io.undertow:undertow-http2-test-suite (1.2.0.beta1), io.undertow:undertow-servlet (1.2.0.beta1) +2 more potentially affected by CVE-2023-1108 via io.undertow:undertow-core (1.2.0.beta1)

io.undertow:undertow-core MAVEN version 1.2.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-http2-test-suite 1.2.0.beta1 - io.undertow:undertow-servlet 1.2.0.beta1 -...

io.inkstand:inkstand-deployment-resteasy (>=0.1.1, <=0.1.2), io.inkstand:inkstand-http-undertow (>=0.1.1, <=0.1.2) +8 more potentially affected by CVE-2023-1108 via io.undertow:undertow-core (1.2.0.beta3)

io.undertow:undertow-core MAVEN version 1.2.0.beta3 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.inkstand:inkstand-deployment-resteasy =0.1.1, =0.1.1, =0.0.1, =0.0.1, =4.0.0, =1.0.0.alpha11,...

io.undertow:undertow-servlet (1.1.0.beta3), io.undertow:undertow-websockets-jsr (1.1.0.beta3) +1 more potentially affected by CVE-2023-1108 via io.undertow:undertow-core (1.1.0.beta3)

io.undertow:undertow-core MAVEN version 1.1.0.beta3 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.1.0.beta3 - io.undertow:undertow-websockets-jsr 1.1.0.beta3 -...

MikroTik RouterOS Privilege Escalation

The vulnerability of the Winbox and HTTP interfaces of the RouterOS operating system in MikroTik devices is related to insecure management of privileges. Exploiting this vulnerability allows a malicious actor to elevate their privileges to the level of Super Admin...

MikroTik RouterOS < 6.49.8 Privilege Escalation Vulnerability

MikroTik RouterOS is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2023-30799 MikroTik RouterOS Administrator Privilege Escalation

MikroTik RouterOS stable before 6.49.7 and long-term through 6.48.6 are vulnerable to a privilege escalation issue. A remote and authenticated attacker can escalate privileges from admin to super-admin on the Winbox or HTTP interface. The attacker can abuse this vulnerability to execute arbitrary...

PT-2023-3875

Name of the Vulnerable Software and Affected Versions MikroTik RouterOS versions prior to 6.49.7 MikroTik RouterOS long-term versions prior to 6.48.7 Description The issue is related to a privilege escalation problem in the Winbox and HTTP interfaces of MikroTik RouterOS. A remote and authenticat...

CVE-2023-30799: Improper Privilege Management

MikroTik RouterOS stable before 6.49.7 and long-term through 6.48.6 are vulnerable to a privilege escalation issue. A remote and authenticated attacker can escalate privileges from admin to super-admin on the Winbox or HTTP interface. The attacker can abuse this vulnerability to execute arbitrary...

io.undertow:undertow-servlet (1.0.5.final), io.undertow:undertow-websockets-jsr (1.0.5.final) +1 more potentially affected by CVE-2022-4492 via io.undertow:undertow-core (1.0.5.final)

io.undertow:undertow-core MAVEN version 1.0.5.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.0.5.final - io.undertow:undertow-websockets-jsr 1.0.5.final -...

io.undertow:undertow-http2-test-suite (1.2.0.beta1), io.undertow:undertow-servlet (1.2.0.beta1) +2 more potentially affected by CVE-2022-4492 via io.undertow:undertow-core (1.2.0.beta1)

io.undertow:undertow-core MAVEN version 1.2.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-http2-test-suite 1.2.0.beta1 - io.undertow:undertow-servlet 1.2.0.beta1 -...

com.mpay24.payment:mpay24-payment-sdk (1.0.0.0), com.mpay24.payment:mpay24-soap-base (1.0.0.0) +11 more potentially affected by CVE-2022-4492 via io.undertow:undertow-core (1.0.10.final)

io.undertow:undertow-core MAVEN version 1.0.10.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.mpay24.payment:mpay24-payment-sdk 1.0.0.0 - com.mpay24.payment:mpay24-soap-base 1.0.0.0 -...

io.undertow:undertow-servlet (1.1.0.beta6), io.undertow:undertow-websockets-jsr (1.1.0.beta6) +1 more potentially affected by CVE-2022-4492 via io.undertow:undertow-core (1.1.0.beta6)

io.undertow:undertow-core MAVEN version 1.1.0.beta6 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.1.0.beta6 - io.undertow:undertow-websockets-jsr 1.1.0.beta6 -...

io.undertow:undertow-servlet (1.1.0.beta3), io.undertow:undertow-websockets-jsr (1.1.0.beta3) +1 more potentially affected by CVE-2022-4492 via io.undertow:undertow-core (1.1.0.beta3)

io.undertow:undertow-core MAVEN version 1.1.0.beta3 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.1.0.beta3 - io.undertow:undertow-websockets-jsr 1.1.0.beta3 -...

SUSE CVE-2013-3565

Multiple cross-site scripting XSS vulnerabilities in the HTTP Interface in VideoLAN VLC Media Player before 2.0.7 allow remote attackers to inject arbitrary web script or HTML via the 1 command parameter to requests/vlmcmd.xml, 2 dir parameter to requests/browse.xml, or 3 URI in a request, which ...

This Week in Spring - January 31st, 2023

Hi, Spring fans! Welcome to another installment of This Week in Spring! I'm not going to spend too much time here in the preamble because a today's both my birthday and my late father's birthday and b I got the worst gift ever: COVID-19. Sigh. So, I'm going back to bed. Without further ado, let's...

Hitachi Modular Switchgear Monitoring HTTP Interface Code Execution

The vulnerability of the HTTP web interface of the performance measurement software for Hitachi Modular Switchgear Monitoring systems is related to the manipulation of inter-site requests. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

XAPI open file limit DoS

ISSUE DESCRIPTION It is possible for an unauthenticated client on the network to cause XAPI to hit its file-descriptor limit. This causes XAPI to be unable to accept new requests for other trusted clients, and blocks XAPI from carrying out any tasks that require the opening of file descriptors...

io.undertow:undertow-http2-test-suite (1.2.0.beta5), io.undertow:undertow-servlet (1.2.0.beta5) +2 more potentially affected by CVE-2022-2053 via io.undertow:undertow-core (1.2.0.beta5)

io.undertow:undertow-core MAVEN version 1.2.0.beta5 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-http2-test-suite 1.2.0.beta5 - io.undertow:undertow-servlet 1.2.0.beta5 -...

io.undertow:undertow-http2-test-suite (1.2.0.beta2), io.undertow:undertow-servlet (1.2.0.beta2) +2 more potentially affected by CVE-2022-2053 via io.undertow:undertow-core (1.2.0.beta2)

io.undertow:undertow-core MAVEN version 1.2.0.beta2 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-http2-test-suite 1.2.0.beta2 - io.undertow:undertow-servlet 1.2.0.beta2 -...

io.undertow:undertow-http2-test-suite (1.2.0.beta1), io.undertow:undertow-servlet (1.2.0.beta1) +2 more potentially affected by CVE-2022-2053 via io.undertow:undertow-core (1.2.0.beta1)

io.undertow:undertow-core MAVEN version 1.2.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-http2-test-suite 1.2.0.beta1 - io.undertow:undertow-servlet 1.2.0.beta1 -...