CVE-2024-50596

An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability affects t...

STMicroelectronics X-CUBE-AZRTOS-F7 HTTP server chunked PUT request integer underflow vulnerability

Talos Vulnerability Report TALOS-2024-2102 STMicroelectronics X-CUBE-AZRTOS-F7 HTTP server chunked PUT request integer underflow vulnerability April 2, 2025 CVE Number CVE-2024-50594,CVE-2024-50595 SUMMARY An integer underflow vulnerability exists in the HTTP server PUT request functionality of...

PT-2025-14501 · Stmicroelectronics · X-Cube-Azrtos-Wl +1

Name of the Vulnerable Software and Affected Versions: STMicroelectronics X-CUBE-AZRTOS-WL version 2.0.0 STMicroelectronics X-CUBE-AZRTOS-F7 NetX Duo Component HTTP Server version 1.1.0 Description: A denial of service issue exists in the NetX Component HTTP server functionality. This can be...

Security Bulletin: There is a vulnerability in jetty-server-9.4.53.v20231009.jar used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2024-6763)

Summary There is a vulnerability in jetty-server-9.4.53.v20231009.jar used by IBM Maximo Manage application in IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2024-6763 DESCRIPTION: Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includ...

Denial Of Service (DoS)

Aimhubio/aim is vulnerable to a Denial Of Service DoS. The vulnerability is due to the tracking server overriding the maximum size for websocket messages, allowing very large images to be tracked, which causes the server to become unresponsive to other requests...

PT-2025-14463 · Zabbix +3 · Zabbix Server +3

Name of the Vulnerable Software and Affected Versions: Zabbix server affected versions not specified Description: The Zabbix server is susceptible to a denial-of-service DoS issue due to uncontrolled resource exhaustion. An attacker can send specially crafted requests to the server, causing it to...

Atlassian Jira Service Management Data Center and Server 5.12.x < 5.12.19 (JSDSERVER-16083)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16083 advisory. - Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn...

USN-7399-1: RabbitMQ Server vulnerability

It was discovered that RabbitMQ Server's management UI did not sanitize certain input. An attacker could possibly use this issue to inject code by performing a cross-site scripting XSS attack...

CVE-2025-2865

SaTECH BCU, in its firmware version 2.1.3, could allow XSS attacks and other malicious resources to be stored on the web server. An attacker with some knowledge of the web application could send a malicious request to the victim users. Through this request, the victims would interpret the code...

Mattermost Server 9.11.x < 9.11.9 / 10.3.x < 10.3.4 / 10.4.x < 10.4.3 (MMSA-2025-00422)

The version of Mattermost Server installed on the remote host is prior to 9.11.9, 10.3.4, or 10.4.3. It is, therefore, affected by a vulnerability as referenced in the MMSA-2025-00422 advisory. - Mattermost versions 10.4.x = 10.4.2, 10.3.x = 10.3.3, 9.11.x = 9.11.8 fail to enforce MFA on certain...

Mattermost Server 10.4.x < 10.4.3 / 10.3.x < 10.3.4 /9.11.x < 9.11.9 / 10.5.x < 10.5.1 (MMSA-2025-00432)

The version of Mattermost Server installed on the remote host is prior to 10.4.4 / 10.3.4 / 9.11.9 / 10.5.1. It is, therefore, affected by a vulnerability as referenced in the MMSA-2025-00432 advisory. - Mattermost versions 10.4.x = 10.4.2, 10.3.x = 10.3.3, 9.11.x = 9.11.8, 10.5.x = 10.5.0 fail t...

HTTP Response Splitting

Overview pitchfork is a preforking HTTP server for Rack applications designed to minimize memory usage by maximizing Copy-on-Write performance. Affected versions of this package are vulnerable to HTTP Response Splitting due to improper request/response handling process. An attacker can manipulate...

CVE-2024-45482

An Inclusion of Functionality from Untrusted Control Sphere vulnerability in the SSH server on B APROL 4.4-00P1 may allow an authenticated local attacker from a trusted remote server to execute malicious commands...

PT-2025-25689

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description A flaw was found in the X server's request handling. Non-zero 'bytes to ignore' in a client's request can cause the server to skip processing another client's request, potentially leading to a...

GPT Academic File Read Vulnerability

GPT Academic is an interface that provides pragmatic interactions for LLM large language models such as GPT/GLM. A file read vulnerability exists in GPT Academic, which stems from a failure of the HotReload feature to properly validate user input, and can be exploited by an attacker to read...

Path Traversal

agentscope is vulnerable to Path Traversal. The vulnerability is due to improper input sanitization, where the /api/file endpoint does not properly validate the path parameter, allowing an attacker to traverse directories and access arbitrary files on the server...

openvpn -- server-side denial-of-service vulnerability with tls-crypt-v2

Gert Doering reports: OpenVPN servers between 2.6.1 and 2.6.13 using --tls-crypt-v2 can be made to abort with an ASSERT message by sending a particular combination of authenticated and malformed packets. To trigger the bug, a valid tls-crypt-v2 client key is needed, or network observation of a...

CVE-2024-45482

An Inclusion of Functionality from Untrusted Control Sphere vulnerability in the SSH server on B&R APROL 4.4-00P1 may allow an authenticated local attacker from a trusted remote server to execute malicious commands...

CVE-2024-45482

CVE-2024-45482 concerns the B&R APROL product. The SSH server in APROL versions prior to 4.4-00P1 may allow an authenticated local attacker from a trusted remote server to execute malicious commands due to an Inclusion of Functionality from an Untrusted Control Sphere vulnerability. Affected prod...

The vulnerability of the setWiFiScheduleCfg() function in the web/cgi-bin/cstecgi.cgi script of the TOTOLINK X5000R router’s microprogramming software allows a perpetrator to execute arbitrary commands.

The vulnerability of the setWiFiScheduleCfg function in the web/cgi-bin/cstecgi.cgi script of the TOTOLINK X5000R router’s microprogramming system is related to the failure to take measures to neutralize special elements used in the operating system’s processing of the sHour parameter. Exploiting...