Huawei EulerOS: Security Advisory for httpd (EulerOS-SA-2024-2168)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for httpd (EulerOS-SA-2024-2139)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2024:2970-1 Security update for python-WebOb

This update for python-WebOb fixes the following issues: - CVE-2024-42353: Fixed open redirect via WebOb's Response object in Location header bsc1229221...

mozilla: Missing permission check when creating a StreamFilter

The Mozilla Foundation Security Advisory describes this flaw as: It was possible for a web extension with minimal permissions to create a StreamFilter which could be used to read and modify the response body of requests on any site...

The vulnerability of the ProfileBasedRequestOptionsBuilder method in the web authentication library webauthn-lib allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the ProfileBasedRequestOptionsBuilder method in the web authentication library webauthn-lib is related to inconsistencies in the responses to incoming requests. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected...

EulerOS Virtualization 2.10.0 : httpd (EulerOS-SA-2024-2119)

According to the versions of the httpd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP...

EulerOS Virtualization 2.10.1 : httpd (EulerOS-SA-2024-2139)

According to the versions of the httpd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP...

CVE-2024-7908 TOTOLINK EX1200L cstecgi.cgi setDefResponse stack-based overflow

A vulnerability, which was classified as critical, was found in TOTOLINK EX1200L 9.3.5u.6146B20201023. Affected is the function setDefResponse of the file /www/cgi-bin/cstecgi.cgi. The manipulation of the argument IpAddress leads to stack-based buffer overflow. It is possible to launch the attack...

CVE-2024-7906

DedeBIZ 6.3.0 is affected, specifically the Attachment Settings component. The vulnerability lies in the get_mime_type function of /admin/dialog/select_images_post.php, where manipulating the upload parameter enables unrestricted file uploads. This can be exploited remotely, and the exploit has b...

CVE-2024-7906 DedeBIZ Attachment Settings select_images_post.php get_mime_type unrestricted upload

A vulnerability classified as critical was found in DedeBIZ 6.3.0. This vulnerability affects the function getmimetype of the file /admin/dialog/selectimagespost.php of the component Attachment Settings. The manipulation of the argument upload leads to unrestricted upload. The attack can be...

CVE-2024-7904

CVE-2024-7904 affects DedeBIZ 6.3.0. The vulnerability lies in the File Extension Handler’s admin/file_manage_control.php where the upfile1 parameter enables unrestricted file upload, enabling remote exploitation as disclosed. Evidence across multiple sources confirms the impact is unrestricted u...

twisted.web has disordered HTTP pipeline response

...

CVE-2024-7900

The CVE-2024-7900 entry describes a cross-site scripting (XSS) vulnerability in xiaohe4966 TpMeCMS 1.3.3.2, specifically in the Basic Configuration Handler’s file /h.php/general/config?ref=addtabs. The issue arises from lack of proper filtering/escaping of user-supplied data for the parameters Si...

CVE-2024-7899

A vulnerability, which was classified as critical, has been found in InnoCMS 0.3.1. This issue affects some unknown processing of the file /panel/pages/1/edit of the component Backend. The manipulation leads to code injection. The attack may be initiated remotely. The exploit has been disclosed t...

CVE-2024-7899

The CVE-2024-7899 entry concerns InnoCMS 0.3.1. A vulnerability exists in the Backend component, specifically some unknown processing of the file /panel/pages/1/edit, which can lead to code injection. The issue may be triggered remotely and the exploit has been disclosed publicly. Public details ...

CVE-2024-7898 Tosei Online Store Management System ネット店舗管理システム Backend default credentials

A vulnerability classified as critical was found in Tosei Online Store Management System ネット店舗管理システム 4.02/4.03/4.04. This vulnerability affects unknown code of the component Backend. The manipulation leads to use of default credentials. The attack can be initiated remotely. The exploit has been...

Amazon Linux 2 : freeradius (ALAS-2024-2611)

The version of freeradius installed on the remote host is prior to 3.0.27-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2611 advisory. RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response...

OESA-2024-1976 firefox security update

Mozilla Firefox is a standalone web browser, designed for standards compliance and performance. Its functionality can be enhanced via a plethora of extensions. Security Fixes: By monitoring the time certain operations take, an attacker could have guessed which external protocol handlers were...

OESA-2024-1979 golang security update

. Security Fixes: The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational 200 or higher status. This mishandling could leave a client connection in an invalid state, where the next request sent on the...

U.S. Dept Of Defense: Improper Authentication Allows Making Appeals as Other Users

The vulnerability allowed unauthenticated users to submit appeals by manipulating HTTP responses. This undermined the security and integrity of the application, as users could perform actions reserved for logged-in users...