CVE-2024-8372

CVE-2024-8372 affects AngularJS; the issue is an improper sanitization of the srcset value (and related attributes) in AngularJS’s HTML rendering, allowing attackers to bypass image source restrictions and potentially enable Content Spoofing. Affected versions include 1.3.0-rc.4 and later. The An...

Pgpool-II vulnerable to information disclosure

Overview Pgpool-II is a cluster management tool. Pgpool-II contains an information disclosure vulnerability CWE-213 in its query cache function. PgPool Global Development Group reported this vulnerability to IPA to notify users of its solution through JVN. JPCERT/CC and PgPool Global Development...

AZL-69910 CVE-2024-25584 affecting package dovecot 2.3.20-1

Dovecot accepts dot LF DOT LF symbol as end of DATA command. RFC requires that it should always be CR LF DOT CR LF. This causes Dovecot to convert single mail with LF DOT LF in middle, into two emails when relaying to SMTP. Dovecot will split mail with LF DOT LF into two mails. Upgrade to latest...

UBUNTU-CVE-2024-25584

Dovecot accepts dot LF DOT LF symbol as end of DATA command. RFC requires that it should always be CR LF DOT CR LF. This causes Dovecot to convert single mail with LF DOT LF in middle, into two emails when relaying to SMTP. Dovecot will split mail with LF DOT LF into two mails. Upgrade to latest...

OESA-2024-2087 nginx security update

NGINX is a free, open-source, high-performance HTTP server and reverse proxy, as well as an IMAP/POP3 proxy server. Security Fixes: NGINX Open Source and NGINX Plus have a vulnerability in the ngxhttpmp4module, which might allow an attacker to over-read NGINX worker memory resulting in its...

Pavel Durov Criticizes Outdated Laws After Arrest Over Telegram Criminal Activity

Telegram CEO Pavel Durov has broken his silence nearly two weeks after his arrest in France, stating the charges are misguided. "If a country is unhappy with an internet service, the established practice is to start a legal action against the service itself," Durov said in a 600-word statement on...

PT-2024-21020 · Dovecot · Dovecot

Name of the Vulnerable Software and Affected Versions: Dovecot affected versions not specified Description: The issue arises because Dovecot accepts the dot LF DOT LF symbol as the end of the DATA command, whereas the RFC requires it to be CR LF DOT CR LF. This discrepancy causes Dovecot to split...

Atlassian Confluence 7.20.x < 8.5.14 Multiple Vulnerabilities

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.19.26, 7.20.x prior to 8.5.14, 8.6.x prior to 8.9.5 or 9.0.x prior to 9.0.1. It is, therefore, affected by a reflected Cross-Site Scripting XSS and a CSRF Cross-Site Reques...

Atlassian Confluence 9.0.x < 9.0.1 Multiple Vulnerabilities

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.19.26, 7.20.x prior to 8.5.14, 8.6.x prior to 8.9.5 or 9.0.x prior to 9.0.1. It is, therefore, affected by a reflected Cross-Site Scripting XSS and a CSRF Cross-Site Reques...

Dovecot 安全漏洞

Dovecot is Dovecot Open Source an open source IMAP and POP3 mail server based on Linux/UNIX-like systems. A security vulnerability exists in Dovecot that stems from a non-RFC-compliant recognition of the DATA command end symbol, which causes a single message containing the LF DOT LF to be...

CVE-2024-8461

A vulnerability, which was classified as problematic, was found in D-Link DNS-320 2.02b01. This affects an unknown part of the file /cgi-bin/discovery.cgi of the component Web Management Interface. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. T...

CVE-2024-8461

A vulnerability, which was classified as problematic, was found in D-Link DNS-320 2.02b01. This affects an unknown part of the file /cgi-bin/discovery.cgi of the component Web Management Interface. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. T...

CVE-2024-8461

The CVE-2024-8461 case concerns D-Link DNS-320 firmware 2.02b01 where the Web Management Interface file /cgi-bin/discovery.cgi mishandles access, enabling information disclosure. Documents state the vulnerability can be triggered remotely and that public exploits exist. The affected product is en...

CVE-2024-8461 D-Link DNS-320 Web Management Interface discovery.cgi information disclosure

A vulnerability, which was classified as problematic, was found in D-Link DNS-320 2.02b01. This affects an unknown part of the file /cgi-bin/discovery.cgi of the component Web Management Interface. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. T...

CVE-2024-8460

A vulnerability, which was classified as problematic, has been found in D-Link DNS-320 2.02b01. Affected by this issue is some unknown functionality of the file /cgi-bin/widgetapi.cgi of the component Web Management Interface. The manipulation of the argument getHD/getSer/getSys leads to...

CVE-2024-8460

A vulnerability, which was classified as problematic, has been found in D-Link DNS-320 2.02b01. Affected by this issue is some unknown functionality of the file /cgi-bin/widgetapi.cgi of the component Web Management Interface. The manipulation of the argument getHD/getSer/getSys leads to...

CVE-2024-8460 D-Link DNS-320 Web Management Interface widget_api.cgi information disclosure

A vulnerability, which was classified as problematic, has been found in D-Link DNS-320 2.02b01. Affected by this issue is some unknown functionality of the file /cgi-bin/widgetapi.cgi of the component Web Management Interface. The manipulation of the argument getHD/getSer/getSys leads to...

CVE-2024-8460

The CVE-2024-8460 affects D-Link DNS-320 (2.02b01) Web Management Interface, specifically /cgi-bin/widget_api.cgi. The vulnerability arises from manipulating the getHD/getSer/getSys parameters, leading to information disclosure. Attacks can be launched remotely with high complexity, and exploitat...

SUSE CVE-2024-45306

Vim is an open source, command line text editor. Patch v9.1.0038 optimized how the cursor position is calculated and removed a loop, that verified that the cursor position always points inside a line and does not become invalid by pointing beyond the end of a line. Back then we assumed this loop ...

PT-2024-6520 · D Link · D-Link Dns-320

Name of the Vulnerable Software and Affected Versions: D-Link DNS-320 version 2.02b01 Description: The issue is related to the disclosure of information in the /cgi-bin/discovery.cgi file of the Web Management Interface component in the D-Link DNS-320 router's firmware. This can be exploited...