Rocky Linux 9 : php:8.1 (RLSA-2024:0387)

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:0387 advisory. - In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, passwordverify function may accept some invalid Blowfish hashes as valid. If...

Fedora 38 : wordpress (2024-df1cdcb0de)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-df1cdcb0de advisory. WordPress 6.4.3 Maintenance and Security release See upstream announcement Security updates included in this release m4tuto for finding a PHP File Upload...

Fedora 39 : wordpress (2024-2b30739a76)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-2b30739a76 advisory. WordPress 6.4.3 Maintenance and Security release See upstream announcement Security updates included in this release m4tuto for finding a PHP File Upload...

Metasploit Weekly Wrap-Up 02/09/2024

Go go gadget Fortra GoAnywhere MFT Module This Metasploit release contains a module for one of 2024's hottest vulnerabilities to date: CVE-2024-0204. The path traversal vulnerability in Fortra GoAnywhere MFT allows for unauthenticated attackers to access the InitialAccountSetup.xhtml endpoint whi...

CVE-2023-50292 Apache Solr: Solr Schema Designer blindly "trusts" all configsets, possibly leading to RCE by unauthenticated users

Incorrect Permission Assignment for Critical Resource, Improper Control of Dynamically-Managed Code Resources vulnerability in Apache Solr. This issue affects Apache Solr: from 8.10.0 through 8.11.2, from 9.0.0 before 9.3.0. The Schema Designer was introduced to allow users to more easily configu...

WordPress NextMove Lite Plugin <= 2.17.0 is vulnerable to Remote Code Execution (RCE)

Software NextMove Lite Type Plugin Vulnerable versions = 2.17.0 Fixed in 2.18.0 OWASP Top 10 A1: Broken Access Control Classification Remote Code Execution RCE CVE CVE-2024-25092 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 2181c91c736b Credits Yudistira Arya Required...

JetBrains TeamCity < 2023.11.3 Multiple Vulnerabilities

The version of JetBrains TeamCity installed on the remote host is prior to 2023.11.3. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2023.11.3 path traversal allowed reading data within JAR archives CVE-2024-24942 - In JetBrains TeamCity before 2023.11.3...

Design/Logic Flaw

An issue was discovered in Atos Unify OpenScape Xpressions WebAssistant V7 before V7R1 FR5 HF42 P911. It allows authenticated remote code execution via file upload...

Exploit for Code Injection in Apache Commons_Text

Install maven - maven-linuxhttps://www.digitalocean.com/c...

GHSA-C352-X843-GGPQ XXL-JOB vulnerable to Server-Side Request Forgery

xxl-job = 2.4.2 has a Server-Side Request Forgery SSRF vulnerability, which causes low-privileged users to control executor to RCE...

CVE-2024-24113

xxl-job = 2.4.1 has a Server-Side Request Forgery SSRF vulnerability, which causes low-privileged users to control executor to RCE...

CVE-2024-24113

xxl-job = 2.4.1 has a Server-Side Request Forgery SSRF vulnerability, which causes low-privileged users to control executor to RCE...

CVE-2024-24216

Zentao v18.0 to v18.10 was discovered to contain a remote code execution RCE vulnerability via the checkConnection method of /app/zentao/module/repo/model.php...

CVE-2024-24113

CVE-2024-24113 (XXL-JOB) : A Server-Side Request Forgery (SSRF) in xxl-job allows low-privilege users to control the executor and potentially achieve Remote Code Execution. Affected: xxl-job versions prior to 2.4.1 (≤ 2.4.1). Root cause cited in Veracode report: improper validation of user-suppli...

CVE-2024-24216

CVE-2024-24216 affects Zentao versions 18.0–18.10, where a remote code execution is possible via the checkConnection method in /app/zentao/module/repo/model.php. Root cause is associated with the checkConnection functionality exposed by that endpoint; the vulnerability has a high impact on confid...

CVE-2023-40263

Summary: CVE-2023-40263 affects Atos Unify OpenScape Voice Trace Manager on versions prior to V8 R0.9.11 and enables an authenticated command injection via FTP. The Red Hat and NVD entries corroborate the vulnerability details and indicate a high-severity impact with network access and low privil...

CVE-2024-24113

xxl-job = 2.4.1 has a Server-Side Request Forgery SSRF vulnerability, which causes low-privileged users to control executor to RCE...

Critical: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.7.11 security and bug fix container update

Red Hat Advanced Cluster Management for Kubernetes 2.7.11 General Availability release images, which provide security updates and fix bugs. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a...

Critical: Red Hat Security Advisory: OpenShift Container Platform 4.14.11 bug fix and security update

An update is now available for Red Hat OpenShift Container Platform 4.14. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

Important: Red Hat Security Advisory: gimp security update

An update for gimp is now available for Red Hat Enterprise Linux 9.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...