Improper access control

Incorrect Access Control vulnerability in Modern Honey Network commit 0abf0db9cd893c6d5c727d036e1f817c02de4c7b allows remote attackers to view sensitive information via crafted PUT request to Web API...

Modern Honey Network 访问控制错误漏洞

Modern Honey Network is a web application for managing honeypots and collecting honeypot data by the individual developers of Pwnlandia. Modern Honey Network has a security vulnerability that stems from the presence of an incorrect access control vulnerability that can be exploited by a remote...

CVE-2023-0587

A file upload vulnerability in exists in Trend Micro Apex One server build 11110. Using a malformed Content-Length header in an HTTP PUT message sent to URL /officescan/console/html/cgi/fcgiOfcDDA.exe, an unauthenticated remote attacker can upload arbitrary files to the SampleSubmission directory...

Unrestricted file upload

A file upload vulnerability in exists in Trend Micro Apex One server build 11110. Using a malformed Content-Length header in an HTTP PUT message sent to URL /officescan/console/html/cgi/fcgiOfcDDA.exe, an unauthenticated remote attacker can upload arbitrary files to the SampleSubmission directory...

CVE-2023-0587

A file upload vulnerability in exists in Trend Micro Apex One server build 11110. Using a malformed Content-Length header in an HTTP PUT message sent to URL /officescan/console/html/cgi/fcgiOfcDDA.exe, an unauthenticated remote attacker can upload arbitrary files to the SampleSubmission directory...

Trend Micro Apex One 代码问题漏洞

Trend Micro Apex One is an endpoint protection software from Trend Micro. A security vulnerability exists in Trend Micro Apex One server version 11110, which arises from the use of an incorrectly formatted Content-Length header in its HTTP PUT message that allows an unauthenticated, remote attack...

Debian DSA-5330-1 : curl - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5330 advisory. Two vulnerabilities were discovered in Curl, an easy-to-use client-side URL transfer library, which could result in denial of service or information disclosure. F...

AlmaLinux 9 : curl (ALSA-2023:0333)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2023:0333 advisory. - When doing HTTPS transfers, libcurl might erroneously use the read callback CURLOPTREADFUNCTION to ask for data to send, even when the CURLOPTPOSTFIELDS option h...

curl security update

7.76.1-19.el91.1 - fix POST following PUT confusion CVE-2022-32221...

Moderate: Red Hat Security Advisory: curl security update

An update for curl is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

curl: POST following PUT confusion

A vulnerability was found in curl. The issue occurs when doing HTTPS transfers, where curl might erroneously use the read callback CURLOPTREADFUNCTION to ask for data to send, even when the CURLOPTPOSTFIELDS option has been set if it previously used the same handle to issue a PUT request which us...

PT-2023-33357 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.4.227 Description: The issue is related to an errant put in the error path of the drm/shmem-helper. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versio...

PT-2023-33886 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.16 Description: The issue is related to a missing put device in mport cdev open, which may potentially lead to security vulnerabilities. The actual impact and attack plausibility have not yet been proven...

PT-2023-33157 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.12 Description: The issue is related to a server-active leak in the afs put server function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions...

A User Can Unblock Themself

Description PUT /api/v1/users/id API doesn't properly check the authorizaion. Proof of Concept 1. admin Enable user registration functionality. 2. user Register new user and login as them. 3. user Create OAuth client. 4. admin Block the new user on admin panel. 5. user Send the following request:...

Huawei EulerOS: Security Advisory for curl (EulerOS-SA-2023-1095)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

UBUNTU-CVE-2022-47655

Libde265 1.0.9 is vulnerable to Buffer Overflow in function void putqpelfallback...

PT-2024-15212 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux Kernel affected versions not specified Description: The issue is related to a use-after-free UAF error during the iommufd put object function call. Recommendations: At the moment, there is no information about a newer version that...

Patient ability to rewrite it's own documents leads to HTML injection

Description It looks like through the PUT request, a Patient can rewrite it's own document via the fullDocument JSON parameter. In this way a malicious user patient can't override the document form and rewrite his own, also injecting valid HTML code that the Doctor would be able to see. Proof of...

The vulnerability of the cURL command-line utility arises from a logical error in the reused descriptor, which allows a hacker to trigger a service failure or cause other adverse effects on the system when processing subsequent HTTP requests like PUT and POST.

The vulnerability of the command-line tool cURL is related to a logical error in the reused descriptor during the processing of subsequent HTTP requests like PUT and POST. Exploiting this vulnerability can allow an attacker to cause service failures or other adverse effects on the system by using...