21946 matches found
CVE-2024-46957
Mellium mellium.im/xmpp 0.0.1 through 0.21.4 allows response spoofing if the implementation uses predictable IDs because the stanza type is not checked. This is fixed in 0.22.0...
CVE-2024-46957
Mellium mellium.im/xmpp 0.0.1 through 0.21.4 allows response spoofing if the implementation uses predictable IDs because the stanza type is not checked. This is fixed in 0.22.0...
EulerOS 2.0 SP8 : httpd (EulerOS-SA-2024-2473)
According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses.CVE-2023-38709 HTT...
EulerOS 2.0 SP8 : shim (EulerOS-SA-2024-2489)
According to the versions of the shim package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summar...
Blast-RADIUS is a vulnerability that affects the RADIUS protocol (CVE-2024-3596)
A vulnerability in the verification of RADIUS Response from a RADIUS server has been disclosed by a team of researchers from UC San Diego and their partners. An attacker, with access to the network where the RADIUS protocol is being transmitted, can spoof a UDP-based RADIUS Response packet to...
CVE-2024-47069 Oveleon Cookiebar reflected Cross-site Scripting vulnerability
Oveleon Cookie Bar is a cookie bar is for the Contao Open Source CMS and allows a visitor to define cookie & privacy settings for the website. Prior to versions 1.16.3 and 2.1.3, the block/locale endpoint does not properly sanitize the user-controlled locale input before including it in the...
Expanding the Security Horizon: Introducing Rapid7 MDR for the Extended Ecosystem
As the cybersecurity landscape gets more complex, the stakes for keeping organizations safe have never been higher. Security teams are tasked with keeping ahead of new ransomware groups, rapidly evolving adversary tactics, and their dynamic attack surface as their business grows. Security...
PolyDrop - A BYOSI (Bring-Your-Own-Script-Interpreter) Rapid Payload Deployment Toolkit
BYOSI - Bring-Your-Own-Script-Interpreter - Leveraging the abuse of trusted applications, one is able to deliver a compatible script interpreter for a Windows, Mac, or Linux system as well as malicious source code in the form of the specific script interpreter of choice. Once both the malicious...
Denial Of Service (DoS)
github.com/coredns/coredns is vulnerable to Denial Of Service DoS. The vulnerability is due to improper handling of DNS responses by the resolver, which allows it to ignore valid replies, making it susceptible to forged responses from attackers...
Huawei EulerOS: Security Advisory for httpd (EulerOS-SA-2024-2473)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
PT-2024-32298 · Mellium · Mellium.Im/Xmpp
Name of the Vulnerable Software and Affected Versions: Mellium mellium.im/xmpp versions 0.0.1 through 0.21.4 Description: The issue allows response spoofing because the stanza type is not checked. This can lead to potential system compromise. The estimated number of potentially affected devices...
PT-2024-32086 · Helpdesk · Helpdesk
Name of the Vulnerable Software and Affected Versions: HelpDeskZ version 2.0.2 Description: A cross-site scripting XSS vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name text field of Custom Fields message box. This issue potential...
CVE-2024-9076
CVE-2024-9076 (DedeCMS) affects DedeCMS versions up to 5.7.115. The vulnerability is a command-injection in the article_string_mix.php (or similar) processing path, enabling remote execution due to improper handling of command input. Public exploits/poC are noted, and vendor contact was ineffecti...
SUSE CVE-2024-45409
The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in = 12.2 and 1.13.0 = 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document by the IdP can thus forge a SAML...
CVE-2024-9003 Jinan Chicheng Company JFlow Attachment EntityMutliFile_Load.do AttachmentUploadController access control
A vulnerability was found in Jinan Chicheng Company JFlow 2.0.0. It has been rated as problematic. This issue affects the function AttachmentUploadController of the file /WF/Ath/EntityMutliFileLoad.do of the component Attachment Handler. The manipulation of the argument oid leads to improper acce...
CVE-2024-9003
CVE-2024-9003 affects Jinan Chicheng/JFlow 2.0.0. The vulnerability is in the function AttachmentUploadController of the Attachment Handler, in file "/WF/Ath/EntityMutliFile_Load.do". The issue stems from manipulation of the argument oid , which leads to improper access controls and potentially e...
CVE-2024-9001
CVE-2024-9001 affects TOTOLINK T10 4.1.8cu.5207. The vulnerability is in the function setTracerouteCfg of /cgi-bin/cstecgi.cgi, where manipulating the argument command results in operating system command injection. The attack can be initiated remotely, and the exploit has been disclosed publicly....
Important: Red Hat Security Advisory: Red Hat Single Sign-On 7.6.11 security update on RHEL 8
New Red Hat Single Sign-On 7.6.11 packages are now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of none. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
Observable Response Discrepancy
Overview Affected versions of this package are vulnerable to Observable Response Discrepancy through the login notification mechanism. An attacker can determine valid usernames by observing the different responses given for correct usernames with weak passwords versus incorrect usernames with wea...
