ManageEngine AssetExplorer 7700 < 7710 Privilege Escalation

The version of ManageEngine AssetExplorer installed on the remote host is prior to 7.7 Build 7710. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-8309 advisory. - A privilege escalation vulnerability caused by the overly permissive regular expression regex rules in UR...

NanoMQ 安全漏洞

NanoMQ is a lightweight and fast MQTT Broker for IoT edge platforms open sourced by EMQ USA. A security vulnerability exists in NanoMQ version 0.21.10, which stems from improper access control and could allow an attacker to use MQTT wildcards to bypass security restrictions and access sensitive...

CVE-2024-42655

An access control issue in NanoMQ v0.21.10 allows attackers to bypass security restrictions and access sensitive system topic messages using MQTT wildcard characters...

Uncaught Exception

Overview Affected versions of this package are vulnerable to Uncaught Exception via improper handling of JMESPath variable substitutions in the getValueAsStringMap function within pkg/engine/wildcards/wildcards.go. An attacker can cause the admission controller and reports controller to crash by...

Astra Linux – Vulnerability in syslog-ng

syslog-ng is an enhanced logging daemon. Prior to version 4.8.2, the tlswildcardmatch function matched against certificates like foo..bar, although this is not allowed. It is also possible to pass partial wildcards, such as foo.ac.bar, which glib logs match, but this should be avoided/disabled...

CVE-2024-31409

Certain MQTT wildcards are not blocked on the CyberPower PowerPanel system, which might result in an attacker obtaining data from throughout the system after gaining access to any device...

CVE-2021-24355

In the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, the lack of capability checks and insufficient nonce check on the AJAX actions, simple301redirects/admin/getwildcard and simple301redirects/admin/wildcard, made it possible for authenticated users to retrieve and update the...

CVE-2002-2192

Cross-site scripting XSS vulnerability in Perception LiteServe 2.0.1 allows remote attackers to execute arbitrary web script via 1 a Host: header when DNS wildcards are supported or 2 the query string in a "dir" request to indexed folders...

UBUNTU-CVE-2024-47619

syslog-ng is an enhanced log daemo. Prior to version 4.8.2, tlswildcardmatch matches on certificates such as foo..bar although that is not allowed. It is also possible to pass partial wildcards such as foo.ac.bar which glib matches but should be avoided / invalidated. This issue could have an...

Configure the Authentication Blocklist and Allowlist Properly

SSH provides the blocklist and allowlist function. You can set a list of users or user groups to allow or deny SSH login for them. By default, this function is not configured in openEuler. The related fields are as follows: AllowUsers userlist specifies the space-separated users who are allowed t...

CVE-2025-0681 New Rock Technologies Cloud Connected Devices Improper Neutralization of Wildcards or Matching Symbols

The Cloud MQTT service of the affected products supports wildcard topic subscription which could allow an attacker to obtain sensitive information from tapping the service communications...

BIT-NODE-MIN-2024-21890

The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. For example: --allow-fs-read=/home/node/.ssh/.pub will ignore pub and give access to everything after .ssh/. This misleading documentation affects all users...

CVE-2024-2800 Uncontrolled Resource Consumption in GitLab

ReDoS flaw in RefMatcher when matching branch names using wildcards in GitLab EE/CE affecting all versions from 11.3 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2 allows denial of service via Regex backtracking...

PT-2024-5512

Name of the Vulnerable Software and Affected Versions GitLab EE/CE versions 11.3 through 17.0.5 GitLab EE/CE versions 17.1 through 17.1.3 GitLab EE/CE versions 17.2 through 17.2.1 Description The issue is related to a ReDoS flaw in the RefMatcher component when matching branch names using...

SUSE CVE-2019-25211

parseWildcardRules in Gin-Gonic CORS middleware before 1.6.0 mishandles a wildcard at the end of an origin string, e.g., https://example.community/ is allowed when the intention is that only https://example.com/ should be allowed, and http://localhost.example.com/ is allowed when the intention is...

The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. For example: ``` --allow-fs-read=/home/node/.ssh/*.pub ``` will ignore `pub` and give access to everything after `.ssh/`. This misleading documentation affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued the permission model is an experimental feature of Node.js.

...

BIT-NODE-2024-21890

The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. For example: --allow-fs-read=/home/node/.ssh/.pub will ignore pub and give access to everything after .ssh/. This misleading documentation affects all users...

CVE-2024-31409

Certain MQTT wildcards are not blocked on the CyberPower PowerPanel system, which might result in an attacker obtaining data from throughout the system after gaining access to any device...

CVE-2024-31409 CyberPower PowerPanel business Incorrect Authorization

Certain MQTT wildcards are not blocked on the CyberPower PowerPanel system, which might result in an attacker obtaining data from throughout the system after gaining access to any device...

CVE-2024-31409

CVE-2024-31409 affects CyberPower PowerPanel software. The vulnerability arises from insufficient authorization due to MQTT wildcards not being blocked, which could allow an attacker who gains access to any device to read data from across the system. Affected product: PowerPanel (enterprise/busin...