CVE-2024-24574 phpMyFAQ vulnerable to stored XSS on attachments filename

phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Unsafe echo of filename in phpMyFAQ\phpmyfaq\admin\attachments.php leads to allowed execution of JavaScript code in client side XSS. This vulnerability has been patched in version 3.2.5...

CVE-2024-24574

CVE-2024-24574 affects phpMyFAQ; unsafe echo of the filename in phpMyFAQ/phpmyfaq/admin/attachments.php enables a stored XSS (client-side JavaScript execution). The vulnerability has been patched in version 3.2.5. Affected description and references from multiple sources (NVD, Red Hat, GHSA) conf...

CVE-2024-22208

CVE-2024-22208 affects phpMyFAQ, where the front-end sharing feature allows unauthenticated users to email multiple recipients (the UI supports 5 addresses) and, due to backend lack of enforcement, can be abused to send thousands of phishing emails via the app’s mail server. The issue stems from ...

CVE-2024-22202

phpMyFAQ contains a vulnerability in the user removal page that lets an attacker spoof another user’s details and trigger phishing-style account deletion emails to administrators. The issue arises because the front-end does not enforce data integrity on the removal request, enabling an attacker (...

CVE-2024-22202 User Removal Page Allows Spoofing Of User Details

phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. phpMyFAQ's user removal page allows an attacker to spoof another user's detail, and in turn make a compelling phishing case for removing another user's account. The front-end of this page doesn'...

SSPI Authentication Errors

Challenge In Veeam Backup & Replication When installing updates, restoring configuration, or directly interacting with the database e.g., using pgAdmin, the following error occurs: SSPI authentication failed for user In Veeam ONE When upgrading to Veeam ONE v13, the following error may occur:...

RHEL 8 : postgresql:12 (RHSA-2023:7656)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7656 advisory. PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: Buffer overrun from integer overflo...

RHEL 8 : postgresql:10 (RHSA-2023:7786)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:7786 advisory. PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: Buffer overrun from integer overflow in arra...

RHEL 8 : postgresql:15 (RHSA-2023:7883)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7883 advisory. PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: Buffer overrun from integer overflo...

RHEL 8 : postgresql:13 (RHSA-2023:7579)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7579 advisory. PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: Buffer overrun from integer overflo...

Amazon Linux 2 : postgresql (ALASPOSTGRESQL14-2024-004)

The version of postgresql installed on the remote host is prior to 14.10-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2POSTGRESQL14-2024-004 advisory. Certain aggregate function calls receiving unknown-type arguments could disclose bytes of server memory from...

Amazon Linux 2 : postgresql (ALASPOSTGRESQL12-2024-007)

The version of postgresql installed on the remote host is prior to 12.17-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2POSTGRESQL12-2024-007 advisory. Certain aggregate function calls receiving unknown-type arguments could disclose bytes of server memory from...

Amazon Linux 2 : postgresql (ALASPOSTGRESQL13-2024-005)

The version of postgresql installed on the remote host is prior to 13.13-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2POSTGRESQL13-2024-005 advisory. Certain aggregate function calls receiving unknown-type arguments could disclose bytes of server memory from...

Amazon Linux 2 : libpq (ALASPOSTGRESQL14-2024-005)

The version of libpq installed on the remote host is prior to 14.10-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2POSTGRESQL14-2024-005 advisory. 2024-06-06: CVE-2023-5869 was removed from this advisory.2024-06-06: The severity of this advisory was modified from...

[SECURITY] Fedora 39 Update: pgadmin4-7.8-3.fc39

pgAdmin is the most popular and feature rich Open Source administration and d evelopment platform for PostgreSQL, the most advanced Open Source database in the world...

Low: libpq

Issue Overview: No CVE associated with this advisory Affected Packages: libpq Note: This advisory is applicable to Amazon Linux 2 - Postgresql14 Extra. Visit this page to learn more about Amazon Linux 2 AL2 Extras and this FAQ section for the difference between AL2 Core and AL2 Extras advisories...

Important: postgresql

Issue Overview: Certain aggregate function calls receiving "unknown"-type arguments could disclose bytes of server memory from the end of the "unknown"-type value to the next zero byte. One typically gets an "unknown"-type value via a string literal having no type designation. We have not confirm...

Important: postgresql

Issue Overview: Certain aggregate function calls receiving "unknown"-type arguments could disclose bytes of server memory from the end of the "unknown"-type value to the next zero byte. One typically gets an "unknown"-type value via a string literal having no type designation. We have not confirm...

Important: postgresql

Issue Overview: Certain aggregate function calls receiving "unknown"-type arguments could disclose bytes of server memory from the end of the "unknown"-type value to the next zero byte. One typically gets an "unknown"-type value via a string literal having no type designation. We have not confirm...

Fedora: Security Advisory (FEDORA-2024-9818cb2406)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...