USN-6885-2 apache2 regression

USN-6885-1 fixed vulnerabilities in Apache HTTP Server. One of the security fixes introduced a regression when proxying requests to a HTTP/2 server. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Marc Stern discovered that the Apache HTTP Server...

USN-6891-1: Python vulnerabilities

It was discovered that Python incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 18.04 LTS. CVE-2015-20107 It was discovered that Python incorrectly used regular expressions vulnerable to...

Audify.js Security Vulnerability

Audify.js is an application by the individual developer Almog Hamdani. It is used to play, stream, and record PCM audio data, and encode and decode Opus into PCM audio data. Audify.js suffers from a security vulnerability that stems from vulnerability to improper validation of array indexes, whic...

Mageia: Security Advisory (MGASA-2024-0258)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Updated apache packages fix security vulnerabilities

Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance. CVE-2024-36387 Encoding problem in modproxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encodin...

Authentication Bypass

modproxy in Apache HTTP Server is vulnerable to Authentication Bypass. The vulnerability is caused due to encoding problem. This allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests...

Improper Encoding

Apache HTTP Server is vulnerable to Improper Encoding. The vulnerability is caused due to Substitution encoding issue in modrewrite. This allows attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant to...

CVE-2024-39594

SAP Business Warehouse - Business Planning and Simulation application does not sufficiently encode user controlled inputs, resulting in Reflected Cross-Site Scripting XSS vulnerability. After successful exploitation, an attacker can cause low impact on the confidentiality and integrity of the...

CVE-2024-39595

SAP Business Warehouse - Business Planning and Simulation application does not sufficiently encode user-controlled inputs, resulting in Stored Cross-Site Scripting XSS vulnerability. This vulnerability allows users to modify website content and on successful exploitation, an attacker can cause lo...

CVE-2024-37174

Custom CSS support option in SAP CRM WebClient UI does not sufficiently encode user-controlled inputs resulting in Cross-Site Scripting vulnerability. On successful exploitation an attacker can cause limited impact on confidentiality and integrity of the application...

CVE-2024-34685

Due to weak encoding of user-controlled input in SAP NetWeaver Knowledge Management XMLEditor which allows malicious scripts can be executed in the application, potentially leading to a Cross-Site Scripting XSS vulnerability. This has no impact on the availability of the application but it has a...

CVE-2024-34685 [CVE-2024-34685] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Knowledge Management XMLEditor

Due to weak encoding of user-controlled input in SAP NetWeaver Knowledge Management XMLEditor which allows malicious scripts can be executed in the application, potentially leading to a Cross-Site Scripting XSS vulnerability. This has no impact on the availability of the application but it has a...

SAP NetWeaver cross-site scripting vulnerabilities

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform mainly for SAP applications to provide development and runtime environment. A cross-site scripting vulnerability exists in SAP NetWeaver Knowledge Management XMLEditor, which stems...

CVE-2024-34685: Improper Neutralization of Input During Web Page Generation

Due to weak encoding of user-controlled input in SAP NetWeaver Knowledge Management XMLEditor which allows malicious scripts can be executed in the application, potentially leading to a Cross-Site Scripting XSS vulnerability. This has no impact on the availability of the application but it has a...

CVE-2024-39595: Improper Neutralization of Input During Web Page Generation

SAP Business Warehouse - Business Planning and Simulation application does not sufficiently encode user-controlled inputs, resulting in Stored Cross-Site Scripting XSS vulnerability. This vulnerability allows users to modify website content and on successful exploitation, an attacker can cause lo...

CVE-2024-34702

Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. Prior to 3.5.0 and 2.19.5, checking name constraints in X.509 certificates is quadratic in the number of names and name constraints...

PT-2024-26105 · Sap · Sap Netweaver Knowledge Management Xmleditor

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Knowledge Management XMLEditor affected versions not specified Description: The issue is due to weak encoding of user-controlled input in the SAP NetWeaver Knowledge Management XMLEditor, allowing malicious scripts to be execute...

PT-2024-9861 · Sap · Sap Business Warehouse - Business Planning/Simulation

Name of the Vulnerable Software and Affected Versions: SAP Business Warehouse - Business Planning and Simulation affected versions not specified Description: The issue is related to insufficient encoding of user-controlled inputs in the SAP Business Warehouse - Business Planning and Simulation...

Cross-site Scripting (XSS)

TYPO3 CMS is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to failing to properly encode user input in multiple areas of the CMS, allowing attackers to inject malicious scripts...

Internet Bug Bounty: moderate: Apache HTTP Server proxy encoding problem (CVE-2024-38473)

Moderate: Apache HTTP Server proxy encoding problem CVE-2024-38473 An encoding problem was discovered in modproxy in Apache HTTP Server versions 2.4.59 and earlier. This issue allowed request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via...