CBL Mariner 2.0 Security Update: git-lfs (CVE-2024-53263)

The version of git-lfs installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-53263 advisory. - Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a...

Malicious code in ui-components-highlight-vdom (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 17c058680e21b489b3504441b59346650d2d8f204795eda46ba03d8c9585e58f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-8452

Certain switch models from PLANET Technology only support obsolete algorithms for authentication protocol and encryption protocol in the SNMPv3 service, allowing attackers to obtain plaintext SNMPv3 credentials potentially...

PT-2024-39057 · Franklin Fueling Systems · Ts-550 Evo

Name of the Vulnerable Software and Affected Versions: Franklin Fueling Systems TS-550 EVO versions prior to 2.26.4.8967 Description: The issue allows an attacker to read a file arbitrarily, potentially obtaining administrator credentials. Recommendations: For Franklin Fueling Systems TS-550 EVO...

PT-2024-12192 · Apache · Apache Kylin

Name of the Vulnerable Software and Affected Versions: Apache Kylin versions 2.0.0 through 4.0.3 Description: The issue concerns the Server Config web interface in Apache Kylin, which displays the content of the kylin.properties file. This file may contain server-side credentials. When the Kylin...

PT-2023-7082

Name of the Vulnerable Software and Affected Versions ownCloud owncloud/graphapi versions 0.2.x through 0.2.0 and versions 0.3.x through 0.3.0 Description The issue is related to the graphapi app in ownCloud, which relies on a third-party GetPhpInfo.php library. This library provides a URL that,...

PT-2023-4588

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 2.7.0 Apache Airflow SMTP Provider versions prior to 1.3.0 Apache Airflow IMAP Provider versions prior to 3.3.0 Description The issue is related to the validation of OpenSSL certificates. The default SSL contex...

OpenStack 安全漏洞

OpenStack is a cloud platform management program of the National Aeronautics and Space Administration NASA. OpenStack suffers from a security vulnerability that stems from allowing an unauthenticated, remote attacker to inspect sensitive data after discovering the IP address of an undercloud, whi...

Kubernetes 代码问题漏洞

Kubernetes K8s is an open source system from the Cloud Native Computing Foundation for automating the deployment, scaling, and management of containerized applications. A security vulnerability exists in Kubernetes that stems from allowing the Aggregation API server to redirect client traffic to...

PT-2022-23256 · Fiberhome · Fiberhome Vdsl2 Modem Hg150-Ub

Name of the Vulnerable Software and Affected Versions: FiberHome VDSL2 Modem HG150-Ub version V3.0 Description: The issue concerns the submission of admin credentials in URLs, which can be logged or sniffed. This poses a risk as sensitive information can be captured and exploited. Recommendations...

CVE-2021-31852

A Reflected Cross-Site Scripting vulnerability in McAfee Policy Auditor prior to 6.5.2 allows a remote unauthenticated attacker to inject arbitrary web script or HTML via the UID request parameter. The malicious script is reflected unmodified into the Policy Auditor web-based interface which coul...

wpForo Forum < 1.9.7 - Open Redirect

The plugin did not validate the redirectto parameter in the login form of the forum, leading to an open redirect issue after a successful login. Such issue could allow an attacker to induce a user to use a login URL redirecting to a website under their control and being a replica of the legitimat...

CVE-2018-8842

Philips e-Alert Unit non-medical device, Version R2.1 and prior. The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors. The Philips e-Alert communication channel is not encrypted which could therefore lead to...

Recurly Client .NET Library Server-Side Request Forgery Attack Vulnerability

Recurly Client .NET Library is an API wrapper for Recurly from Recurly USA. A server-side request forgery attack vulnerability exists in Recurly Client .NET Library, which stems from the program failing to properly use the 'Uri.EscapeUriString' function. The vulnerability can be exploited by an...

Foreman: API permits HTTP requests when require_ssl is enabled

Foreman after 1.1 and before 1.9.0-RC1 does not redirect HTTP requests to HTTPS when the requiressl setting is set to true, which allows remote attackers to obtain user credentials via a man-in-the-middle attack...

Your Facebook credentials at risk on Android - iOS jailbroken devices

Your Facebook credentials at risk on Android - iOS jailbroken devices Facebook allows its authentication credentials to be stored in plain text within the Apple iOS version of its mobile app, allowing an attacker complete control over your Facebook account if he knows where to look. Security...

Arbitrary File Access

When told to follow a "redirect" automatically, libcurl does not question the new target URL but follows it to any new URL that it understands. As libcurl supports FILE:// URLs, a rogue server can thus "trick" a libcurl-using application to read a local file instead of the remote one. This is a...

[Full-disclosure] XAMPP

------------------------------------------------------------ - EXPL-A-2005-006 exploitlabs.com Advisory 034 - ------------------------------------------------------------ - XAMPP - OVERVIEW ======== XAMPP is an easy to install Apache distribution containing MySQL, PHP and Perl. XAMPP is really ve...

Win2k Telnet.exe malicious server vulnerability

Microsoft was informed of this problem with exploit over a month ago. I received some token responses right after emailing them, but have heard nothing since. If they have released an advisory of their own yet, I have not seen it. I informed them up-front that I would release a full-disclosure...