USN-7157-2 php7.4 regression

USN-7157-1 fixed vulnerabilities in PHP. The patch for CVE-2024-8932 caused a regression in php7.4. This update fixes the problem. Original advisory details: It was discovered that PHP incorrectly handled certain inputs when processed with convert.quoted-printable decode filters. An attacker coul...

Boundary Controller Incorrectly Handles HTTP Requests On Initialization Which May Lead to a Denial of Service

Summary Boundary Community Edition and Boundary Enterprise “Boundary” incorrectly handles HTTP requests during the initialization of the Boundary controller, potentially causing the Boundary server to terminate prematurely or allow an attacker to perform a denial of service attack. Boundary is on...

PT-2024-17529

Name of the Vulnerable Software and Affected Versions Boundary Community Edition versions prior to 0.16.4 Boundary Community Edition versions prior to 0.17.3 Boundary Community Edition versions prior to 0.18.2 Boundary Enterprise versions prior to 0.16.4 Boundary Enterprise versions prior to 0.17...

CVE-2024-54133

Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting XSS vulnerability in the contentsecuritypolicy helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set...

CVE-2024-45206

A vulnerability in Veeam Service Provider Console has been identified, which allows to perform arbitrary HTTP requests to arbitrary hosts of the network and get information about internal resources...

Veeam Service Provider Console 安全漏洞

Veeam Service Provider Console is a cloud-enabled platform from Veeam USA. A security vulnerability exists in the Veeam Service Provider Console that originates from allowing arbitrary HTTP requests to be performed on arbitrary hosts on the network and obtain information about internal resources...

PT-2024-10317 · 1с · Битрикс24 +1

Name of the Vulnerable Software and Affected Versions: 1С-Битрикс: Управление сайтом affected versions not specified Description: The issue is related to the UI module of the Битрикс24 business management service and the 1С-Битрикс site management system CMS, which fails to protect the web page...

The vulnerability of the ProjectSend file-sharing software is related to deficiencies in the authentication process, which allows attackers to modify the application’s configuration.

The vulnerability of the ProjectSend file-sharing software is related to deficiencies in its authentication procedures. Exploiting this vulnerability allows a malicious actor to remotely modify the application’s configuration by sending specially crafted HTTP requests...

The vulnerability of the MDP package for the operating system of industrial personal computers TwinCAT/BSD, related to operations beyond the buffer in memory, allows attackers to exploit their privileges, execute arbitrary code, or cause system failures.

The vulnerability of the MDP package for the operating system of industrial personal computers TwinCAT/BSD relates to operations that occur outside the buffer in memory. Exploiting this vulnerability can allow attackers to enhance their privileges, execute arbitrary code, or cause service failure...

CVE-2024-29224

An OS command injection vulnerability exists in the NAT parameter of GoCast 1.1.3. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an unauthenticated HTTP request to trigger this vulnerability...

PT-2024-22632 · Gocast +1 · Gocast +1

Name of the Vulnerable Software and Affected Versions: GoCast version 1.1.3 Description: An OS command injection issue exists in the name parameter of GoCast, allowing arbitrary command execution via a specially crafted HTTP request. This can be triggered by an unauthenticated HTTP request...

The vulnerability of the final point of the Splunk Enterprise data model/web REST platform for operational analysis allows a malicious actor to trigger a service failure.

The vulnerability of the final point of the Splunk Enterprise data model/web REST platform for operational analysis is related to the execution of a loop with an unreachable exit condition. Exploiting this vulnerability allows a malicious actor to trigger a service failure using a specially creat...

The vulnerability of the microprogramming software of the automation and process control module Sprecher SPRECON-E, related to insecure management of privileges, allows a perpetrator to alter the device’s configuration.

The vulnerability of the microprogramming software used in the Sprecher SPRECON-E automation and process control module is related to insecure management of privileges. Exploiting this vulnerability could allow a malicious actor, operating remotely, to modify the device’s configuration using...

CVE-2024-32117

An improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability CWE-22 in Fortinet FortiManager version 7.4.0 through 7.4.2 and below 7.2.5, FortiAnalyzer version 7.4.0 through 7.4.2 and below 7.2.5 & FortiAnalyzer-BigData version 7.4.0 and below 7.2.7 allows a...

CVE-2024-10814

The Code Embed plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5 via the cegetfile function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originati...

CVE-2024-24914

Authenticated Gaia users can inject code or commands by global variables through special HTTP requests. A Security fix that mitigates this vulnerability is available...

The vulnerability of the software for downloading pyload files is related to insufficient validation of input data, allowing a perpetrator to execute arbitrary code.

The vulnerability of the software for downloading pyload files is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially crafted HTTP request remotely...

PT-2024-20662 · Gaia · Gaia

Name of the Vulnerable Software and Affected Versions: Gaia affected versions not specified Description: The issue allows authenticated Gaia users to inject code or commands by global variables through special HTTP requests. A security fix is available to mitigate this issue. Recommendations: At...

Cisco Unified Industrial Wireless Software 命令注入漏洞

Cisco Unified Industrial Wireless Software is a software provided by Cisco for industrial wireless networks. A command injection vulnerability exists in Cisco Unified Industrial Wireless Software. The vulnerability is caused due to improper validation of inputs to the web management interface of...

xerces-c: An integer overflow issue that allows remote attackers to cause out-of-bound access via HTTP request

An integer overflow exists in xerces-c++. This flaw allows an attacker using a specially crafted HTTP request payload to trigger an out-of-bounds read, resulting in a loss of confidentiality, integrity, and availability...