PT-2024-15008

Name of the Vulnerable Software and Affected Versions Featured Image from URL FIFU plugin for WordPress versions up to, and including, 4.5.3 Description The issue is related to Stored Cross-Site Scripting via the featured image alt text due to insufficient input sanitization and output escaping...

CVE-2023-6561: Improper Neutralization of Input During Web Page Generation

The Featured Image from URL FIFU plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the featured image alt text in all versions up to, and including, 4.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

Fedora 38 : exim (2024-e0841c83bb)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-e0841c83bb advisory. Security fix for CVE-2023-51766. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus...

Facebook Job Scam

Qualys has confirmed ongoing attacks against multiple brands offering work-from-home remote job offers, advertised through Facebook. Unfortunately, these scams typically see a rise in prevalence following the holidays. Qualys has confirmed cyber criminals are advertising jobs within Facebook to...

WWBN AVideo Security Breach

WWBN AVideo is a video platform builder written in PHP by the WWBN team. A security vulnerability exists in WWBN AVideo, which stems from a local file inclusion vulnerability in the getLanguageFromBrowser method...

CVE-2024-20681

creationtimestamp| type| source ---|---|--- 2024-01-09 20:16:20+00:00| seen| https://t.me/ctinow/165318 2025-05-03 02:16:45+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/14675...

CVE-2023-49722

Network port 8899 open in WiFi firmware of BCC101/BCC102/BCC50 products, that allows an attacker to connect to the device via same WiFi network...

Request Smuggling

fastify-reply-from is vulnerable to Request Smuggling. The vulnerability is due to the absence of a unified Content-Type parsing, unlike the majority of Fastify that uses fast-content-type-parse with trimming after split. This issue can be exploited by an attacker to bypass security checks,...

CVE-2023-6042

Any unauthenticated user may send e-mail from the site with any title or content to the admin...

AZL-33498 CVE-2022-2585 affecting package kernel for versions less than 5.15.153.1-1

It was discovered that when exec'ing from a non-leader thread, armed POSIX CPU timers would be left on a list but freed, leading to a use-after-free...

http-proxy-with-cors (>=1.2.2, <=1.2.4) potentially affected by CVE-2023-51701 via @fastify/reply-from (9.1.0)

@fastify/reply-from NPM version 9.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @fastify/reply-from and may be impacted: - http-proxy-with-cors =1.2.2, =1.2.4 Source cves: CVE-2023-51701 Source advisory: OSV:GHSA-V2V2-HPH8-Q5XP...

@fastify/reply-from JSON Content-Type parsing confusion

Impact The main repo of fastify use fast-content-type-parse to parse request Content-Type, which will trim after split. The fastify-reply-from have not use this repo to unify the parse of Content-Type, which won't trim. As a result, a reverse proxy server built with @fastify/reply-from could...

CVE-2023-51701 @fastify-reply-from JSON Content-Type parsing confusion

fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server. A reverse proxy server built with @fastify/reply-from could misinterpret the incoming body by passing an header ContentType: application/json ; charset=utf-8. This can lead to bypass of security checks...

CVE-2023-51701 @fastify-reply-from JSON Content-Type parsing confusion

fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server. A reverse proxy server built with @fastify/reply-from could misinterpret the incoming body by passing an header ContentType: application/json ; charset=utf-8. This can lead to bypass of security checks...

CVE-2023-51701

fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server. A reverse proxy server built with "@fastify/reply-from" could misinterpret the incoming body by passing an header "ContentType: application/json ; charset=utf-8". This can lead to bypass of security...

CVE-2023-51701

CVE-2023-51701 affects fastify-reply-from, a Fastify plugin. The vulnerability arises when the plugin misinterprets the request body due to a Content-Type handling discrepancy (Content-Type header like application/json ; charset=utf-8), allowing bypass of security checks. References in multiple s...

CVE-2023-51701 @fastify-reply-from JSON Content-Type parsing confusion

fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server. A reverse proxy server built with @fastify/reply-from could misinterpret the incoming body by passing an header ContentType: application/json ; charset=utf-8. This can lead to bypass of security checks...

RHSA-2019:3082

creationtimestamp| type| source ---|---|--- 2024-01-08 13:36:46+00:00| seen| https://t.me/ctinow/164333...

Fastify Environmental Vulnerabilities

Fastify is an open source web framework for Node.js from the OpenJS Foundation. A security vulnerability exists in Fastify fastify-reply-from versions prior to 9.6.0, which stems from the fact that passing body text via header using fastify/reply-from may be misinterpreted, leading to bypassing...

PT-2024-14252

Name of the Vulnerable Software and Affected Versions @fastify/reply-from versions prior to 9.6.0 Description The issue arises when a reverse proxy server built with @fastify/reply-from misinterprets the incoming body by passing a header ContentType: application/json ; charset=utf-8, potentially...