sidekiq-unique-jobs UI server vulnerable to XSS & RCE in Redis

Cross site scripting XSS potentially exposing cookies / sessions / localStorage, fixed by sidekiq-unique-jobs v8.0.7. Details Specially crafted URL query parameters handled by any of the following endpoints of sidekiq-unique-jobs' "admin" web UI, allow a super-user attacker, or an unwitting, but...

February Fortinet Advisory: everything you need to know

Fortinet offers guidance to detect and mitigate CVE-2024-21762 and CVE-2024-23113, critical RCE vulnerabilities in FortiOS and FortiProxy, including guidance that organizations should patch urgently...

Important: Red Hat Security Advisory: Jenkins and Jenkins-2-plugins security update

An update for Jenkins and Jenkins-2-plugins is now available for OpenShift Developer Tools and Services for OCP 4.12. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Important: Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

An update for jenkins and jenkins-2-plugins is now available for OpenShift Developer Tools and Services for OCP 4.14. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Important: Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

An update for jenkins and jenkins-2-plugins is now available for OpenShift Developer Tools and Services for OCP 4.13. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Rocky Linux 9 : php:8.1 (RLSA-2024:0387)

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:0387 advisory. - In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, passwordverify function may accept some invalid Blowfish hashes as valid. If...

Fedora 38 : wordpress (2024-df1cdcb0de)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-df1cdcb0de advisory. WordPress 6.4.3 Maintenance and Security release See upstream announcement Security updates included in this release m4tuto for finding a PHP File Upload...

Fedora 39 : wordpress (2024-2b30739a76)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-2b30739a76 advisory. WordPress 6.4.3 Maintenance and Security release See upstream announcement Security updates included in this release m4tuto for finding a PHP File Upload...

Metasploit Weekly Wrap-Up 02/09/2024

Go go gadget Fortra GoAnywhere MFT Module This Metasploit release contains a module for one of 2024's hottest vulnerabilities to date: CVE-2024-0204. The path traversal vulnerability in Fortra GoAnywhere MFT allows for unauthenticated attackers to access the InitialAccountSetup.xhtml endpoint whi...

CVE-2023-50292 Apache Solr: Solr Schema Designer blindly "trusts" all configsets, possibly leading to RCE by unauthenticated users

Incorrect Permission Assignment for Critical Resource, Improper Control of Dynamically-Managed Code Resources vulnerability in Apache Solr. This issue affects Apache Solr: from 8.10.0 through 8.11.2, from 9.0.0 before 9.3.0. The Schema Designer was introduced to allow users to more easily configu...

WordPress NextMove Lite Plugin <= 2.17.0 is vulnerable to Remote Code Execution (RCE)

Software NextMove Lite Type Plugin Vulnerable versions = 2.17.0 Fixed in 2.18.0 OWASP Top 10 A1: Broken Access Control Classification Remote Code Execution RCE CVE CVE-2024-25092 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 2181c91c736b Credits Yudistira Arya Required...

JetBrains TeamCity < 2023.11.3 Multiple Vulnerabilities

The version of JetBrains TeamCity installed on the remote host is prior to 2023.11.3. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2023.11.3 path traversal allowed reading data within JAR archives CVE-2024-24942 - In JetBrains TeamCity before 2023.11.3...

Design/Logic Flaw

An issue was discovered in Atos Unify OpenScape Xpressions WebAssistant V7 before V7R1 FR5 HF42 P911. It allows authenticated remote code execution via file upload...

Exploit for Code Injection in Apache Commons_Text

Install maven - maven-linuxhttps://www.digitalocean.com/c...

GHSA-C352-X843-GGPQ XXL-JOB vulnerable to Server-Side Request Forgery

xxl-job = 2.4.2 has a Server-Side Request Forgery SSRF vulnerability, which causes low-privileged users to control executor to RCE...

CVE-2024-24113

xxl-job = 2.4.1 has a Server-Side Request Forgery SSRF vulnerability, which causes low-privileged users to control executor to RCE...

CVE-2024-24113

xxl-job = 2.4.1 has a Server-Side Request Forgery SSRF vulnerability, which causes low-privileged users to control executor to RCE...

CVE-2024-24216

Zentao v18.0 to v18.10 was discovered to contain a remote code execution RCE vulnerability via the checkConnection method of /app/zentao/module/repo/model.php...

CVE-2024-24113

CVE-2024-24113 (XXL-JOB) : A Server-Side Request Forgery (SSRF) in xxl-job allows low-privilege users to control the executor and potentially achieve Remote Code Execution. Affected: xxl-job versions prior to 2.4.1 (≤ 2.4.1). Root cause cited in Veracode report: improper validation of user-suppli...

CVE-2024-24216

CVE-2024-24216 affects Zentao versions 18.0–18.10, where a remote code execution is possible via the checkConnection method in /app/zentao/module/repo/model.php. Root cause is associated with the checkConnection functionality exposed by that endpoint; the vulnerability has a high impact on confid...