[SECURITY] Fedora 35 Update: lighttpd-1.4.67-1.fc35

lighttpd pronounced /lighty/ is a secure, fast, compliant, and very flexible web server that has been optimized for high-performance environments. lighttpd uses memory and CPU efficiently and has lower resource use than other popular web servers. Its advanced feature-set FastCGI, CGI, Auth,...

Security Advisory 2022-10-04-1 - wolfSSL buffer overflow during a TLS 1.3 handshake (CVE-2022-39173)

DESCRIPTION In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow on server during a TLS 1.3 handshake. This occurs when an attacker supposedly resumes a previous TLS session. During the resumption Client Hello a Hello Retry Request must be triggered. Both Client Hellos are...

The vulnerability of the strcpy() function in Netgear N300 wireless router microprogramming software allows a hacker to cause a service failure.

The vulnerability of the strcpy function in the microprogramming software for Netgear N300 wireless routers WNR2000v4 is related to the issue where the write operation goes beyond the buffer boundaries when processing configuration files of the uHTTPd web server. Exploiting this vulnerability can...

WordPress String Locator Plugin < 2.5.0 Arbitrary File Read Vulnerability

The WordPress plugin Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

Design/Logic Flaw

The Frontend File Manager Plugin WordPress plugin before 21.3 allows any unauthenticated user to rename uploaded files from users. Furthermore, due to the lack of validation in the destination filename, this could allow allow them to change the content of arbitrary files on the web server...

Exploit for Incorrect Calculation in Moodle

Proof of concept for CVE-2022-30600 Overview This rep...

httpd: mod_proxy: X-Forwarded-For dropped by hop-by-hop mechanism

A flaw was found in the modproxy module of httpd. The server may remove the X-Forwarded- headers from a request based on the client-side Connection header hop-by-hop mechanism...

httpd: core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody

A flaw was found in httpd, where it incorrectly limits the value of the LimitXMLRequestBody option. This issue can lead to an integer overflow and later causes an out-of-bounds write...

CVE-2021-40694

Insufficient escaping of the LaTeX preamble made it possible for site administrators to read files available to the HTTP server system account...

Apache Tomcat 竞争条件问题漏洞

Apache Tomcat is the United States Apache Apache Foundation of a lightweight Web application server. The program implements support for Servlets and JavaServer Page JSP. A security vulnerability exists in Apache Tomcat, which stems from a simplified implementation of blocking reads and writes, wi...

Security Bulletin: Directory listing vulnerability in IBM InfoSphere Data Replication Dashboard (CVE-2012-4861)

Abstract InfoSphere Data Replication Dashboard includes a web server that can be used to list specific directories under the dashboard web application. Content VULNERABILITY DETAILS: CVE ID: CVE-2012-4861 DESCRIPTION: It is possible to retrieve a directory listing by sending a request for specifi...

Security Bulletin: Java API Documentation Frame Injection Vulnerability (CVE-2013-1571)

Abstract Java API Documentation shipped in IBM Tivoli Storage Manager TSM 6.1, 6.2, and 6.3 Windows client packages contains a frame injection vulnerability Content VULNERABILITY DETAILS: The TSM 6.1 Windows client packages and some TSM 6.2 and 6.3 Windows client packages contain documentation...

Apache Airflow Open Redirect Vulnerability

Apache Airflow is an open source platform for creating, managing and monitoring workflows from the Apache Foundation. Apache Airflow versions 2.3.0 to 2.3.4 have an open redirection vulnerability, which originates from the /confirm port of the web server does not do a reasonable job on the target...

Unified Remote Authentication Bypass / Code Execution Exploit

This Metasploit module utilizes the Unified Remote remote control protocol to type out and deploy a payload. The remote control protocol can be configured to have no passwords, a group password, or individual user accounts. If the web page is accessible, the access control is set to no password f...

CVE-2022-30578

The Web Server component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute Stored Cross Site Scripting XSS on the affected system. A successful attack using this vulnerability requires human...

CVE-2022-30578

The Web Server component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute Stored Cross Site Scripting XSS on the affected system. A successful attack using this vulnerability requires human...

CVE-2022-30577

The Web Server component of TIBCO Software Inc.'s TIBCO EBX contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute Stored Cross Site Scripting XSS on the affected system. A successful attack using this vulnerability requires human...

CVE-2022-30577

The Web Server component of TIBCO Software Inc.'s TIBCO EBX contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute Stored Cross Site Scripting XSS on the affected system. A successful attack using this vulnerability requires human...

Cross site scripting

The Web Server component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute Stored Cross Site Scripting XSS on the affected system. A successful attack using this vulnerability requires human...

Cross site scripting

The Web Server component of TIBCO Software Inc.'s TIBCO EBX contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute Stored Cross Site Scripting XSS on the affected system. A successful attack using this vulnerability requires human...