CVE-2024-9999

CVE-2024-9999 affects Progress WS_FTP Server prior to version 8.8.9 (2022.0.9). The root cause is an incorrect implementation of the authentication algorithm in the Web Transfer Module, allowing bypass of the second-factor verification and login with username and password only. Impact described i...

CVE-2024-52010 Zoraxy has an authenticated command injection in the Web SSH feature

Zoraxy is a general purpose HTTP reverse proxy and forwarding tool. A command injection vulnerability in the Web SSH feature allows an authenticated attacker to execute arbitrary commands as root on the host. Zoraxy has a Web SSH terminal feature that allows authenticated users to connect to SSH...

CVE-2024-52010

CVE-2024-52010 concerns Zoraxy, a general-purpose HTTP reverse proxy/forwarding tool, with a vulnerability in the Web SSH feature. In HandleCreateProxySession , the request to create an SSH session handles a user-supplied username that can be injected into the sshCommand ; the username is not val...

CVE-2024-50560

Summary (CVE-2024-50560) Siemens industrial devices including RUGGEDCOM RM1224 LTE, SCALANCE M families, S615, W-series, MUM-series, and related products are affected by an input-validation vulnerability that causes truncation of usernames longer than 15 characters when accessed via SSH or Telnet...

CVE-2024-50560

A vulnerability has been identified in RUGGEDCOM RM1224 LTE4G EU 6GK6108-4AM00-2BA2 All versions V8.2, RUGGEDCOM RM1224 LTE4G NAM 6GK6108-4AM00-2DA2 All versions V8.2, SCALANCE M804PB 6GK5804-0AP00-2AA2 All versions V8.2, SCALANCE M812-1 ADSL-Router 6GK5812-1AA00-2AA2 All versions V8.2, SCALANCE...

PT-2024-8729 · Siemens · Scalance Wam766-1 +14

Name of the Vulnerable Software and Affected Versions: RUGGEDCOM RM1224 LTE4G EU versions V8.2 RUGGEDCOM RM1224 LTE4G NAM versions V8.2 SCALANCE M804PB versions V8.2 SCALANCE M812-1 ADSL-Router versions V8.2 SCALANCE M816-1 ADSL-Router versions V8.2 SCALANCE M826-2 SHDSL-Router versions V8.2...

Wazifa System logincontrol.php file SQL Injection Vulnerability

Wazifa System is a content management system. Wazifa System suffers from a SQL injection vulnerability that originates from a lack of validation of externally entered SQL statements in the parameter username in the file /controllers/logincontrol.php. An attacker can use this vulnerability to...

Malicious code in byted-flux (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a8424c4934716d4a7390731613807c89bca1d0f11a56e3062dacef247d859e80 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

Malicious code in byteff (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a56aa5a63bf5b3ed081b62351f3aedb42fd6c2e834ab240922247add79aee664 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

Malicious code in cascadev (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5ab2dd918716f1e2d0da5f75506d3929f160ef65f790729059b4803d50443b27 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

Malicious code in bytedsp (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 66e4cc5b96bf24d76cba76d3ffd653ae5eddc1926ddd0406c372d62a62cc7052 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

Malicious code in byted-flex (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f7c46f02d189ba471aba10b985193a2e0476f4f7f9f6e068ddf3fe79c2088ea1 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

Malicious code in byte-flux-3822a6dd00d6414daba3ae0de3930a5a (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 cec00e10a19e19684fc4887fa09aa1025aafc00f1121baacdf55f0c3b2ba9aec A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

Malicious code in bytepilot-0-0-15 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 608d6f9a817cfe14b72754d3b6b3dea5967d82b8932a06092b6ab752f0a42e02 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

Malicious code in bytep (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8ab7e80f551a6d38ee9f4ee2163f0cb195257d40fb013074ff8887a8d70111ab A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

Malicious code in bytesp (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ddcbb6dd1dd58abad76edbd33cb16d40223a2a4da723c3998bdf83d639d2de8f A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

Malicious code in bytekafka0-0-15 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0f3f2cbd161379b1f474af51611780606cf694273c13d7f0db7bb3869f03de02 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

python-django: Username enumeration through timing difference for users with unusable passwords

A vulnerability was found in Python-Django in the django.contrib.auth.backends.ModelBackend.authenticate method. This flaw allows remote attackers to enumerate users via a timing attack involving login requests for users with unusable passwords...

CVE-2024-10842

A vulnerability, which was classified as problematic, has been found in romadebrian WEB-Sekolah 1.0. Affected by this issue is some unknown functionality of the file /Admin/ProsesEditAkun.php of the component Backend. The manipulation of the argument UsernameBaru/Password leads to cross site...

Malicious code in bytesap (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4eec30f2d541d35548fef109eb76c972e92203c749f615aa08f976fb9b0c2a03 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...