PT-2024-23641 · Netentsec · Netentsec Ns-Asg

Name of the Vulnerable Software and Affected Versions: netentsec NS-ASG version 6.3 Description: The issue is related to SQL Injection, which can be exploited via the "/WebPages/history.php" API endpoint. This allows for potential unauthorized access or manipulation of data. Recommendations: For...

PT-2024-23635 · Netentsec · Netentsec Ns-Asg

Name of the Vulnerable Software and Affected Versions: netentsec NS-ASG version 6.3 Description: The issue is related to SQL Injection. It can be exploited via the "/admin/edit fire wall.php" API endpoint. Recommendations: For netentsec NS-ASG version 6.3, consider restricting access to the...

Exploit for Embedded Malicious Code in Tukaani Xz

Good evening, I would like to inform you about a critical secur...

CVE-2024-30468

All In One WP Security & Firewall (AIOS) for WordPress is affected by a Cross-Site Request Forgery (CSRF) vulnerability in versions up to 5.2.6, with fix released in 5.2.7. The issue can be triggered by unauthenticated attackers exploiting CSRF to manipulate actions triggered by site administrato...

OESA-2024-1334 mod_security security update

This software is also called Modsec,it is an open-source web application firewall. It is designed for Apache HTTP Server.ModSecurity is commonly deployed to provide protections against generic classed of vulnerabilities.The install of this package is easy and you can read the README.TXT for more...

Wordfence Intelligence Weekly WordPress Vulnerability Report (March 18, 2024 to March 24, 2024)

Did you know were running a Bug Bounty Extravaganza again? Earn over 6x our usual bounty rates, up to $10,000, for all vulnerabilities submitted through May 27th, 2024 when you opt to have Wordfence handle responsible disclosure! Last week, there were 94 vulnerabilities disclosed in 81 WordPress...

Imperva SecureSphere 安全漏洞

Imperva SecureSphere is a suite of high-performance, centralized data security protection and management products from Imperva, USA. The product provides unified auditing, reporting and logging of different SecureSphere products, visualization of security status and real-time monitoring of events...

WordPress All In One WP Security & Firewall Plugin <= 5.2.6 is vulnerable to Cross Site Request Forgery (CSRF)

Software All In One WP Security & Firewall Type Plugin Vulnerable versions = 5.2.6 Fixed in 5.2.7 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-30468 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 4458bfd0a1fc Credits...

K000139064: Apache vulnerabilities CVE-2009-2299, CVE-2012-3526, CVE-2012-4001, and CVE-2012-4360

Security Advisory Description CVE-2009-2299 The Artofdefence Hyperguard Web Application Firewall WAF module before 2.5.5-11635, 3.0 before 3.0.3-11636, and 3.1 before 3.1.1-11637, a module for the Apache HTTP Server, allows remote attackers to cause a denial of service memory consumption via an...

Firewall Bypass

github.com/chirpstack/chirpstack-gateway-bridge/ is vulnerable to Firewall Bypass. The vulnerability is due to the firewall accepting specific TCP packets outside the ESTABLISHED connection state...

[SECURITY] Fedora 40 Update: netavark-1.10.3-3.fc40

OCI network stack Netavark is a rust based network stack for containers. It is being designed to work with Podman but is also applicable for other OCI container management applications. Netavark is a tool for configuring networking for Linux containers. Its features include: Configuration of...

The vulnerability of the formSetFirewallCfg() function (/goform/SetFirewallCfg) in the Tenda AC15 router software allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the formSetFirewallCfg function /goform/SetFirewallCfg of the Tenda AC15 router’s software lies in the issue of the operation exceeding the buffer boundaries in memory when processing the firewallEn parameter. Exploiting this vulnerability allows an attacker to compromise the...

Fedora: Security Advisory for netavark (FEDORA-2024-a267e93f8c)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Hitachi Energy MACH SCM (Update A)

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.9 ATTENTION : Exploitable remotely Vendor : Hitachi Energy Equipment : MACH SCM Vulnerabilities : Improper Control of Generation of Code, Improper Neutralization of Directives in Dynamically Evaluated Code 2. RISK EVALUATION Successful exploitation of...

CVE-2024-2809

A vulnerability, which was classified as critical, was found in Tenda AC15 15.03.05.18/15.03.20multi. Affected is the function formSetFirewallCfg of the file /goform/SetFirewallCfg. The manipulation of the argument firewallEn leads to stack-based buffer overflow. It is possible to launch the atta...

The vulnerability of the built-in mobile security firewall, Ivanti Standalone Sentry, arises due to the lack of measures taken to neutralize special elements used in the operating system’s command set. This vulnerability allows a intruder to execute arbitrary code.

The vulnerability of the built-in mobile security firewall, Ivanti Standalone Sentry, exists due to the lack of measures taken to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Unspecified Vulnerability in Palo Alto Networks GlobalProtect (CNVD-2024-20435)

Palo Alto Networks GlobalProtect is a suite of network protection software from Palo Alto Networks, USA. The software provides firewall monitoring and threat prevention. A security vulnerability exists in Palo Alto Networks GlobalProtect that stems from the ability of a local user to exploit a...

Wordfence Intelligence Weekly WordPress Vulnerability Report (March 11, 2024 to March 17, 2024)

Did you know were running a Bug Bounty Extravaganza again? Earn over 6x our usual bounty rates, up to $10,000, for all vulnerabilities submitted through May 27th, 2024 when you opt to have Wordfence handle responsible disclosure! Last week, there were 163 vulnerabilities disclosed in 126 WordPres...

Critical Flaw In WordPress Plugins Poses Risk Of Site Takeover

Summary: A critical security vulnerability, identified as CVE-2024-2172 in WordPress, urges users utilizing miniOranges Malware Scanner and Web Application Firewall plugins to uninstall these plugins from their websites. This vulnerability enables unauthorized attackers to gain administrative...

CVE-2024-29862

The Kerlink firewall in ChirpStack chirpstack-mqtt-forwarder before 4.2.1 and chirpstack-gateway-bridge before 4.0.11 wrongly accepts certain TCP packets when a connection is not in the ESTABLISHED state...