CVE-2024-9477

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in AirTies Air4443 Firmware allows Cross-Site Scripting XSS. This issue affects Air4443 Firmware: through 14102024. NOTE: The vendor was contacted and it was learned that the product classified...

CVE-2024-9477

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in AirTies Air4443 Firmware allows Cross-Site Scripting XSS.This issue affects Air4443 Firmware: through 14102024. NOTE: The vendor was contacted and it was learned that the product classified ...

CVE-2024-9477 XSS in AirTies' Air4443 Firmware

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in AirTies Air4443 Firmware allows Cross-Site Scripting XSS. This issue affects Air4443 Firmware: through 14102024. NOTE: The vendor was contacted and it was learned that the product classified...

CVE-2024-9477

CVE-2024-9477 describes an XSS in AirTies Air4443 Firmware caused by improper input neutralization during web page generation. Affected product: AirTies Air4443 Firmware (versions through 14102024). Root cause identified as improper input handling in web page generation, enabling cross-site scrip...

CVE-2024-9477 XSS in AirTies' Air4443 Firmware

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in AirTies Air4443 Firmware allows Cross-Site Scripting XSS. This issue affects Air4443 Firmware: through 14102024. NOTE: The vendor was contacted and it was learned that the product classified...

libsoup: HTTP request smuggling via stripping null bytes from the ends of header names

A flaw was found in the Libsoup library. When Libsoup parses HTTP headers, it ignores null bytes at the end of header names. Thus, Transfer-Encoding: chunked is equivalent to Transfer-Encoding\x00: chunked. This issue allows request smuggling when Libsoup is used in a service behind a reverse pro...

PT-2024-39654 · Airties · Airties Air4443 Firmware

Name of the Vulnerable Software and Affected Versions: AirTies Air4443 Firmware versions through 14102024 Description: The issue affects AirTies Air4443 Firmware, allowing Cross-Site Scripting XSS due to improper neutralization of input during web page generation. The product is classified as...

CVE-2023-52268

The End-User Portal module before 1.0.65 for FreeScout sometimes allows an attacker to authenticate as an arbitrary user because a session token can be sent to the /auth endpoint. NOTE: this module is not part of freescout-helpdesk/freescout on GitHub...

kernel: fuse: Initialize beyond-EOF page contents before setting uptodate

In the Linux kernel, the following vulnerability has been resolved: fuse: Initialize beyond-EOF page contents before setting uptodate fusenotifystore, unlike fusedoreadpage, does not enable page zeroing because it can be used to change partial page contents. So fusenotifystore must be more carefu...

kernel: usb: dwc3: Wait unconditionally after issuing EndXfer command

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: Wait unconditionally after issuing EndXfer command Currently all controller IP/revisions except DWC3usb3 = 310a wait 1ms unconditionally for ENDXFER completion when IOC is not set. This is because DWCusb3 controller...

November 12, 2024—KB5046697 (Monthly Rollup)

None None...

November 12, 2024—KB5046682 (Monthly Rollup)

None None...

November 12, 2024—KB5046661 (Monthly Rollup)

None None...

November 12, 2024—KB5046687 (Monthly Rollup)

None None...

KB5046630: Cumulative security update for Internet Explorer: November 12, 2024

None None...

CVE-2023-52268

The End-User Portal module before 1.0.65 for FreeScout sometimes allows an attacker to authenticate as an arbitrary user because a session token can be sent to the /auth endpoint. NOTE: this module is not part of freescout-helpdesk/freescout on GitHub...

CVE-2024-43498

.NET and Visual Studio Remote Code Execution Vulnerability...

CVE-2024-43499

.NET and Visual Studio Denial of Service Vulnerability...

CVE-2023-52268

The End-User Portal module before 1.0.65 for FreeScout sometimes allows an attacker to authenticate as an arbitrary user because a session token can be sent to the /auth endpoint. NOTE: this module is not part of freescout-helpdesk/freescout on GitHub...

CVE-2023-52268

CVE-2023-52268 affects the FreeScout End-User Portal module pre-1.0.65. The root cause is improper session token handling at the /auth endpoint, enabling an attacker to authenticate as arbitrary users and impersonate them to access their tickets. Impact is high confidentiality/integrity loss with...