F5 BIG-IP Security Vulnerabilities

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, and load balancing. A security vulnerability exists in F5 BIG-IP that stems from an undisclosed response that could cause the Traffic Management Microkernel TMM t...

Contiki-NG Buffer Error Vulnerability

Contiki-NG is an open source cross-platform operating system for next-generation IoT Internet of Things devices. A buffer error vulnerability exists in Contiki-NG 4.9 and earlier versions, which stems from an out-of-bounds write in the driver for the IEEE 802.15.4 radio...

CVE-2024-23306: Insufficiently Protected Credentials

A vulnerability exists in BIG-IP Next CNF and SPK systems that may allow access to undisclosed sensitive files. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2024-23314: Use of Uninitialized Resource

When HTTP/2 is configured on BIG-IP or BIG-IP Next SPK systems, undisclosed responses can cause the Traffic Management Microkernel TMM to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

PT-2024-19798

Name of the Vulnerable Software and Affected Versions BIG-IP Next CNF and SPK systems affected versions not specified Description A vulnerability exists in BIG-IP Next CNF and SPK systems that may allow access to undisclosed sensitive files. Note that software versions which have reached End of...

F5 BIG-IP Security Vulnerabilities

F5 BIG-IP is an application delivery platform that integrates network traffic management, application security management, load balancing, and other features from F5 USA. A security vulnerability exists in F5 BIG-IP that stems from a vulnerability in the Next CNF and SPK systems that allows acces...

PT-2024-14013 · Unknown · Contiki-Ng

Name of the Vulnerable Software and Affected Versions: Contiki-NG versions prior to 4.9 Description: The issue is caused by insufficient control of the lengths for DIO and DAO messages, particularly when they contain RPL sub-option headers, allowing an attacker to trigger out-of-bounds reads in t...

forum.phuketnext.com Cross Site Scripting vulnerability OBB-3848269

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Cross-site Scripting (XSS)

urql/next is vulnerable to Cross-site scripting XSS. The vulnerability is due to improper sanitization of HTML-like characters in the response stream. An attacker can inject malicious scripts by ensuring that the response returns html tags and that the web-application is using streamed responses...

@enalmada/next-gql (>=0.0.4, <=0.1.3) potentially affected by CVE-2024-24556 via @urql/next (>=1.0.0, <=1.1.0)

@urql/next NPM version =1.0.0, =0.0.4, =0.1.3 Source cves: CVE-2024-24556 Source advisory: OSV:GHSA-QHJF-HM5J-335W...

GHSA-QHJF-HM5J-335W @urql/next Cross-site Scripting vulnerability

impact The @urql/next package is vulnerable to XSS. To exploit this an attacker would need to ensure that the response returns html tags and that the web-application is using streamed responses non-RSC. This vulnerability is due to improper escaping of html-like characters in the response-stream...

@enalmada/next-gql (>=0.0.4, <=0.1.3) potentially affected by CVE-2024-24556 via @urql/next (>=1.0.0, <=1.1.0)

@urql/next NPM version =1.0.0, =0.0.4, =0.1.3 Source cves: CVE-2024-24556 Source advisory: GHSA-QHJF-HM5J-335W...

@urql/next Cross-site Scripting vulnerability

impact The @urql/next package is vulnerable to XSS. To exploit this an attacker would need to ensure that the response returns html tags and that the web-application is using streamed responses non-RSC. This vulnerability is due to improper escaping of html-like characters in the response-stream...

CVE-2024-24558

TanStack Query supplies asynchronous state management, server-state utilities and data fetching for the web. The @tanstack/react-query-next-experimental NPM package is vulnerable to a cross-site scripting vulnerability. To exploit this, an attacker would need to either inject malicious input or...

CVE-2024-24556

urql is a GraphQL client that exposes a set of helpers for several frameworks. The @urql/next package is vulnerable to XSS. To exploit this an attacker would need to ensure that the response returns html tags and that the web-application is using streamed responses non-RSC. This vulnerability is...

CVE-2024-24556 XSS in @urql/next

urql is a GraphQL client that exposes a set of helpers for several frameworks. The @urql/next package is vulnerable to XSS. To exploit this an attacker would need to ensure that the response returns html tags and that the web-application is using streamed responses non-RSC. This vulnerability is...

@enalmada/next-gql (>=0.0.4, <=0.1.3) potentially affected by CVE-2024-24556 via @urql/next (>=1.0.0, <=1.1.0)

@urql/next NPM version =1.0.0, =0.0.4, =0.1.3 Source cves: CVE-2024-24556 Source advisory: MEND:CVE-2024-24556...

CVE-2024-24556

CVE-2024-24556 affects the urql family; specifically the @urql/next package is vulnerable to Cross-Site Scripting (XSS). The root cause is improper escaping of HTML-like characters in the response stream, which attackers could exploit when the application uses streamed responses (non-RSC) and the...

CVE-2024-24556 XSS in @urql/next

urql is a GraphQL client that exposes a set of helpers for several frameworks. The @urql/next package is vulnerable to XSS. To exploit this an attacker would need to ensure that the response returns html tags and that the web-application is using streamed responses non-RSC. This vulnerability is...

CVE-2024-24556

urql is a GraphQL client that exposes a set of helpers for several frameworks. The "@urql/next" package is vulnerable to XSS. To exploit this an attacker would need to ensure that the response returns "html" tags and that the web-application is using streamed responses non-RSC. This vulnerability...