CVE-2024-40750

Linksys Velop Pro 6E 1.0.8 MX62001.0.8.215731 and 7 1.0.10.215314 devices send cleartext Wi-Fi passwords over the public Internet during app-based installation...

WordPress plugin Unlimited Elements For Elementor Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

Code Issue Vulnerability in DAR-7000 at AUO Electronic Devices (Shanghai) Co.

DAR-7000 is an Internet Behavior Audit Gateway from China AUO D-Link. AUO Electronic Devices Shanghai Co. A code issue vulnerability exists in the DAR-7000, which stems from the file parameter of /log/decodmail.php being able to deserialize certain content. No details of the vulnerability are...

Linksys Velop Pro 6E Security Vulnerability

The Linksys Velop Pro 6E is a wireless router from Linksys. A security vulnerability exists in Linksys Velop Pro 6E versions 1.0.8 MX62001.0.8.215731 and 7 1.0.10.215314, which originates from a plaintext Wi-Fi password being sent over the public Internet during an application-based installation...

CVE-2024-40750

Linksys Velop Pro 6E 1.0.8 MX62001.0.8.215731 and 7 1.0.10.215314 devices send cleartext Wi-Fi passwords over the public Internet during app-based installation...

Microsoft Defender Security Vulnerability

Microsoft Defender is a threat protection software from Microsoft USA. A security vulnerability exists in Microsoft Defender for IoT. An attacker can elevate privileges by exploiting the vulnerability...

PT-2024-29027 · Linksys · Linksys Velop Pro 6E

Name of the Vulnerable Software and Affected Versions: Linksys Velop Pro 6E version 1.0.8 Linksys Velop Pro 6E version 1.0.10.215314 Description: The issue concerns Linksys Velop Pro 6E devices sending cleartext Wi-Fi passwords over the public Internet during app-based installation...

JVN#28515217: Cleartext transmission issue in TONE store App to TONE store

TONE store App provided by DREAM TRAIN INTERNET INC. contains a cleartext transmission issue to TONE store website CWE-419. Impact A man-in-the-middle attack may allow an attacker to obtain and/or alter communications of the affected App. Solution Update the application Update the application to...

Internet Bug Bounty: CVE-2024-34750 Apache Tomcat DoS vulnerability in HTTP/2 connector

CVE-2024-34750: Apache Tomcat Denial of Service Vulnerability A vulnerability was discovered in Apache Tomcat versions between 11.0.0-M1 and 11.0.0-M20, 10.1.0-M1 and 10.1.24, and 9.0.0-M1 and 9.0.89. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers...

UBUNTU-CVE-2024-6284

In https://github.com/google/nftables IP addresses were encoded in the wrong byte order, resulting in an nftables configuration which does not work as intended might block or not block the desired addresses. This issue affects: https://pkg.go.dev/github.com/google/[email protected] The bug was...

Internet Bug Bounty: moderate: Apache HTTP Server: HTTP response splitting (CVE-2023-38709)

moderate: Apache HTTP Server: HTTP response splitting CVE-2023-38709 Faulty input validation in the core of Apache allowed malicious or exploitable backend/content generators to split HTTP responses. This issue affected Apache HTTP Server through version 2.4.58...

Internet Bug Bounty: important: Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect (CVE-2024-38476)

The Apache HTTP Server vulnerability CVE-2024-38476 was discovered in versions 2.4.0 through 2.4.59. The vulnerability allowed the use of exploitable or malicious backend application output to run local handlers via internal redirect. Users were recommended to upgrade to version 2.4.60, which fix...

Internet Bug Bounty: important: Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path. (CVE-2024-38475)

The Apache HTTP Server was found to have a vulnerability in modrewrite where improper escaping of output allowed attackers to map URLs to filesystem locations that were permitted to be served by the server but were not intentionally/directly reachable by any URL. This resulted in potential code...

Internet Bug Bounty: important: Apache HTTP Server weakness with encoded question marks in backreferences (CVE-2024-38474)

The Apache HTTP Server versions 2.4.0 through 2.4.59 were affected by a substitution encoding issue in modrewrite that allowed attackers to execute scripts in directories permitted by the configuration, but not directly reachable by any URL, or disclose the source of scripts meant to be executed ...

ABB ASPECT System

SUMMARY ABB became aware of vulnerabilities in the product versions listed as affected in the advisory. ASPECT devices are not intended to be internet-facing. A product advisory issued in June 2023 informed cus-tomers of this parameter. An attacker can successfully exploit these vulnerabilities...

kernel: ipv6: sr: fix possible use-after-free and null-ptr-deref

A use-after-free flaw was found in the Linux kernel’s IPv6 protocol functionality. This flaw allows a local user to potentially crash the system...

The Problem the US TikTok Crackdown and Kaspersky Ban Have in Common

While Kaspersky and TikTok make very different kinds of software, the US has targeted both over national security concerns. But the looming bans have larger implications for internet freedom...

Azure IoT Platform Device SDK Double Free Vulnerability

...

Google to Block Entrust Certificates in Chrome Starting November 2024

Google has announced that it's going to start blocking websites that use certificates from Entrust starting around November 1, 2024, in its Chrome browser, citing compliance failures and the certificate authority's inability to address security issues in a timely manner. "Over the past several...

The vulnerability of the VPN protocol library using “IPsec” in libreswan, related to uncontrolled, reachable assertions, allows attackers to cause service failures.

The vulnerability of the VPN protocol using “IPsec” with libreswan is related to a claim that packets processed via IKEv1 can be processed without specifying the esp field. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...