OESA-2024-2019 c-ares security update

This is c-ares, an asynchronous resolver library. It is intended for applications which need to perform DNS queries without blocking, or need to perform multiple Security Fixes: c-ares is a C library for asynchronous DNS requests. aresreadline is used to parse local configuration files such as...

OESA-2024-2021 c-ares security update

This is c-ares, an asynchronous resolver library. It is intended for applications which need to perform DNS queries without blocking, or need to perform multiple Security Fixes: c-ares is a C library for asynchronous DNS requests. aresreadline is used to parse local configuration files such as...

CVE-2024-8077

This CVE-2024-8077 affects TOTOLINK AC1200 T8, specifically version 4.1.5cu.862_B20230228. The vulnerability is in the setTracerouteCfg function and allows OS command injection, with remote exploitation as implied by the sources. Reports consistently describe a critical impact under this function...

F5 Nginx 安全漏洞

F5 Nginx is a lightweight web server/reverse proxy server and email IMAP/POP3 proxy server from F5 Corporation, USA, distributed under the BSD-like protocol. A security vulnerability exists in F5 Nginx, which stems from a flaw in the configdirs restriction feature. An elevated-privilege attacker...

GO-2022-0451 Ignition config accessible to unprivileged software on VMware in github.com/coreos/ignition

Ignition config accessible to unprivileged software on VMware in github.com/coreos/ignition...

GO-2022-0305 Instance config inline secret exposure in Grafana in github.com/grafana/agent

Instance config inline secret exposure in Grafana in github.com/grafana/agent...

PT-2024-30068 · Pligg Cms · Pligg Cms

Name of the Vulnerable Software and Affected Versions: Pligg CMS version 2.0.2 Description: A Cross-Site Request Forgery CSRF issue was discovered. The issue is related to the "/admin/admin config.php?action=save&var id=32" API endpoint. Recommendations: For Pligg CMS version 2.0.2, as a temporar...

TOTOLINK EX1200L 安全漏洞

The TOTOLINK EX1200L is a wireless repeater from China's Gion Electronics TOTOLINK. The TOTOLINK EX1200L suffers from a stack buffer overflow vulnerability that originates from the parameter langType of the setLanguageCfg function of the file /www/cgi-bin/cstecgi.cgi, which can lead to a...

PT-2024-7422 · Trend Micro · Trend Micro Antivirus

Name of the Vulnerable Software and Affected Versions: Trend Micro Antivirus One versions 3.10.4 and below Consumer Description: The issue is related to insufficient access control, which could allow an attacker to gain unauthorized access to protected information. This could permit arbitrary...

PT-2024-38671 · Xiaohe4966 · Tpmecms

Name of the Vulnerable Software and Affected Versions: xiaohe4966 TpMeCMS version 1.3.3.2 Description: A problematic vulnerability was found in the Basic Configuration Handler component of xiaohe4966 TpMeCMS. The issue affects an unknown function of the file /h.php/general/config?ref=addtabs. The...

TpMeCMS 跨站脚本漏洞

TpMeCMS is a CMS developed on the FastAdmin framework. TpMeCMS version 1.3.3.2 suffers from a cross-site scripting vulnerability, which originates from the lack of effective filtering and escaping of user-supplied data in the parameter Site Name/Beian/Contact address/copyright/technical support i...

CVE-2024-5916

An information exposure vulnerability in Palo Alto Networks PAN-OS software enables a local system administrator to unintentionally disclose secrets, passwords, and tokens of external systems. A read-only administrator who has access to the config log, can read secrets, passwords, and tokens to...

PT-2024-37238 · Palo Alto Networks · Pan-Os

Name of the Vulnerable Software and Affected Versions: Palo Alto Networks PAN-OS versions prior to 10.2.8 Palo Alto Networks PAN-OS versions prior to 11.0.4 Description: An information exposure issue in the software enables a local system administrator to unintentionally disclose secrets,...

CVE-2024-7700

A command injection flaw was found in the "Host Init Config" template in the Foreman application via the "Install Packages" field on the "Register Host" page. This flaw allows an attacker with the necessary privileges to inject arbitrary commands into the configuration, potentially allowing...

CVE-2024-7700

A command injection flaw was found in the "Host Init Config" template in the Foreman application via the "Install Packages" field on the "Register Host" page. This flaw allows an attacker with the necessary privileges to inject arbitrary commands into the configuration, potentially allowing...

CVE-2024-7700 Foreman: command injection in "host init config" template via "install packages" field on foreman

A command injection flaw was found in the "Host Init Config" template in the Foreman application via the "Install Packages" field on the "Register Host" page. This flaw allows an attacker with the necessary privileges to inject arbitrary commands into the configuration, potentially allowing...

CVE-2024-7700 Foreman: command injection in "host init config" template via "install packages" field on foreman

A command injection flaw was found in the "Host Init Config" template in the Foreman application via the "Install Packages" field on the "Register Host" page. This flaw allows an attacker with the necessary privileges to inject arbitrary commands into the configuration, potentially allowing...

CVE-2024-7700

The CVE-2024-7700 entry concerns Foreman where the vulnerability is a command-injection flaw in the Host Init Config template via the Install Packages field on the Register Host page. The root cause is the injection into the configuration, enabling potentially arbitrary command execution during h...

DEBIAN-CVE-2024-43168

DISPUTE NOTE: this issue does not pose a security risk as it according to analysis by the original software developer, NLnet Labs falls within the expected functionality and security controls of the application. Red Hat has made a claim that there is a security risk within Red Hat products. NLnet...

AZL-47776 CVE-2024-43168 affecting package unbound for versions less than 1.19.1-2

DISPUTE NOTE: this issue does not pose a security risk as it according to analysis by the original software developer, NLnet Labs falls within the expected functionality and security controls of the application. Red Hat has made a claim that there is a security risk within Red Hat products. NLnet...