11317 matches found
CVE-2024-25737
A Server-Side Request Forgery SSRF vulnerability in the /Cover/Show route showAction in CoverController.php in Open Library Foundation VuFind 2.4 through 9.1 before 9.1.1 allows remote attackers to access internal HTTP servers and perform Cross-Site Scripting XSS attacks by proxying arbitrary URL...
CVE-2024-25737
VuFind 2.4–9.1 (pre-9.1.1) is affected by a Server-Side Request Forgery (SSRF) in the /Cover/Show route (ShowAction in CoverController.php). The vulnerability allows an attacker to proxy arbitrary URLs via the proxy GET parameter, enabling access to internal HTTP services and potentially enabling...
XAMPP Resource Management Error Vulnerability
XAMPP is an easy-to-install Apache distribution that includes MariaDB, PHP, and Perl. the product is primarily used for building web servers. A resource management error vulnerability exists in XAMPP 7.3.2 and earlier versions, which stems from a failure to properly handle incoming error messages...
Moderate: tigervnc security update
Virtual Network Computing VNC is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is a suite of VNC servers and clients...
ALSA-2024:3067 Moderate: tigervnc security update
Virtual Network Computing VNC is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is a suite of VNC servers and clients...
K000139685: Python vulnerability CVE-2023-40217
Security Advisory Description An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers such as HTTP servers that use TLS client authentication. If a TLS server-side socket is created, receives data into the...
UBUNTU-CVE-2023-52732
In the Linux kernel, the following vulnerability has been resolved: ceph: blocklist the kclient when receiving corrupted snap trace When received corrupted snap trace we don't know what exactly has happened in MDS side. And we shouldn't continue IOs and metadatas access to MDS, which may corrupt ...
ROS-20240521-06
A vulnerability in the RSA Key Exchange Handler component of the encryption and SSL toolkit for Python m2crypto is related to decryption of captured messages on TLS servers using RSA key exchange. Exploitation of the vulnerability could allow an attacker acting remotely, allowing an intruder to t...
New Readiness Check - Multiple Veeam Backup Servers Are Required by One Recovery Plan
Article Applicability This article documents a new Plan Readiness Check parameter in Veeam Recovery Orchestrator 7.1. Purpose This article documents a new addition to the Plan Readiness Check in Veeam Recovery Orchestrator VRO v7.1. This new check will be part of the Plan Readiness Check for all...
CVE-2024-35882
CVE-2024-35882 affects the Linux kernel SUNRPC over TCP, causing a slow server-side memory leak. A bisect identifies the first bad commit as e18e157bb5c8, which changed RPC message sending on TCP with a single sock_sendmsg() call. The issue occurs because sock_sendmsg() does not release all pages...
CVE-2024-34083 STARTTLS unencrypted commands injection
aiosmptd is a reimplementation of the Python stdlib smtpd.py based on asyncio. Prior to version 1.4.6, servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a man-in-the-middle...
Ebury A Potent Linux Botnet Infects Over 400K Servers
...
GHSA-CQH9-JFQR-H9JJ Withdrawn Advisory: Weights and Biases (wandb) has a Server-Side Request Forgery (SSRF) vulnerability
Withdrawn Advisory This advisory has been withdrawn because the underlying issue existed in Weights and Biases's backend server code, not the software development kit included in the wandb PyPI package, as originally reported. This link is maintained to preserve external references. Original...
CVE-2024-4642
CVE-2024-4642 is described in connected advisories as a Server-Side Request Forgery (SSRF) in the wandb/wandb repository, caused by improper handling of HTTP redirects (HTTP 302). The issue could allow team members with access to the Webhooks settings to reach internal HTTP(S) endpoints, with pot...
Nextcloud: Mail auto configurator can be tricked into sending account information to wrong servers
The mail auto configurator was vulnerable to being tricked into sending account information to unintended servers...
CVE-2024-35183 wolfictl leaks GitHub tokens to remote non-GitHub git servers
wolfictl is a command line tool for working with Wolfi. A git authentication issue in versions prior to 0.16.10 allows a local user’s GitHub token to be sent to remote servers other than github.com. Most git-dependent functionality in wolfictl relies on its own git package, which contains...
CVE-2024-35183
CVE-2024-35183 affects wolfictl (Wolfi) and involves a git authentication issue in versions before 0.16.10. The vulnerability arises from a GetGitAuth flow that reads a GitHub token from the GITHUB_TOKEN environment variable and uses it for HTTP basic auth with go-git, in cases where the remote r...
CVE-2024-35183 wolfictl leaks GitHub tokens to remote non-GitHub git servers
wolfictl is a command line tool for working with Wolfi. A git authentication issue in versions prior to 0.16.10 allows a local user’s GitHub token to be sent to remote servers other than github.com. Most git-dependent functionality in wolfictl relies on its own git package, which contains...
CVE-2024-35183 wolfictl leaks GitHub tokens to remote non-GitHub git servers
wolfictl is a command line tool for working with Wolfi. A git authentication issue in versions prior to 0.16.10 allows a local user’s GitHub token to be sent to remote servers other than github.com. Most git-dependent functionality in wolfictl relies on its own git package, which contains...