CVE-2024-38308

Advantech ADAM 5550's web application includes a "logs" page where all the HTTP requests received are displayed to the user. The device doesn't correctly neutralize malicious code when parsing HTTP requests to generate page output...

CVE-2024-38308

CVE-2024-38308 affects Advantech ADAM-5550. The vulnerability is a Cross-Site Scripting issue on the device’s web application “logs” page where HTTP requests are displayed without proper neutralization of malicious code, enabling potential web content injection. Connected sources confirm affected...

Hackers Could Have Remotely Controlled Kia Cars Using Only License Plates

Cybersecurity researchers have disclosed a set of now patched vulnerabilities in Kia vehicles that, if successfully exploited, could have allowed remote control over key functions simply by using only a license plate. "These attacks could be executed remotely on any hardware-equipped vehicle in...

CVE-2024-20508

A vulnerability in Cisco Unified Threat Defense UTD Snort Intrusion Prevention System IPS Engine for Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass configured security policies or cause a denial of service DoS condition on an affected device. This vulnerability is...

DataEase XML External Entity Injection Vulnerability

DataEase is a lightweight, high-performance self-service data visualization and analysis tool that helps users quickly explore and understand complex data, provides real-time data analysis and report generation capabilities, supports a variety of data sources, and is designed to improve data...

PT-2024-6618

Name of the Vulnerable Software and Affected Versions: Puma versions prior to 6.4.3 Puma versions prior to 5.6.9 Description: The issue is related to the handling of HTTP requests in Puma, a Ruby/Rack web server. Clients could overwrite values set by intermediate proxies, such as X-Forwarded-For,...

Cache Poisoning

Next is vulnerable to Cache Poisoning. The vulnerability is due to improper handling of crafted HTTP requests, causing the incorrect caching of non-dynamic server-side rendered routes in the pages router. It allows an attacker to manipulate the cache, potentially serving stale or incorrect conten...

Spring Framework < 5.3.40 / 6.0.x < 6.0.24 / 6.1.x < 6.1.13 Path Traversal (CVE-2024-38816)

The remote host contains a Spring Framework version is affected by a path traversal vulnerability. Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain...

GO-2024-3098 The req library may send an unintended request when a malformed URL is provided in github.com/imroc/req

The req library is a widely used HTTP library in Go. However, it does not handle malformed URLs effectively. As a result, after parsing a malformed URL, the library may send HTTP requests to unexpected destinations, potentially leading to security vulnerabilities or unintended behavior in...

CVE-2024-38816

A flaw was found in Spring applications using the WebMvc.fn or WebFlux.fn frameworks. This issue can allow attackers to perform path traversal attacks via crafted HTTP requests when the application serves static resources using RouterFunctions and explicitly configures resource handling with a...

Path traversal vulnerability in functional web frameworks

Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application...

Fortinet FortiClient EMS < 7.2.5 (FG-IR-23-362)

The version of Fortinet FortiClient EMS installed on the remote host is prior to 7.2.5. It is, therefore, affected by a vulnerability as referenced in the FG-IR-23-362 advisory. - A improper limitation of a pathname to a restricted directory 'path traversal' in Fortinet FortiClientEMS versions...

CVE-2024-45327

An improper authorization vulnerability CWE-285 in FortiSOAR version 7.4.0 through 7.4.3, 7.3.0 through 7.3.2, 7.2.0 through 7.2.2, 7.0.0 through 7.0.3 change password endpoint may allow an authenticated attacker to perform a brute force attack on users and administrators password via crafted HTT...

CVE-2024-45327

An improper authorization vulnerability CWE-285 in FortiSOAR version 7.4.0 through 7.4.3, 7.3.0 through 7.3.2, 7.2.0 through 7.2.2, 7.0.0 through 7.0.3 change password endpoint may allow an authenticated attacker to perform a brute force attack on users and administrators password via crafted HTT...

CVE-2024-45327

An improper authorization vulnerability CWE-285 in FortiSOAR version 7.4.0 through 7.4.3, 7.3.0 through 7.3.2, 7.2.0 through 7.2.2, 7.0.0 through 7.0.3 change password endpoint may allow an authenticated attacker to perform a brute force attack on users and administrators password via crafted HTT...

CVE-2024-45327

FortiSOAR is affected by an improper authorization vulnerability (CWE-285) in the change password endpoint, enabling an authenticated attacker to perform brute force attacks on user and administrator passwords. Affected FortiSOAR versions are 7.0.0–7.0.3, 7.2.0–7.2.2, 7.3.0–7.3.2, and 7.4.0–7.4.3...

Denial Of Service (DoS)

Keycloak is vulnerable to a Denial of Service DoS. The vulnerability is due to a lack of limits on the number of attributes per object, allowing an attacker to send repeated HTTP requests that cause resource exhaustion when the application returns rows with long attribute values...

GHSA-W97F-W3HQ-36G2 Keycloak Denial of Service vulnerability

A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited, an attacker by sending repeated HTTP requests could cause a resource exhaustion when the application send back rows with long attribute values. The issue is fixed in Keycloak 24 with...

Keycloak Denial of Service vulnerability

A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited, an attacker by sending repeated HTTP requests could cause a resource exhaustion when the application send back rows with long attribute values. The issue is fixed in Keycloak 24 with...

CVE-2023-6841

A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited,an attacker by sending repeated HTTP requests could cause a resource exhaustion when the application send back rows with long attribute values...