CVE-2023-22374

A format string vulnerability exists in iControl SOAP that allows an authenticated attacker to crash the iControl SOAP CGI process or, potentially execute arbitrary code. In appliance mode BIG-IP, a successful exploit of this vulnerability can allow the attacker to cross a security boundary. Note...

CVE-2023-22374

A format string vulnerability exists in iControl SOAP that allows an authenticated attacker to crash the iControl SOAP CGI process or, potentially execute arbitrary code. In appliance mode BIG-IP, a successful exploit of this vulnerability can allow the attacker to cross a security boundary. Note...

Format string

A format string vulnerability exists in iControl SOAP that allows an authenticated attacker to crash the iControl SOAP CGI process or, potentially execute arbitrary code. In appliance mode BIG-IP, a successful exploit of this vulnerability can allow the attacker to cross a security boundary. Note...

CVE-2023-22374 iControl SOAP vulnerability

A format string vulnerability exists in iControl SOAP that allows an authenticated attacker to crash the iControl SOAP CGI process or, potentially execute arbitrary code. In appliance mode BIG-IP, a successful exploit of this vulnerability can allow the attacker to cross a security boundary. Note...

CVE-2023-22374

CVE-2023-22374 affects F5 BIG-IP iControl SOAP with a format-string vulnerability that can crash the iControl SOAP CGI process or allow potentially arbitrary command execution for authenticated attackers. Affected BIG-IP branches and vulnerable versions (per K000130415): 17.x (17.0.0) fixed in 17...

CVE-2023-22374: F5 BIG-IP Format String Vulnerability

While following up our previous work on F5's BIG-IP devices, Rapid7 found an additional vulnerability in the appliance-mode REST interface; the vulnerability was assigned CVE-2023-22374. We reported it to F5 on December 6, 2022, and are now disclosing it in accordance with our vulnerability...

Security Bulletin: IBM Spectrum Scale GUI is vulnerable to "Format string attack" (CVE-2022-43869)

Summary A security vulnerability has been identified in IBM Spectrum Scale GUI where an input string could be evaluated as a command by the application. A fix for this vulnerability is available. Vulnerability Details CVEID:CVE-2022-43869 DESCRIPTION: IBM Spectrum Scale could allow an authenticat...

Exploit for Improper Input Validation in Cisco Ios

Cisco-Smart-Exploit Cisco SmartInstall Exploit CVE-2018-0171...

CVE-2023-0599: Improper Neutralization of Input During Web Page Generation

Rapid7 Metasploit Pro versions 4.21.2 and lower suffer from a stored cross site scripting vulnerability, due to a lack of JavaScript request string sanitization. Using this vulnerability, an authenticated attacker can execute arbitrary HTML and script code in the target browser against another...

PT-2023-7312 · F5 · Big-Ip

Name of the Vulnerable Software and Affected Versions: BIG-IP versions 13.1.5 through 17.0.0 Description: A format string vulnerability exists in iControl SOAP that allows an authenticated attacker to crash the iControl SOAP CGI process or potentially execute arbitrary code. In appliance mode...

CVE-2023-22374: Use of Externally-Controlled Format String

A format string vulnerability exists in iControl SOAP that allows an authenticated attacker to crash the iControl SOAP CGI process or, potentially execute arbitrary code. In appliance mode BIG-IP, a successful exploit of this vulnerability can allow the attacker to cross a security boundary. Note...

F5 BIG-IP Format String Error Vulnerability

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. An elevation of privilege vulnerability exists in F5 iControl SOAP, which can be exploited by an authenticated attacker to...

nodejs-moment: Regular expression denial of service

The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a crafted date string, a different vulnerability than CVE-2016-4055...

nodejs-moment: Regular expression denial of service

The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a crafted date string, a different vulnerability than CVE-2016-4055...

Debian dla-3299 : node-qs - security update

The remote Debian 10 host has a package installed that is affected by a vulnerability as referenced in the dla-3299 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3299-1 [email protected] https://www.debian.org/lts/security/...

Cacti poll_for_data Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Cacti. Authentication is not required to exploit this vulnerability. The specific flaw exists within the pollfordata function. The issue results from the lack of proper validation of a user-supplied...

NetScaler HTTP-ECV monitor probe fails and returns "404 Not Found" response code

The HTTP-ECV monitor fails and returns the 404 Not Found response code. For example, a monitor of the HTTP-ECV type was configured to monitor the status of a backend server using the following as the expected response string: "Response is Successful." The status of the related service was marked ...

Huawei EulerOS: Security Advisory for tcl (EulerOS-SA-2023-1298)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

In pkgconf through 1.9.3 variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For example a .pc file containing a few hundred bytes can expand to one billion bytes.

...

EulerOS Virtualization 3.0.2.2 : rsyslog (EulerOS-SA-2023-1291)

According to the versions of the rsyslog packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The zmq3 input and output modules in rsyslog before 8.28.0 interpreted description fields as format strings, possibly allowing a...