Livewire Cross-Site Request Forgery Vulnerability

Livewire is a full-stack framework for Laravel that allows you to build dynamic UI components without leaving PHP. A cross-site request forgery vulnerability exists in Livewire versions prior to v3.0.4, which originates from a vulnerability that allows remote attackers to execute arbitrary code v...

Identify and De-risk Unmanaged, Unauthorized Devices With Qualys CyberSecurity Asset Management (CSAM)

69% of organizations said they experienced at least one cyberattack resulting from an exploit of an unknown or unmanaged asset such as software, cloud-based workloads user accounts, and IoT devices. Ultimately, these attacks stem from visibility gaps in the attack surface. Bringing these assets...

Enumeration of users in HashiCorp Vault

HashiCorp Vault and Vault Enterprise allowed the enumeration of users via the LDAP auth method. Fixed in 1.5.6 and 1.6.1...

urllib3: Request body not stripped after redirect from 303 status changes request method to GET

A flaw was found in urllib3, an HTTP client library for Python. urllib3 doesn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303, after changing the method in a request from one that could accept a request body such as POST to GET, as is required by HTTP...

TOTOLINK A3300R security vulnerabilities

TOTOLINK A3300R is a dual-band wireless router manufactured by China's Gion Electronics TOTOLINK, mainly used for home and small network environments. The TOTOLINK A3300R suffers from a command injection vulnerability that stems from the failure of the arpEnable parameter of the setStaticDhcpRule...

openBI Information Disclosure Vulnerability

openBI is a big data visualization solution from openBI. An information disclosure vulnerability exists in openBI version 1.0.8, which stems from an information disclosure issue in the agent method of the /application/index/controller/Datament.php file...

openBI Security Vulnerabilities

openBI is a big data visualization solution from openBI Inc. A security vulnerability exists in openBI version 1.0.8, which stems from an unrestricted file upload in the uploadFile method of the /application/index/controller/File.php file...

CVE-2023-5389: Exposed Dangerous Method or Function

An attacker could potentially exploit this vulnerability, leading to the ability to modify files on Honeywell Experion ControlEdge VirtualUOC and ControlEdge UOC . This exploit could be used to write a file that may result in unexpected behavior based on configuration changes or updating of files...

Integer Overflow to Buffer Overflow

Overview Affected versions of this package are vulnerable to Integer Overflow to Buffer Overflow in the UTF32Encoding::convert and UTF32Encoding::queryConvert methods. Remediation Upgrade poco to version 1.11.0 or higher. References - GitHub Commit - GitHub Commit - GitHub Diff - GitHub Issue -...

TOTOLINK A3700R setLanguageCfg Method Buffer Overflow Vulnerability

The TOTOLINK A3700R is a wireless router from China's Gion Electronics TOTOLINK. The TOTOLINK A3700R suffers from a buffer overflow vulnerability that stems from the setLanguageCfg method failing to properly validate the length and size of the input data, which can be exploited by an attacker to...

Mozilla Firefox Denial of Service Vulnerability (CNVD-2024-10432)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox suffers from a denial of service vulnerability caused by an unchecked return value in the TLS handshake code. An attacker can exploit the vulnerability to cause the NSS TLS method to...

PT-2024-15732 · 10Web · The Form Maker

Name of the Vulnerable Software and Affected Versions: The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress versions up to, and including, 1.15.21 Description: The issue is due to missing or incorrect nonce validation on the execute function, making it...

TOTOLINK A3700R setParentalRules method buffer overflow vulnerability

The TOTOLINK A3700R is a wireless router from China's Gion Electronics TOTOLINK. The TOTOLINK A3700R suffers from a buffer overflow vulnerability that stems from the setParentalRules method failing to properly validate the length size of input data, which can be exploited by an attacker to execut...

Cross site scripting

An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in J-Web of Juniper Networks Junos OS on SRX Series and EX Series allows an attacker to construct a URL that when visited by another user enables the attacker to execute commands with the target's...

CVE-2023-5675

A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either...

urllib3: Request body not stripped after redirect from 303 status changes request method to GET

A flaw was found in urllib3, an HTTP client library for Python. urllib3 doesn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303, after changing the method in a request from one that could accept a request body such as POST to GET, as is required by HTTP...

TOTOLINK X6000R Command Injection Vulnerability

TOTOLINK X6000R is a wireless router supporting Wi-Fi 6 technology from China's Gion Electronics TOTOLINK, focusing on high concurrent connections and dual-band transmission capabilities. The TOTOLINK X6000R suffers from a command injection vulnerability that stems from a command injection...

PT-2024-1629 · Plone · Plone

Name of the Vulnerable Software and Affected Versions: Plone Docker version 5.2.13 5221 Description: The issue is related to the absence of a mechanism to prevent unintended changes to resources when processing requests. This allows unauthenticated attackers to execute dangerous actions, such as...

Moderate: python-urllib3 security update

The python-urllib3 package provides the Python HTTP module with connection pooling and file POST abilities. Security Fixes: python-urllib3: Cookie request header isn't stripped during cross-origin redirects CVE-2023-43804 urllib3: Request body not stripped after redirect from 303 status changes...

SWFTools swf_DeleteTag method memory misreference vulnerability

SWFTools is a set of utilities for working with Adobe Flash files SWF files. A memory misreference vulnerability exists in SWFTools version 0.9.2, which stems from a messed up instruction responsible for freeing memory in the swfDeleteTag method on page rfxswf.c:1193. An attacker can exploit this...