BIT-AIRFLOW-2024-41937 Apache Airflow: Stored XSS Vulnerability on provider link

Apache Airflow, versions before 2.10.0, have a vulnerability that allows the developer of a malicious provider to execute a cross-site scripting attack when clicking on a provider documentation link. This would require the provider to be installed on the web server and the user to click the...

Siemens SCALANCE M-800, RUGGEDCOM RM1224 Exposure of Data Element to Wrong Session (CVE-2024-41977)

A vulnerability has been identified in RUGGEDCOM RM1224 LTE4G EU 6GK6108-4AM00-2BA2 All versions V8.1, RUGGEDCOM RM1224 LTE4G NAM 6GK6108-4AM00-2DA2 All versions V8.1, SCALANCE M804PB 6GK5804-0AP00-2AA2 All versions V8.1, SCALANCE M812-1 ADSL- Router family All versions V8.1, SCALANCE M816-1...

Cross Site Scripting (XSS)

ckeditor4 is vulnerable to Cross Site Scripting XSS. The vulnerability is caused due to a flaw in the Code Snippet GeSHi plugin. An attacker could craft a malicious script that could be executed by sending a request to the GeSHi library hosted on a PHP web server...

Cross Site Scripting(XSS)

apacheairflow is vulnerable to a Cross Site ScriptingXSS. The vulnerability is due to the ability of a malicious provider to execute a script when a user clicks on a provider documentation link in docs.py and provided the provider is installed on the web server, which allows an attacker to exploi...

Apache Airflow Cross-site Scripting Vulnerability

Apache Airflow, versions before 2.10.0, have a vulnerability that allows the developer of a malicious provider to execute a cross-site scripting attack when clicking on a provider documentation link. This would require the provider to be installed on the web server and the user to click the...

CVE-2024-41937 Apache Airflow: Stored XSS Vulnerability on provider link

Apache Airflow, versions before 2.10.0, have a vulnerability that allows the developer of a malicious provider to execute a cross-site scripting attack when clicking on a provider documentation link. This would require the provider to be installed on the web server and the user to click the...

CVE-2024-43407

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A potential vulnerability has been discovered in CKEditor 4 Code Snippet GeSHi plugin. The vulnerability allowed a reflected XSS attack by exploiting a flaw in the GeSHi syntax highlighter library hosted by the victim. The GeSH...

CVE-2024-43407 Code Snippet GeSHi plugin has reflected cross-site scripting (XSS) vulnerability

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A potential vulnerability has been discovered in CKEditor 4 Code Snippet GeSHi plugin. The vulnerability allowed a reflected XSS attack by exploiting a flaw in the GeSHi syntax highlighter library hosted by the victim. The GeSH...

CVE-2024-43407 Code Snippet GeSHi plugin has reflected cross-site scripting (XSS) vulnerability

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A potential vulnerability has been discovered in CKEditor 4 Code Snippet GeSHi plugin. The vulnerability allowed a reflected XSS attack by exploiting a flaw in the GeSHi syntax highlighter library hosted by the victim. The GeSH...

CVE-2024-43407

Summary: CVE-2024-43407 affects CKEditor 4 via the Code Snippet GeSHi plugin, where a flaw in the GeSHi syntax highlighter could enable a reflected XSS attack. The GeSHi library was included as a vendor dependency in CKEditor 4 source files. The advisory states the GeSHi library is no longer acti...

CVE-2024-43407

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A potential vulnerability has been discovered in CKEditor 4 Code Snippet GeSHi plugin. The vulnerability allowed a reflected XSS attack by exploiting a flaw in the GeSHi syntax highlighter library hosted by the victim. The GeSH...

CKEditor4 安全漏洞

CKEditor4 is an enterprise WYSIWYG editor from CKEditor open source. A security vulnerability exists in versions prior to CKEditor4 4.25.0-lts. An attacker exploiting this vulnerability can write malicious scripts that can be executed by sending requests to the GeSHi library hosted on a PHP web...

Johnson Controls ExacqVision Web Server Installed (Linux)

Binary data johnsoncontrolsexacqvisionwebservernixinstalled.nbin...

CVE-2024-42815

In the TP-Link RE365 V1180213, there is a buffer overflow vulnerability due to the lack of length verification for the USERAGENT field in /usr/bin/httpd. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands...

PT-2024-5749 · Tp Link · Tp-Link Re365

Name of the Vulnerable Software and Affected Versions: TP-Link RE365 version V1 180213 Description: The issue is related to a buffer overflow vulnerability due to the lack of length verification for the USER AGENT field in /usr/bin/httpd. This vulnerability can be exploited by attackers to cause...

The vulnerability of the Apache HTTP Server’s kernel allows attackers to gain unauthorized access to protected information.

The vulnerability of the Apache HTTP Server’s kernel is related to the use of outdated configuration settings for handlers. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information...

The vulnerability of the WSGI-server Gunicorn, related to defects in HTTP request processing, allows attackers to circumvent existing security restrictions and execute a “HTTP request hijacking” attack.

The vulnerability of the WSGI-server Gunicorn is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions and carry out an “HTTP request hijacking” attack...

[SECURITY] Fedora 39 Update: httpd-2.4.62-2.fc39

The Apache HTTP Server is a powerful, efficient, and extensible web server...

PT-2024-14840 · Undefined · Undefined

"Source": "CVE FEED", "Title": "CVE-2023-5888 - Apache Web Server Remote Command Execution Vulnerability", "Content": "CVE ID : CVE-2023-5888 Published : Aug. 16, 2024, 7:15 p.m. | 38 minutes ago Description : Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-7246...

PT-2024-30085 · Tenda · Tenda Ac9

Name of the Vulnerable Software and Affected Versions: Tenda AC9 version 15.03.06.42 Description: A Command Injection issue exists in the formWriteFacMac function of the httpd binary. This allows an attacker to execute OS commands with root privileges. Recommendations: For Tenda AC9 version...