The manipulation of the PASSOx argument leads to code injection. This issue can be...

PT-2024-9158 · Nextcloud +1 · Nextcloud Enterprise Server +2

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 28.0.10 and prior to 29.0.7 Nextcloud Enterprise Server versions prior to 27.1.11.8, prior to 28.0.10, and prior to 29.0.7 Description: The issue is related to the insecure storage of confidential informatio...

PT-2024-37533 · WordPress · Funnelforms Free

Name of the Vulnerable Software and Affected Versions: Funnelforms Free plugin for WordPress versions up to, and including, 3.7.3.2 Description: The issue is related to arbitrary file deletion due to the plugin not properly validating a file or its path prior to deletion. This is made possible vi...

OESA-2024-2021 c-ares security update

This is c-ares, an asynchronous resolver library. It is intended for applications which need to perform DNS queries without blocking, or need to perform multiple Security Fixes: c-ares is a C library for asynchronous DNS requests. aresreadline is used to parse local configuration files such as...

DEBIAN-CVE-2024-43168

DISPUTE NOTE: this issue does not pose a security risk as it according to analysis by the original software developer, NLnet Labs falls within the expected functionality and security controls of the application. Red Hat has made a claim that there is a security risk within Red Hat products. NLnet...

AZL-47776 CVE-2024-43168 affecting package unbound for versions less than 1.19.1-2

DISPUTE NOTE: this issue does not pose a security risk as it according to analysis by the original software developer, NLnet Labs falls within the expected functionality and security controls of the application. Red Hat has made a claim that there is a security risk within Red Hat products. NLnet...

UBUNTU-CVE-2024-43168

DISPUTE NOTE: this issue does not pose a security risk as it according to analysis by the original software developer, NLnet Labs falls within the expected functionality and security controls of the application. Red Hat has made a claim that there is a security risk within Red Hat products. NLnet...

NLnet Unbound 安全漏洞

NLnet Unbound is an open source DNS server from the Dutch NLnet team. NLnet Unbound has a security vulnerability that originates from a heap buffer overflow vulnerability in the function cfgmarkports in the file util/configfile.c. The vulnerability is caused by a heap buffer overflow vulnerabilit...

PT-2024-37487 · Unknown · Gaizhenbiao/Chuanhuchatgpt

Name of the Vulnerable Software and Affected Versions: gaizhenbiao/chuanhuchatgpt version 20240410 Description: A vulnerability in the JSON file handling allows any user to delete any JSON file on the server, including critical configuration files such as config.json and ds config chatbot.json...

PT-2024-38132 · Totolink · Totolink A3000Ru

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3000RU version 5.9c.5185 Description: A problem was found in the processing of the file /web cste/cgi-bin/product.ini, which leads to the use of a hard-coded password. The issue has been disclosed to the public and may be used. The...

PT-2024-5851

Name of the Vulnerable Software and Affected Versions Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 version 3.90 Description A critical vulnerability was found in the Web Interface component of Raisecom devices, specifically in the file list base config.php. The manipulation of the template...

CVE-2024-36111 KubePi's JWT token validation has a defect

KubePi is a K8s panel. Starting in version 1.6.3 and prior to version 1.8.0, there is a defect in the KubePi JWT token verification. The JWT key in the default configuration file is empty. Although a random 32-bit string will be generated to overwrite the key in the configuration file when the ke...

The vulnerability of the web interface of IP-telephone devices, BAS-IP, allows a perpetrator to disclose protected information.

The vulnerability of the web interface of IP-telephone devices BAS-IP relates to the storage of user credentials in configuration files. Exploiting this vulnerability can allow an attacker to disclose sensitive information by sending a specially crafted HTTP request...

CVE-2024-6317

The Generate PDF using Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 4.0.6. This is due to missing nonce validation and the plugin not properly validating a file or its path prior to deleting it in the...

CVE-2024-5824

A path traversal vulnerability in the /setpersonalityconfig endpoint of parisneo/lollms version 9.4.0 allows an attacker to overwrite the configs/config.yaml file. This can lead to remote code execution by changing server configuration properties such as forceacceptremoteaccess and...