CVE-2024-24760 Mailcow Docker Container Exposure to Local Network

mailcow is a dockerized email package, with multiple containers linked in one bridged network. A security vulnerability has been identified in mailcow affecting versions 2024-01c. This vulnerability potentially allows attackers on the same subnet to connect to exposed ports of a Docker container,...

TOTOLINK A3300R setUrlFilterRules Method Command Injection Vulnerability

TOTOLINK A3300R is a dual-band wireless router manufactured by China's Gion Electronics TOTOLINK, mainly used for home and small network environments. The TOTOLINK A3300R suffers from a command injection vulnerability that stems from the url parameter of the setUrlFilterRules method failing to...

CFPB’s Proposed Data Rules

In October, the Consumer Financial Protection Bureau CFPB proposed a set of rules that if implemented would transform how financial institutions handle personal data about their customers. The rules put control of that data back in the hands of ordinary Americans, while at the same time undermini...

TrueLayer.Client SSRF when fetching payment or payment provider

Impact The vulnerability could potentially allow a malicious actor to gain control over the destination URL of the HttpClient used in the API classes. For applications using the SDK, requests to unexpected resources on local networks or to the internet could be made which could lead to informatio...

Server-Side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-Side Request Forgery SSRF via the process of fetching payment or payment provider information. An attacker can gain control over the destination URL of the HttpClient used in the API classes, leading to requests to unexpected...

GHSA-67M4-QXP3-J6HH TrueLayer.Client SSRF when fetching payment or payment provider

Impact The vulnerability could potentially allow a malicious actor to gain control over the destination URL of the HttpClient used in the API classes. For applications using the SDK, requests to unexpected resources on local networks or to the internet could be made which could lead to informatio...

Server-Side Template Injection Vulnerability in Confluence Data Center and Server (CVE-2023-22527)

Introduction On January 16 2024, Atlassian issued a ​​significant alert on a critical Server-Side Template Injection SSTI vulnerability in Confluence Data Center and Server, identified as CVE-2023-22527. This issue found in older versions, poses a serious risk as it allows attackers without any...

CVE-2024-23838

TrueLayer.NET is the .Net client for TrueLayer. The vulnerability could potentially allow a malicious actor to gain control over the destination URL of the HttpClient used in the API classes. For applications using the SDK, requests to unexpected resources on local networks or to the internet cou...

Information disclosure

TrueLayer.NET is the .Net client for TrueLayer. The vulnerability could potentially allow a malicious actor to gain control over the destination URL of the HttpClient used in the API classes. For applications using the SDK, requests to unexpected resources on local networks or to the internet cou...

CVE-2024-23838 TrueLayer.Client SSRF when fetching payment or payment provider

TrueLayer.NET is the .Net client for TrueLayer. The vulnerability could potentially allow a malicious actor to gain control over the destination URL of the HttpClient used in the API classes. For applications using the SDK, requests to unexpected resources on local networks or to the internet cou...

CVE-2024-23838

TrueLayer.NET (the .NET client for TrueLayer) has a SSRF-type issue where an attacker could manipulate the destination URL used by HttpClient in the API classes, potentially causing requests to local network resources or external destinations and leading to information disclosure. Affected: TrueL...

CVE-2024-23838 TrueLayer.Client SSRF when fetching payment or payment provider

TrueLayer.NET is the .Net client for TrueLayer. The vulnerability could potentially allow a malicious actor to gain control over the destination URL of the HttpClient used in the API classes. For applications using the SDK, requests to unexpected resources on local networks or to the internet cou...

CVE-2024-23838 TrueLayer.Client SSRF when fetching payment or payment provider

TrueLayer.NET is the .Net client for TrueLayer. The vulnerability could potentially allow a malicious actor to gain control over the destination URL of the HttpClient used in the API classes. For applications using the SDK, requests to unexpected resources on local networks or to the internet cou...

CVE-2024-24329

TOTOLINK A3300R V17.0.0cu.557B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setPortForwardRules function...

CVE-2024-0564

A flaw was found in the Linux kernel's memory deduplication mechanism. The max page sharing of Kernel Samepage Merging KSM, added in Linux kernel version 4.4.0-96.119, can create a side channel. When the attacker and the victim share the same host and the default setting of KSM is "max page...

TOTOLINK A3300R 安全漏洞

TOTOLINK A3300R is a wireless router from China's Gion Electronics TOTOLINK. A command injection vulnerability exists in the TOTOLINK A3300R version V17.0.0cu.557B20221024, which stems from the enable parameter of the setPortForwardRules method failing to correctly filter construct command specia...

PT-2024-20114 · Truelayer · Truelayer.Client +1

Name of the Vulnerable Software and Affected Versions: TrueLayer.Client versions prior to v1.6.0 Description: The issue could potentially allow a malicious actor to gain control over the destination URL of the HttpClient used in the API classes. For applications using the SDK, requests to...

PT-2024-1545 · Totolink · Totolink A3300R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3300R version V17.0.0cu.557 B20221024 Description: The issue exists due to the lack of measures to neutralize special elements in the setStaticDhcpRules function of the TOTOLINK A3300R router's firmware. This allows a remote attacke...

TOTOLINK N200RE setParentalRules function buffer overflow vulnerability

The TOTOLINK N200RE is a wireless router for the SOHO market. The TOTOLINK N200RE suffers from a buffer overflow vulnerability that originates from a stack-based buffer overflow in the eTime parameter of the setParentalRules function of /cgi-bin/cstecgi.cgi. No detailed vulnerability details are...

The vulnerability of the setParentalRules() function in the cstecgi.cgi script of the Totolink N200RE router’s microprogramming system, which allows a violator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the setParentalRules function in the cstecgi.cgi script of the Totolink N200RE router’s microprogramming system is related to the issue of the operation exceeding the buffer in memory when processing the parameters eTime, week, and sTime. Exploiting this vulnerability could...