PT-2024-34580 · Draytek · Draytek Vigor3900

Name of the Vulnerable Software and Affected Versions: DrayTek Vigor3900 version 1.5.1.3 Description: The issue allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doSSLTunnel function. Recommendations: For DrayTek Vigor3900 version...

CVE-2024-49768

Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recvbytes defaults to 8192 long, followed by a secondary request using HTTP pipelining. When request lookahead is disabled default we won't read any more requests, and when the...

AZL-57396 CVE-2024-49768 affecting package python-waitress 3.0.1-1

Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recvbytes defaults to 8192 long, followed by a secondary request using HTTP pipelining. When request lookahead is disabled default we won't read any more requests, and when the...

DEBIAN-CVE-2024-49768

Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recvbytes defaults to 8192 long, followed by a secondary request using HTTP pipelining. When request lookahead is disabled default we won't read any more requests, and when the...

PYSEC-2024-210

Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recvbytes defaults to 8192 long, followed by a secondary request using HTTP pipelining. When request lookahead is disabled default we won't read any more requests, and when the...

UBUNTU-CVE-2024-49768

Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recvbytes defaults to 8192 long, followed by a secondary request using HTTP pipelining. When request lookahead is disabled default we won't read any more requests, and when the...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview waitress is a production-quality pure-Python WSGI server with very acceptable performance. Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition in HTTP pipelining when handling an invalid initial request. An attacker can exploit this...

GHSA-9298-4CF8-G4WJ Waitress has request processing race condition in HTTP pipelining with invalid first request

Impact A remote client may send a request that is exactly recvbytes defaults to 8192 long, followed by a secondary request using HTTP pipelining. When request lookahead is disabled default we won't read any more requests, and when the first request fails due to a parsing error, we simply close th...

PT-2024-34201 · WordPress · Surveyjs: Drag & Drop Wordpress Form Builder

Name of the Vulnerable Software and Affected Versions: SurveyJS: Drag & Drop WordPress Form Builder versions 1.9.136 and earlier Description: The issue is related to an Unrestricted Upload of File with Dangerous Type vulnerability. This means that the software may allow uploading files of dangero...

PT-2024-32997 · Pluxml · Pluxml

Name of the Vulnerable Software and Affected Versions: PluXml versions 5.8.16 and lower Description: A remote code execution issue in the /PluXml/core/admin/parametres edittpl.php component allows attackers to execute arbitrary code by injecting a crafted payload into a template. Recommendations:...

PT-2024-34158 · Unknown · Instantcms

Name of the Vulnerable Software and Affected Versions: InstantCMS versions prior to 2.16.3 Description: The issue is related to a lack of input validation in the photo upload function on the photo album page, allowing attackers to inject and execute Cross Site Scripting XSS payloads...

PT-2024-34147 · Scoold · Scoold

Name of the Vulnerable Software and Affected Versions: Scoold versions prior to 1.64.0 Description: A semicolon path injection vulnerability was found on the "/api;/config" endpoint. By appending a semicolon in the URL, attackers can bypass authentication and gain unauthorized access to sensitive...

PT-2024-16150

Name of the Vulnerable Software and Affected Versions Keycloak-services affected versions not specified Red Hat products affected versions not specified Description A vulnerability was found in the Keycloak-services package. If untrusted data is passed to the SearchQueryUtils method, it could lea...

PT-2024-37790 · Unknown · Lollms-Webui

Name of the Vulnerable Software and Affected Versions: lollms-webui versions v9.9 through the latest Description: A Cross-Site Request Forgery CSRF issue exists in the "install comfyui" endpoint of the lollms comfyui.py file. This endpoint uses the GET method without requiring a client ID, allowi...

PT-2024-33244 · Tenda · Tenda Ac7

Name of the Vulnerable Software and Affected Versions: Tenda AC7 version 15.03.06.44 Description: The issue allows remote attackers to execute arbitrary code due to a pre-authentication command injection in the ate iwpriv set function. Recommendations: For version 15.03.06.44, consider disabling...

PT-2024-33282 · Schedmd · Slurm

Name of the Vulnerable Software and Affected Versions: SchedMD Slurm versions prior to 24.05.4 Description: A mistake in authentication handling in stepmgr could permit an attacker to execute processes under other users' jobs. This issue is limited to jobs explicitly running with --stepmgr, or on...

PT-2024-34254 · Unknown · Swoop 1-Click Login: Passwordless Authentication

Name of the Vulnerable Software and Affected Versions: Swoop 1-Click Login: Passwordless Authentication version 1.4.5 Description: The issue is related to an Authentication Bypass by Primary Weakness vulnerability in the Passwordless Authentication feature. This vulnerability allows for...

PT-2024-9811 · NetGear · Netgear R8500

Name of the Vulnerable Software and Affected Versions: Netgear R8500 version 1.0.2.160 Description: The issue is related to a stack overflow in the ipv6 tunnel function when handling the ipv6 static ip parameter. This can be exploited by a remote attacker to cause a Denial of Service DoS using a...

PT-2024-8854 · D Link · D-Link Dir-820L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-820L version 1.05b03 Description: The issue is related to the ping v4 and ping v6 functions in the D-Link DIR-820L router's firmware, which fails to properly sanitize data when handling the ping addr parameter. This can allow a...

PT-2024-16273 · Wavlink · Wavlink Wn572Hp3 +1

Name of the Vulnerable Software and Affected Versions: WAVLINK WN530H4 versions up to 20221028 WAVLINK WN530HG4 versions up to 20221028 WAVLINK WN572HG3 versions up to 20221028 Description: A critical issue affects the set ipv6 function of the firewall.cgi file, where manipulation of the...