PT-2024-13906 · Realtek · Realtek Rtl819X Jungle Sdk

Name of the Vulnerable Software and Affected Versions: Realtek rtl819x Jungle SDK version 3.4.11 Description: A stack-based buffer overflow vulnerability exists in the boa getInfo functionality. This can be triggered by a specially crafted series of HTTP requests, potentially leading to remote co...

The vulnerability of the Cisco AppDynamics Network Visibility Agent’s software for monitoring and analyzing network traffic stems from insufficient validation of input data. This allows attackers to trigger service interruptions.

The vulnerability of the Cisco AppDynamics Network Visibility Agent software for monitoring and analyzing network traffic exists due to insufficient validation of input data. Exploiting this vulnerability can allow attackers to trigger a service failure through a specially crafted HTTP request...

ROS-20240703-12

An Apache Tomcat application server vulnerability is related to insufficient input validation. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service using specially crafted HTTP/2 requests...

CVE-2024-38473

Encoding problem in modproxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests. Users are recommended to upgrade to version 2.4.60, which fixes this issue...

PT-2024-28412 · Unknown · Thunderobot Control Center

Name of the Vulnerable Software and Affected Versions: ThundeRobot Control Center version 2.0.0.10 Description: The issue in the component ControlCenter.sys/ControlCenter64.sys allows attackers to access sensitive information, execute arbitrary code, or escalate privileges via sending crafted IOC...

GO-2024-2430 Authenticated users can crash the CubeFS servers with maliciously crafted requests in github.com/cubefs/cubefs

Authenticated users can crash the CubeFS servers with maliciously crafted requests in github.com/cubefs/cubefs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...

The vulnerability of ZTE ZXHN H388X router’s micro-programming software, related to improper storage of resolutions, allows attackers to increase their privileges.

The vulnerability of ZTE ZXHN H388X router’s microprogramming software is related to improper storage of permissions. Exploiting this vulnerability can allow attackers to enhance their privileges through specially created requests...

CVE-2024-21827

A leftover debug code vulnerability exists in the cliserver debug functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.4.1 Build 20240117 Rel.57421. A specially crafted series of network requests can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger...

The vulnerability in the web interface of microprogramming software for devices that control lighting and energy consumption of Schneider Electric Sage systems allows a perpetrator to trigger a service failure.

The vulnerability of the web interface of microprogramming software for devices for remote control of lighting and energy consumption in Schneider Electric Sage is related to the copying of buffers without checking the size of input data. Exploiting this vulnerability could allow a malicious acto...

The vulnerability of microprogramming software in devices for remote control of lighting and energy consumption from Schneider Electric Sage lies in the possibility of writing beyond the buffer in memory, allowing attackers to bypass authentication procedures.

The vulnerability of microprogramming software in Schneider Electric Sage lighting and energy consumption remote control devices is related to writing data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a malicious actor to bypass authentication procedures by...

AlmaLinux 9 : 389-ds-base (ALSA-2024:3837)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:3837 advisory. 389-ds-base: potential denial of service via specially crafted kerberos AS-REQ request CVE-2024-3657 389-ds-base: Malformed userPassword may cause crash a...

The vulnerability of the software for centralized management of FortiWeb Manager firewalls lies in the authentication procedures’ deficiencies, which allow an attacker to gain access to read, modify, or delete data.

The vulnerability of the FortiWeb Manager software for centralized control of network firewalls is related to deficiencies in its authentication procedures. Exploiting this vulnerability could allow an attacker to gain access to read, modify, or delete data by sending specially crafted HTTP...

The vulnerability of FortiWeb web applications’ network firewalls, related to deficiencies in authentication procedures, allows attackers to gain read, modify, or delete access to data.

The vulnerability of FortiWeb web applications’ network firewalls is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow a malicious actor to gain read, modify, or delete access to data by sending specially crafted requests...

PT-2024-4308 · Gitlab +1 · Gitlab Ce/Ee +2

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 8.4 through 16.10.7 GitLab CE/EE versions 16.11 through 16.11.4 GitLab CE/EE versions 17.0 through 17.0.2 Description: A vulnerability in GitLab's Asana integration allowed an attacker to potentially cause a regular...

Arbitrary File Deletion

litellm is vulnerable to Arbitrary File Deletion. The vulnerability is due to improper input validation on the /audio/transcriptions endpoint, allowing attackers to send crafted requests that delete specified files without proper authorization or validation...

The vulnerability of the prog.cgi file in D-Link DIR-2640 router microprogramming software allows a hacker to execute arbitrary code in the root context.

The vulnerability of the prog.cgi file in D-Link DIR-2640 router microprogramming software is related to buffer overflow in the stack. Exploiting this vulnerability allows a remote attacker to execute arbitrary code in the root context by sending specially crafted HNAP requests to TCP ports 80 an...

CVE-2024-5186 Server Side Request Forgery (SSRF) in imartinez/privategpt

A Server-Side Request Forgery SSRF vulnerability exists in the file upload section of imartinez/privategpt version 0.5.0. This vulnerability allows attackers to send crafted requests that could result in unauthorized access to the local network and potentially sensitive information. Specifically,...

Improper Input Validation

actionpack is vulnerable to Improper Input Validation. The vulnerability is due to improper handling of security headers for non-HTML content types, which allows an attacker to potentially bypass security restrictions by sending specially crafted requests that exploit the lack of these security...

The vulnerability of the HTTP/3 QUIC module (ngx_http_v3_module) in NGINX Plus and NGINX OSS web servers allows a hacker to gain unauthorized access to protected information.

The vulnerability of the HTTP/3 QUIC module ngxhttpv3module in NGINX Plus and NGINX OSS servers is related to the use of memory after it is freed. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to protected information through specially crafted HTTP/3 reques...

The vulnerability of the HTTP/3 QUIC module (ngx_http_v3_module) in NGINX Plus and NGINX OSS web servers allows a attacker to cause a service failure.

The vulnerability of the HTTP/3 QUIC module ngxhttpv3module in NGINX Plus and NGINX OSS relates to the assignment of the zero pointer. Exploiting this vulnerability can allow a malicious actor to cause service interruptions by sending specially crafted HTTP/3 requests...