CVE-2024-52043 User enumeration in HubHub

Generation of Error Message Containing Sensitive Information in HumHub GmbH & Co. KG - HumHub on Linux allows: Excavation user enumeration.This issue affects all released HumHub versions: through 1.16.2...

PT-2024-35101 · Humhub · Humhub

Name of the Vulnerable Software and Affected Versions: HumHub versions through 1.16.2 Description: The issue affects HumHub, allowing excavation through user enumeration due to an observable response discrepancy. This discrepancy can lead to the generation of error messages containing sensitive...

Security Bulletin: IBM Sterling Control Center is vulnerable to User Enumeration

Summary User Enumeration is affecting v6.2.1 and v6.3.1. Vulnerability Details CVEID:CVE-2024-35114 DESCRIPTION: IBM Sterling Control Center could allow a remote attacker to enumerate usernames due to an observable discrepancy between login attempts. CWE:CWE-204: Observable Response Discrepancy...

freeradius: forgery attack

A vulnerability in the RADIUS Remote Authentication Dial-In User Service protocol allows attackers to forge authentication responses when the Message-Authenticator attribute is not enforced. This issue arises from a cryptographically insecure integrity check using MD5, enabling attackers to spoof...

GO-2024-3234 Mattermost Server vulnerable to application crash from attacker-generated large response in github.com/mattermost/mattermost-server

Mattermost Server vulnerable to application crash from attacker-generated large response in github.com/mattermost/mattermost-server...

CVE-2024-51556

This vulnerability exists in the Wave 2.0 due to insufficient encryption of sensitive data received at the API response. An authenticated remote attacker could exploit this vulnerability by manipulating API input parameters through API request URL/payload leading to unauthorized access to sensiti...

freeradius: forgery attack

A vulnerability in the RADIUS Remote Authentication Dial-In User Service protocol allows attackers to forge authentication responses when the Message-Authenticator attribute is not enforced. This issue arises from a cryptographically insecure integrity check using MD5, enabling attackers to spoof...

RHEL 6 / 7 : rh-nodejs4-nodejs and rh-nodejs4-http-parser (RHSA-2017:0002)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:0002 advisory. Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an...

RHEL 7 : rabbitmq-server (RHSA-2016:0308)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2016:0308 advisory. RabbitMQ is an implementation of AMQP, the emerging standard for high performance enterprise messaging. The RabbitMQ server is a robust and...

SUSE CVE-2024-47067

AList is a file list program that supports multiple storages. AList contains a reflected cross-site scripting vulnerability in helper.go. The endpoint /i/:linkname takes in a user-provided value and reflects it back in the response. The endpoint returns an application/xml response, opening it up ...

Exploit for Code Injection in Vmware Spring_Framework

Project Spring4Shell CVE-2022-22965 Blocker Firewall Se...

openSUSE Security Advisory (SUSE-SU-2024:3861-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLES15: apache2-mod_uwsgi / uwsgi / uwsgi-emperor_pg / uwsgi-emperor_zeromq / etc (SUSE-SU-2024:3861-1)

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:3861-1 advisory. - CVE-2024-24795: Fixed HTTP Response Splitting in multiple modules bsc1222332 Tenable has extracted the preceding description block...

BIT-CONSUL-2024-10086 Consul Vulnerable To Reflected XSS On Content-Type Error Manipulation

A vulnerability was identified in Consul and Consul Enterprise such that the server response did not explicitly set a Content-Type HTTP header, allowing user-provided inputs to be misinterpreted and lead to reflected XSS...

Security update for uwsgi

This update for uwsgi fixes the following issues: CVE-2024-24795: Fixed HTTP Response Splitting in multiple modules bsc1222332 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the...

SUSE-SU-2024:3861-1 Security update for uwsgi

This update for uwsgi fixes the following issues: - CVE-2024-24795: Fixed HTTP Response Splitting in multiple modules bsc1222332...

CVE-2024-10613

CVE-2024-10613 affects ESAFENET CDG 5, specifically the delSystemEncryptPolicy function in /com/esafenet/servlet/system/SystemEncryptPolicyService.java. The vulnerability arises from improper handling of the id argument, enabling SQL injection. Remote exploitation is possible, and public disclosu...

CVE-2024-10612

CVE-2024-10612 affects ESAFENET CDG 5, impacting the function removeHookInvalidCourse in /com/esafenet/servlet/system/HookInvalidCourseService.java. The vulnerability arises from improper handling of the id parameter, enabling SQL injection and potentially enabling remote attack. Public exploit d...

CVE-2024-10611 ESAFENET CDG PrintScreenListService.java delProtocol sql injection

A vulnerability was found in ESAFENET CDG 5 and classified as critical. This issue affects the function delProtocol of the file /com/esafenet/servlet/system/PrintScreenListService.java. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit h...

CVE-2024-10611

CVE-2024-10611 affects ESAFENET CDG v5, with a SQL injection in the delProtocol function of /com/esafenet/servlet/system/PrintScreenListService.java caused by unsafely handling the id argument. This can be exploited remotely; public exploit details exist and vendor response was unavailable. Relat...