USN-7049-1: PHP vulnerabilities

It was discovered that PHP incorrectly handled parsing multipart form data. A remote attacker could possibly use this issue to inject payloads and cause PHP to ignore legitimate data. CVE-2024-8925 It was discovered that PHP incorrectly handled the cgi.forceredirect configuration option due to...

USN-7049-1 php7.4, php8.1, php8.3 vulnerabilities

It was discovered that PHP incorrectly handled parsing multipart form data. A remote attacker could possibly use this issue to inject payloads and cause PHP to ignore legitimate data. CVE-2024-8925 It was discovered that PHP incorrectly handled the cgi.forceredirect configuration option due to...

Command Injection

Overview PyNinja is a Lightweight OS-agnostic service monitoring API Affected versions of this package are vulnerable to Command Injection through relative path for service managers and due to insufficient logging for service level failures. Remediation Upgrade PyNinja to version 0.0.4 or higher...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : PHP vulnerabilities (USN-7049-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7049-1 advisory. It was discovered that PHP incorrectly handled parsing multipart form data. A remote attacker could possibly use this issue to...

Information Disclosure

github.com/microsoft/terraform-provider-power-platform is vulnerable to Information Disclosure. The vulnerability is due to improper handling of sensitive data in the logging mechanism, where the clientsecret is not properly masked. This allows an attacker to impersonate the service principal and...

CVE-2024-9315

A vulnerability was found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/maintenance/managedepartment.php. The manipulation of the argument id leads to sql injection. The attack may ...

CVE-2024-9315 SourceCodester Employee and Visitor Gate Pass Logging System manage_department.php sql injection

A vulnerability was found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/maintenance/managedepartment.php. The manipulation of the argument id leads to sql injection. The attack may ...

CVE-2024-9315 SourceCodester Employee and Visitor Gate Pass Logging System manage_department.php sql injection

A vulnerability was found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/maintenance/managedepartment.php. The manipulation of the argument id leads to sql injection. The attack may ...

CVE-2024-9315

CVE-2024-9315 affects SourceCodester Employee and Visitor Gate Pass Logging System v1.0. The issue is a SQL injection in the /admin/maintenance/manage_department.php page caused by unsafely handling the id parameter, enabling remote exploitation. Multiple sources confirm the vulnerability details...

Employee and Visitor Gate Pass Logging System SQL注入漏洞

Employee and Visitor Gate Pass Logging System is an employee and visitor pass logging system by Carlo Montero, an individual developer. A SQL injection vulnerability exists in SourceCodester Employee and Visitor Gate Pass Logging System version 1.0, which stems from an SQL injection in the id...

New HTML Smuggling Campaign Delivers DCRat Malware to Russian-Speaking Users

Russian-speaking users have been targeted as part of a new campaign distributing a commodity trojan called DCRat aka DarkCrystal RAT by means of a technique known as HTML smuggling. The development marks the first time the malware has been deployed using this method, a departure from previously...

Moderate: Red Hat Security Advisory: Logging for Red Hat OpenShift - 5.8.13

Logging for Red Hat OpenShift - 5.8.13 Logging for Red Hat OpenShift - 5.8.13...

BIT-ENVOY-2024-7207

A flaw was found in Envoy. It is possible to modify or manipulate headers from external clients when pass-through routes are used for the ingress gateway. This issue could allow a malicious user to forge what is logged by Envoy as a requested path and cause the Envoy proxy to make requests to...

USN-7036-1 ruby-rack vulnerabilities

It was discovered that Rack was not properly parsing data when processing multipart POST requests. If a user or automated system were tricked into sending a specially crafted multipart POST request to an application using Rack, a remote attacker could possibly use this issue to cause a denial of...

CVE-2024-47083

Power Platform Terraform Provider allows managing environments and other resources within Power Platform. Versions prior to 3.0.0 have an issue in the Power Platform Terraform Provider where sensitive information, specifically the clientsecret used in the service principal authentication, may be...

CVE-2024-47083 Power Platform Terraform Provider has Improper Masking of Secrets in Logs

Power Platform Terraform Provider allows managing environments and other resources within Power Platform. Versions prior to 3.0.0 have an issue in the Power Platform Terraform Provider where sensitive information, specifically the clientsecret used in the service principal authentication, may be...

CVE-2024-47083 Power Platform Terraform Provider has Improper Masking of Secrets in Logs

Power Platform Terraform Provider allows managing environments and other resources within Power Platform. Versions prior to 3.0.0 have an issue in the Power Platform Terraform Provider where sensitive information, specifically the clientsecret used in the service principal authentication, may be...

kernel: USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages

A vulnerability was found in the Linux kernel's CDC WDM driver, where excessive logging in the interrupt-URB completion callback could lead to CPU lockups, which occurs when the driver rapidly resubmits interrupt URBs after receiving a -EPROTO status, causing a backlog of error messages that...

CVE-2024-7207

Rejected reason: Duplicate of CVE-2024-45806...

pcp: pmpost symlink attack allows escalating pcp to root user

A vulnerability was found in Performance Co-Pilot PCP. This flaw can only be exploited if an attacker has access to a compromised PCP system account. The issue is related to the pmpost tool, which is used to log messages in the system. Under certain conditions, it runs with high-level privileges...