undertow: response write hangs in case of Java 17 TLSv1.3 NewSessionTicket

A vulnerability was found in Undertow, where the chunked response hangs after the body was flushed. The response headers and body were sent but the client would continue waiting as Undertow does not send the expected 0\r\n termination of the chunked response. This results in uncontrolled resource...

Wordfence Intelligence Weekly WordPress Vulnerability Report (July 29, 2024 to August 4, 2024)

Did you know Wordfence runs a Bug Bounty Program for all WordPress plugin and themes at no cost to vendors? Researchers can earn up to $10,400, for all in-scope vulnerabilities submitted to our Bug Bounty Program! Find a vulnerability, submit the details directly to us, and we handle all the rest...

UBUNTU-CVE-2024-42255

In the Linux kernel, the following vulnerability has been resolved: tpm: Use auth only after NULL check in tpmbufcheckhmacresponse Dereference auth after NULL check in tpmbufcheckhmacresponse. Otherwise, unless tpm2sessionsinit was called, a call can cause NULL dereference, when TCGTPM2HMAC is...

kernel: wifi: iwlwifi: mvm: rfi: fix potential response leaks

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: rfi: fix potential response leaks The Linux kernel CVE team has assigned CVE-2024-35912 to this issue. Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051956-CVE-2024-35912-b093@gregkh/T...

PT-2024-29988 · Dorsett Controls · Dorsett Controls Infoscan

Name of the Vulnerable Software and Affected Versions: Dorsett Controls InfoScan affected versions not specified Description: The issue concerns a leak of possible sensitive information through the response headers and the rendered JavaScript prior to user login. Recommendations: At the moment,...

CVE-2024-7585 Tenda i22 apPortalAuth formApPortalWebAuth buffer overflow

A vulnerability has been found in Tenda i22 1.0.0.34687 and classified as critical. Affected by this vulnerability is the function formApPortalWebAuth of the file /goform/apPortalAuth. The manipulation of the argument webUserName/webUserPassword leads to buffer overflow. The attack can be launche...

CVE-2024-7584 Tenda i22 apPortalPhoneAuth formApPortalPhoneAuth buffer overflow

A vulnerability, which was classified as critical, was found in Tenda i22 1.0.0.34687. Affected is the function formApPortalPhoneAuth of the file /goform/apPortalPhoneAuth. The manipulation of the argument data leads to buffer overflow. It is possible to launch the attack remotely. The exploit ha...

CVE-2024-7583

A vulnerability, which was classified as critical, has been found in Tenda i22 1.0.0.34687. This issue affects the function formApPortalOneKeyAuth of the file /goform/apPortalOneKeyAuth. The manipulation of the argument data leads to buffer overflow. The attack may be initiated remotely. The...

CVE-2024-7525

The Mozilla Foundation Security Advisory describes this flaw as: It was possible for a web extension with minimal permissions to create a StreamFilter which could be used to read and modify the response body of requests on any site...

CVE-2024-7583 Tenda i22 apPortalOneKeyAuth formApPortalOneKeyAuth buffer overflow

A vulnerability, which was classified as critical, has been found in Tenda i22 1.0.0.34687. This issue affects the function formApPortalOneKeyAuth of the file /goform/apPortalOneKeyAuth. The manipulation of the argument data leads to buffer overflow. The attack may be initiated remotely. The...

CVE-2024-7583

CVE-2024-7583 affects Tenda i22 (firmware 1.0.0.3(4687)). The vulnerability is in the formApPortalOneKeyAuth function of the /goform/apPortalOneKeyAuth endpoint, caused by lack of input size validation which leads to a buffer overflow. The attack can be initiated remotely and the exploit has been...

CVE-2024-7580

A vulnerability was found in Alien Technology ALR-F800 up to 19.10.24.00. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/system.html. The manipulation of the argument uploadedFile with the input ;whoami leads to os command injection. The...

CVE-2024-7581 Tenda A301 WifiBasicSet formWifiBasicSet stack-based overflow

A vulnerability classified as critical has been found in Tenda A301 15.13.08.12. This affects the function formWifiBasicSet of the file /goform/WifiBasicSet. The manipulation of the argument security leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit...

CVE-2024-7581

CVE-2024-7581 – Tenda A301 is tied to a stack-based buffer overflow in the WiFiBasicSet handling of /goform/WifiBasicSet (function formWifiBasicSet) on Tenda A301 firmware 15.13.08.12. The vulnerability stems from improper handling of the security argument, enabling a remote attacker to exploit w...

CVE-2024-7579 Alien Technology ALR-F800 File Name upgrade.cgi popen os command injection

A vulnerability was found in Alien Technology ALR-F800 up to 19.10.24.00. It has been declared as critical. Affected by this vulnerability is the function popen of the file /var/www/cgi-bin/upgrade.cgi of the component File Name Handler. The manipulation of the argument uploadedFile leads to os...

CVE-2024-7579

An issue affects Alien Technology ALR-F800 up to version 19.10.24.00. The vulnerability resides in the popen call within the File Name Handler component, specifically the /var/www/cgi-bin/upgrade.cgi file, where manipulating the uploadedFile argument leads to an OS command injection. The attack c...

CVE-2024-7578

CVE-2024-7578 affects the Alien Technology ALR-F800 firmware up to 19.10.24.00. The vulnerability lies in an unknown function within the file /var/www/cmd.php where manipulating the cmd argument leads to improper authorization, enabling a remote attack. The exploit has been disclosed publicly. Se...

CrowdStrike Reveals Root Cause of Global System Outages

Cybersecurity company CrowdStrike has published its root cause analysis detailing the Falcon Sensor software update crash that crippled millions of Windows devices globally. The "Channel File 291" incident, as originally highlighted in its Preliminary Post Incident Review PIR, has been traced bac...

Huawei EulerOS: Security Advisory for shim (EulerOS-SA-2024-2076)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-41226

A CSV injection vulnerability in Automation Anywhere Automation 360 version 21094 allows attackers to execute arbitrary code via a crafted payload. NOTE: Automation Anywhere disputes this report, arguing the attacker executes everything from the client side and does not attack the Control Room. T...