Debian dsa-5800 : xnest - security update

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5800 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5800-1 [email protected] https://www.debian.org/security/...

Vulnerability of the Server component: The Information Schema of the Oracle MySQL Server database management system, which allows a hacker to cause a service failure.

Vulnerability of the Server component: The information schema of the Oracle MySQL Server database management system is related to insufficient validation of input data. Exploiting this vulnerability may allow a malicious actor to cause service interruptions using the MySQL network protocol...

OESA-2024-2287 mysql security update

The MySQLTM software delivers a very fast, multi-threaded, multi-user, and robust SQL Structured Query Language database server. MySQL Server is intended for mission-critical, heavy-load production systems as well as for embedding into mass-deployed software. MySQL is a trademark of Oracle and/or...

CVE-2024-47901

A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber All versions V8.2.12, InterMesh 7707 Fire Subscriber All versions V7.2.12 only if the IP interface is enabled which is not the default configuration. The web server of affected devices does not sanitize the input paramete...

CVE-2024-21134

...

CVE-2024-21127

...

Unspecified Vulnerability in Oracle MySQL Server (CNVD-2024-42451)

Oracle MySQL Server is a relational database from Oracle Corporation. A security vulnerability exists in Oracle MySQL Server, which can be exploited by attackers to cause MySQL Server to hang or crash frequently and repeatedly...

Remote Denial Of Service (DoS)

org.eclipse.jetty, jetty-server is vulnerable to a Remote Denial-of-Service DoS. The vulnerability is due to the ThreadLimitHandler.getRemote method, which allows unauthorized users to send crafted requests that trigger OutOfMemory errors and exhaust the server's memory...

CVE-2024-49366 Nginx UI's json field can construct a directory traversal payload, causing arbitrary files to be written

Nginx UI is a web user interface for the Nginx web server. Nginx UI v2.0.0-beta.35 and earlier gets the value from the json field without verification, and can construct a value value in the form of ../../. Arbitrary files can be written to the server, which may result in loss of permissions...

The vulnerability of the Navidrome media server, related to the lack of protective measures for the SQL query structure, allows attackers to execute arbitrary code and disclose the protected information.

The vulnerability of the Navidrome media server relates to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code and disclose sensitive information by sending specially crafted SQL queries...

Admidio Vulnerable to HTML Injection In The Messages Section

An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server...

The vulnerability of the Core server component of Oracle WebLogic Server, a software platform of Oracle Fusion Middleware, allows an attacker to gain full access to the vulnerable software.

The vulnerability of the Core server component of Oracle WebLogic Server, a software platform of Oracle Fusion Middleware, is related to errors in processing input data. Exploiting this vulnerability allows an attacker, operating remotely, to gain full access to the vulnerable software by sending...

AZL-50366 CVE-2024-21219 affecting package mysql for versions less than 8.0.40-1

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DML. Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromi...

CVE-2024-21196

CVE-2024-21196 affects the Oracle MySQL Server (component: Server: X Plugin). Affected versions are 8.0.39 and earlier, 8.4.2 and earlier, and 9.0.1 and earlier. The description states that a low-privileged attacker with network access via multiple protocols can exploit this to cause the MySQL Se...

CVE-2024-48914

Summary (CVE-2024-48914): Vendure’s asset server plugin allows an attacker to traverse the server filesystem and read arbitrary files, including configs and environment data, due to using the decoded request path directly in path.join (no normalization). A second vector in the same code path can ...

CVE-2024-46898

SHIRASAGI prior to v1.19.1 processes URLs in HTTP requests improperly, resulting in a path traversal vulnerability. If this vulnerability is exploited, arbitrary files on the server may be retrieved when processing crafted HTTP requests...

The vulnerability of the Remote Desktop Protocol Server, which handles remote desktop connections for Windows operating systems, allows a hacker to execute arbitrary code.

The vulnerability of the Remote Desktop Protocol Server for Windows operating systems relates to the use of memory after it is freed. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2024-42640

CVE-2024-42640 affects the Angular-base64-upload library prior to v0.1.21. The root cause is unauthenticated remote code execution via the demo/server.php endpoint, allowing an attacker to upload arbitrary content that can be accessed at demo/uploads and executed on the server. Affected packages ...

CVE-2024-43582

Remote Desktop Protocol Server Remote Code Execution Vulnerability...

Exposure Of Information Through Directory Listing

@saltcorn/server is vulnerable to Exposure of Information Through Directory Listing. The vulnerability is due to missing validations of the builddirname parameter. This allows an attacker with admin permission to view files and directories on the filesystem...