CVE-2024-28854 Slow loris vulnerability with default configuration in tls-listener

tls-listener is a rust lang wrapper around a connection listener to support TLS. With the default configuration of tls-listener, a malicious user can open 6.4 TcpStreams a second, sending 0 bytes, and can trigger a DoS. The default configuration options make any public service using...

CVE-2024-28854 Slow loris vulnerability with default configuration in tls-listener

tls-listener is a rust lang wrapper around a connection listener to support TLS. With the default configuration of tls-listener, a malicious user can open 6.4 TcpStreams a second, sending 0 bytes, and can trigger a DoS. The default configuration options make any public service using...

CVE-2024-28854 Slow loris vulnerability with default configuration in tls-listener

tls-listener is a rust lang wrapper around a connection listener to support TLS. With the default configuration of tls-listener, a malicious user can open 6.4 TcpStreams a second, sending 0 bytes, and can trigger a DoS. The default configuration options make any public service using...

RUSTSEC-2024-0341 Slow loris vulnerability with default configuration

tls-listener is a rust lang wrapper around a connection listener to support TLS. With the default configuration of tls-listener, a malicious user can open 6.4 TcpStreams a second, sending 0 bytes, and can trigger a DoS. The default configuration options make any public service using...

PT-2024-2476 · Moodle · Moodle

Name of the Vulnerable Software and Affected Versions: Moodle version 3.10.9 Description: A Cross-Site Scripting XSS issue exists due to inadequate protection of the webpage structure when handling the lang parameter in the "/?lang=" URL parameter. This could allow a remote attacker to read,...

[SECURITY] Fedora 40 Update: apache-commons-math-3.6.1-18.fc40

Commons Math is a library of lightweight, self-contained mathematics and statistics components addressing the most common problems not available in the Java programming language or Commons Lang...

BIT-GOLANG-2021-27918

encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader for xml.NewTokenDecoder returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Skip method...

BIT-PHPMYADMIN-2022-0813 PhpMyAdmin exposure of sensitive information

PhpMyAdmin 5.1.1 and before allows an attacker to retrieve potentially sensitive information by creating invalid requests. This affects the lang parameter, the pmaparameter, and the cookie section...

TOTOLINK N200RE 安全漏洞

The TOTOLINK N200RE is a wireless broadband router for small office or home SOHO environments. The TOTOLINK N200RE suffers from a stack buffer overflow vulnerability that originates from a stack-based buffer overflow in the lang parameter of the setLanguageCfg function of /cgi-bin/cstecgi.cgi. No...

PT-2024-1317 · Totolink · Totolink N200Re

Name of the Vulnerable Software and Affected Versions: Totolink N200RE version 9.3.5u.6139 B20201216 Description: A critical issue has been found in the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi, where the manipulation of the argument lang leads to a stack-based buffer overflow. Th...

PT-2024-13309 · S-Lang +1 · S-Lang +1

Name of the Vulnerable Software and Affected Versions: S-Lang version 2.3.2 Description: The issue is related to an arithmetic exception in S-Lang via the tt sprintf function. Recommendations: For S-Lang version 2.3.2, consider disabling the tt sprintf function until a patch is available. At the...

ferris-says has undefined behavior when not using UTF-8

Affected versions receive a &u8 from the caller through a safe API, and pass it directly to the unsafe str::fromutf8unchecked function. The behavior of ferrissays::say is undefined if the bytes from the caller don't happen to be valid UTF-8. The flaw was corrected in ferris-says21 by using the sa...

CVE-2023-52042

An issue discovered in sub4117F8 function in TOTOLINK X6000R V9.4.0cu.852B20230719 allows attackers to run arbitrary commands via the 'lang' parameter...

CVE-2023-52042

An issue discovered in sub4117F8 function in TOTOLINK X6000R V9.4.0cu.852B20230719 allows attackers to run arbitrary commands via the 'lang' parameter...

PT-2024-14371 · Totolink · Totolink X6000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK X6000R version 9.4.0cu.852 B20230719 Description: An issue discovered in the sub 4117F8 function allows attackers to run arbitrary commands via the lang parameter. Recommendations: For TOTOLINK X6000R version 9.4.0cu.852 B20230719,...

TOTOLINK X6000R 安全漏洞

TOTOLINK X6000R is a wireless router from China's Gion Electronics TOTOLINK. The TOTOLINK X6000R suffers from a code execution vulnerability that stems from the application's failure to properly filter construct command special characters, commands, etc. An attacker can exploit the vulnerability ...

Piwigo Security Breach

Piwigo is a Web-based open source photo gallery software. The software includes features such as image management, image categorization and permission management. A security vulnerability exists in Piwigo version v.14.0.0, which stems from a cross-site scripting vulnerability that allows remote...

PT-2024-15408 · Icewarp · Icewarp

Name of the Vulnerable Software and Affected Versions: IceWarp versions 12.0.2.1 through 12.0.3.1 Description: A problematic issue has been discovered, affecting the Utility Download Handler component in the /install/ file. The issue can be exploited by manipulating the lang argument with a...

IceWarp Cross-Site Scripting Vulnerability

IceWarp is an integrated enterprise communication and collaboration platform from IceWarp, a Czech company, designed to provide organizations with a variety of tools and features to support internal and external communication, collaboration and business processes. A cross-site scripting...

PT-2023-31738 · Totolink · Totolink Ex1800T

Name of the Vulnerable Software and Affected Versions: TOTOlink EX1800T version 9.1.0cu.2112 B20220316 Description: The issue allows for unauthorized arbitrary command execution. This is achieved through the langFlag parameter of the "setLanguageCfg" interface in the "cstecgi.cgi" endpoint...