Fedora 38 : xen (2024-a676697123)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-a676697123 advisory. x86: Native Branch History Injection XSA-456, CVE-2024-2201 update to xen 4.17.4, remove patches now included upstream rebase xen.gcc12.fixes.patch...

Django Debug Mode Enabled

Django is a free and open-source Python web application framework which offers a debug mode which allows developers to get additional information to help troubleshooting their applications including stack traces on error pages, exposing variables defined in your Django settings. A remote...

WSO2 Management Console Cross-Site Scripting

The management console of multiple WSO2 products suffer from a Cross-Site Scripting vulnerability : - WSO2 API Manager versions 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0, 4.0.0 - WSO2 API Manager Analytics versions 2.2.0, 2.5.0, 2.6.0 - WSO2 API Microgateway version 2.2.0 - WSO2 Data Analytics...

WordPress 6.2.x < 6.2.5 Cross-Site Scripting

According to its self-reported version number, the detected WordPress application is affected by a Cross-Site Scripting XSS vulnerability affecting the avatar block type. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version...

KB5036969: Windows Server 2012 Security Update (April 2024)

The remote Windows host is missing security update 5036969. It is, therefore, affected by multiple vulnerabilities - Microsoft WDAC SQL Server ODBC Driver Remote Code Execution Vulnerability CVE-2024-26214 - Secure Boot Security Feature Bypass Vulnerability CVE-2024-20669, CVE-2024-20688,...

Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2024-12270)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-12270 advisory. - netfilter: nftables: reject QUEUE/DROP verdict parameters Florian Westphal Orabug: 36467681 CVE-2024-1086 - netfilter: nftables: Reject tables of...

Exploit for Path Traversal in Apache Http_Server

CVE-2021-42013 Vulnerability Scanner This Python script check...

FreeBSD : Apache httpd -- multiple vulnerabilities (8e6f684b-f333-11ee-a573-84a93843eb75)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 8e6f684b-f333-11ee-a573-84a93843eb75 advisory. - HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that ca...

PrestaShop 1.7.7.0 SQL injection

Prestashop version 1.7.7.0 are vulnerable to an SQL Injection through 'idproducts' parameter of the the 'productcomments' module. No source data...

Siemens SCALANCE W1750D Buffer Overflow (CVE-2023-22785)

There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI Aruba's access point management protocol UDP port 8211. Successful exploitation of these vulnerabilities...

CVE-2024-27920

The CVE covers projectdiscovery/nuclei where unsigned code templates could be executed via workflows in Nuclei v3. root cause: oversight in workflow execution that allows executing unsigned templates. Impact: local execution with high severity per listed metrics; effects are mitigation-dependent ...

CVE-2024-27920 Unsigned code template execution through workflows in projectdiscovery/nuclei

projectdiscovery/nuclei is a fast and customisable vulnerability scanner based on simple YAML based DSL. A significant security oversight was identified in Nuclei v3, involving the execution of unsigned code templates through workflows. This vulnerability specifically affects users utilizing cust...

February 2024: Vulremi, Vuldetta, PT VM Course relaunch, PT TrendVulns digests, Ivanti, Fortinet, MSPT, Linux PW

February 2024: Vulremi, Vuldetta, PT VM Course relaunch, PT TrendVulns digests, Ivanti, Fortinet, MSPT, Linux PW. Hello everyone! In this episode, I will talk about the February updates of my open source projects, also about projects at my main job at Positive Technologies and interesting...

CentOS 9 : runc-1.1.7-1.el9

The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the runc-1.1.7-1.el9 build changelog. - runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless...

Exploit for Out-of-bounds Write in Fortinet Fortiproxy

CVE-2024-21762 Check Safely detect whether a FortiGate SSL VPN...

Oracle Linux 8 : unbound (ELSA-2024-0965)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-0965 advisory. - bind9: KeyTrap - Extreme CPU consumption in DNSSEC validator CVE-2023-50387 Tenable has extracted the preceding description block directly from the...

Wordfence Intelligence Weekly WordPress Vulnerability Report (February 5, 2024 to February 11, 2024)

Did you know were running a Bug Bounty Extravaganza again? Earn over 6x our usual bounty rates, up to $10,000, for all vulnerabilities submitted through February 29th, 2024 when you opt to have Wordfence handle responsible disclosure! Last week, there were 95 vulnerabilities disclosed in 65...

WordPress 6.0.x < 6.0.7 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A PHP file upload bypass via Plugin Installer requiring admin privileges. - An RCE POP Chains vulnerability. Note that the scanner has not tested for these issues but has...

WordPress 4.8.x < 4.8.24 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A PHP file upload bypass via Plugin Installer requiring admin privileges. - An RCE POP Chains vulnerability. Note that the scanner has not tested for these issues but has...

WordPress 5.9.x < 5.9.9 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A PHP file upload bypass via Plugin Installer requiring admin privileges. - An RCE POP Chains vulnerability. Note that the scanner has not tested for these issues but has...