557 matches found
Debian dla-3919 : libapache-mod-jk-doc - security update
The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-3919 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3919-1 [email protected] https://www.debian.org/lts/security/...
kvf-admin cross-site scripting vulnerability
kvf-admin is a rapid development framework, scaffolding, backend management system, permission system. kvf-admin cross-site scripting vulnerability , the vulnerability stems from the file / ueditor/upload?configPath=ueditor/config.json&action=uploadfile parameter upfile lack of effective filterin...
Privilege Escalation
github.com/external-secrets/external-secrets is vulnerable to privilege escalation. The vulnerability is due to improper configuration of the ClusterRole, which grants "get/list" verbs for secrets resources and "path/update" verb for validating webhook configurations. It allows an attacker to abu...
Mars: phpinfo() exposed on ██████████
A phpinfo page was exposed at the URL ███████. This configuration issue allowed sensitive system information to be publicly accessed...
CVE-2024-41027 Fix userfaultfd_api to return EINVAL as expected
In the Linux kernel, the following vulnerability has been resolved: Fix userfaultfdapi to return EINVAL as expected Currently if we request a feature that is not set in the Kernel config we fail silently and return all the available features. However, the man page indicates we should return an...
Error 2320: "No value could be found for LegacyLocaluserNameAndPassword" when opening ICA connection
The following message is displayed when opening an ICA connection: Error 2320: Citrix Receiver configuration manager: No value could be found for LegacyLocaluserNameAndPassword that satisfies all lockdown requirements. The lockdown requirements in force might be conflicting...
PT-2024-37512
Name of the Vulnerable Software and Affected Versions: github.com/google/nftables version 0.1.0 Description: The issue arises from IP addresses being encoded in the wrong byte order, resulting in an nftables configuration that does not work as intended. This could lead to either blocking or not...
Soar Cloud HR Portal Code Issue Vulnerability
Soar Cloud HR Portal is a human resources application from Soar Cloud, Inc. A code issue vulnerability exists in Soar Cloud HR Portal versions prior to 7.3.2024.0409 that stems from not properly configuring the session expiration date...
CVE-2024-28826 Unrestricted upload and download paths in check_sftp
Improper restriction of local upload and download paths in checksftp in Checkmk before 2.3.0p4, 2.2.0p27, 2.1.0p44, and in Checkmk 2.0.0 EOL allows attackers with sufficient permissions to configure the check to read and write local files on the Checkmk site server...
PT-2024-3832 · Tenda · Tenda Fh1206
Name of the Vulnerable Software and Affected Versions: Tenda FH1206 version 1.2.0.88155 Description: The issue is related to a command injection vulnerability. It can be exploited via the mac parameter at the "/ip/goform/WriteFacMac" endpoint, allowing a remote attacker to execute arbitrary...
CVE-2023-6154
A configuration setting issue in seccenter.exe as used in Bitdefender Total Security, Bitdefender Internet Security, Bitdefender Antivirus Plus, Bitdefender Antivirus Free allows an attacker to change the product's expected behavior and potentially load a third-party library upon execution. This...
CVE-2024-29037
Summary: CVE-2024-29037 affects datahub-helm helm charts used to deploy Datahub on Kubernetes. Affected versions: 0.1.143 through 0.2.181. Root cause: misconfigurations in the helm chart led to a default, static secret key being used to generate personal access tokens during a limited deployment ...
CVE-2023-33105 Configuration Issue in WLAN Host and Firmware
Transient DOS in WLAN Host and Firmware when large number of open authentication frames are sent with an invalid transaction sequence number...
CVE-2024-23322 Envoy crashes when idle and request per try timeout occur within the backoff interval
Envoy is a high-performance edge/middle/service proxy. Envoy will crash when certain timeouts happen within the same interval. The crash occurs when the following are true: 1. hedgeonpertrytimeout is enabled, 2. pertryidletimeout is enabled it can only be done in configuration, 3. per-try-timeout...
CVE-2024-0690 Ansible-core: possible information leak in tasks that ignore ansible_no_log configuration
An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLENOLOG configuration in some scenarios. Information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive information, such as...
CVE-2023-33076 Configuration Issue in Core
Memory corruption in Core when updating rollback version for TA and OTA feature is enabled...
Directory Traversal
fastify-swagger-ui is vulnerable to Directory Traversal. The vulnerability is caused due to a default configuration issue in @fastify/swagger-ui .If the baseDir option is not set, the module exposes all files in its directory through the HTTP route it serves. This allows an attacker to gain...
Workspace App for Windows appears for AllAccount although only one store is configured
Citrix Workspace App for Windows appears for all accounts although with just one store configuration. Workspace App should appear like this if only one store is configured...
MCS Provisioned VDI shows the wrong Storage Type as HDD
Use MCS to create VDIs on Azure hypervisor and select the storage type as "Standard SSD". After that, the storage type is shown correctly as Standard SSD in Azure Portal. However, when logon VDI and open the Task Manager, the storage type is shown as "HDD"...