Huawei EulerOS: Security Advisory for httpd (EulerOS-SA-2023-1998)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-27639

An issue was discovered in the tshirtecommerce aka Custom Product Designer component 2.1.4 for PrestaShop. An HTTP request can be forged with the POST parameter filename in the tshirtecommerce/ajax.php?type=svg endpoint, to allow a remote attacker to traverse directories on the system in order to...

CVE-2023-27639

An issue was discovered in the tshirtecommerce aka Custom Product Designer component 2.1.4 for PrestaShop. An HTTP request can be forged with the POST parameter filename in the tshirtecommerce/ajax.php?type=svg endpoint, to allow a remote attacker to traverse directories on the system in order to...

CVE-2023-27639

The tshirtecommerce (Custom Product Designer) component version 2.1.4 for PrestaShop is vulnerable to a directory traversal attack. A remote attacker can forge an HTTP request using the file_name parameter in the tshirtecommerce/ajax.php?type=svg endpoint to traverse directories and open arbitrar...

CVE-2023-33966

Deno is a runtime for JavaScript and TypeScript. In deno 1.34.0 and denoruntime 0.114.0, outbound HTTP requests made using the built-in "node:http" or "node:https" modules are incorrectly not checked against the network permission allow list "--allow-net". Dependencies relying on these built-in...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.18-openssl (SUSE-SU-2023:2312-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2312-1 advisory. - Add subpackage go1.x-libstd compiled shared object libstd.so jscPED-1962 Main go1.x package...

Pydio Cells 4.1.2 - Unauthorised Role Assignments Vulnerability

Exploit Title: Pydio Cells 4.1.2 - Unauthorised Role Assignments Affected Versions: 4.1.2 and earlier versions Fixed Versions: 4.2.0, 4.1.3, 3.0.12 Vulnerability Type: Privilege Escalation Security Risk: high Vendor URL: https://pydio.com/ Vendor Status: notified Advisory URL:...

GHSA-MJ6P-3PC9-WF5M proxy denial of service vulnerability

A remote attacker can trigger a denial of service in the socket.remoteAddress variable, by sending a crafted HTTP request. Usage of the undefined variable raises a TypeError exception...

proxy denial of service vulnerability

A remote attacker can trigger a denial of service in the socket.remoteAddress variable, by sending a crafted HTTP request. Usage of the undefined variable raises a TypeError exception...

CVE-2023-2968

A remote attacker can trigger a denial of service in the socket.remoteAddress variable, by sending a crafted HTTP request. Usage of the undefined variable raises a TypeError exception...

Code injection

A remote attacker can trigger a denial of service in the socket.remoteAddress variable, by sending a crafted HTTP request. Usage of the undefined variable raises a TypeError exception...

CVE-2023-2968 Undefined variable usage in npm package "proxy" leads to remote denial of service

A remote attacker can trigger a denial of service in the socket.remoteAddress variable, by sending a crafted HTTP request. Usage of the undefined variable raises a TypeError exception...

CVE-2023-2968

CVE-2023-2968 corresponds to a DoS flaw in the npm package proxy (TooTallNate proxy-agents) caused by using an undefined variable in socket.remoteAddress, which raises a TypeError when processing crafted HTTP requests. The vulnerability allows remote attackers to trigger denial of service without...

Security Bulletin: Apache HTTP Server as used by IBM QRadar SIEM is vulnerable to HTTP request splitting attacks (CVE-2023-25690)

Summary Apache HTTP Server as used by IBM QRadar SIEM is vulnerable to HTTP request splitting attacks. IBM has addressed the relevant vulnerability Vulnerability Details CVEID:CVE-2023-25690 DESCRIPTION: Apache HTTP Server is vulnerable to HTTP request splitting attacks, caused by an error when...

PT-2023-4004

Name of the Vulnerable Software and Affected Versions Zyxel NAS326 versions prior to V5.21AAZF.13C0 Zyxel NAS540 affected versions not specified Zyxel NAS542 affected versions not specified Description The issue is related to a command injection vulnerability. It may allow a remote attacker with...

GLSA-202305-37 : Apache Tomcat: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202305-37 Apache Tomcat: Multiple Vulnerabilities - If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to...

CVE-2023-2968: Improper Handling of Undefined Values

A remote attacker can trigger a denial of service in the socket.remoteAddress variable, by sending a crafted HTTP request. Usage of the undefined variable raises a TypeError exception...

Denial Of Service (DoS)

froxlor/froxlor is vulnerable to Denial Of Service DoS. The vulnerability exists because of a lack of HTTP request validation in the rate-limiting functionality during a password reset, which allows an attacker to crash the application...

Privilege Escalation

org.apache.inlong is vulnerable to Privilege Escalation. The vulnerability exists because the library does not properly remove the permission when deleting a user, allowing an attacker with a valid but unprivileged account to send malicious login requests and follow it with a subsequent HTTP...

CVE-2023-33280

In the Store Commander scquickaccounting module for PrestaShop through 3.7.3, multiple sensitive SQL calls can be executed with a trivial HTTP request and exploited to forge a blind SQL injection...