CVE-2024-7706

CVE-2024-7706 affects Fujian mwcms 1.0.0; the uploadimage function in /uploadfile.html is vulnerable due to unrestricted upload via the upfile parameter. This enables remote exploitation and has had the exploit publicly disclosed. Vendor response is not provided in the documents. A mitigations pa...

CVE-2024-7705

CVE-2024-7705 affects Fujian mwcms 1.0.0, specifically the Image Upload component’s function uploadeditor at /uploadeditor.html?action=uploadimage. The vulnerability arises from manipulating the upfile parameter, enabling unrestricted file upload and remote exploitation. Public exploitation infor...

CVE-2024-7704

Weaver e-cology 8 is affected in the Source Code Handler component, via an issue in the file /cloudstore/ecode/setup/ecology_dev.zip. The vulnerability enables information disclosure and can be exploited remotely; exploitation has been disclosed publicly. The available connected docs do not speci...

CVE-2024-7704 Weaver e-cology Source Code ecology_dev.zip information disclosure

A vulnerability was found in Weaver e-cology 8. It has been classified as problematic. Affected is an unknown function of the file /cloudstore/ecode/setup/ecologydev.zip of the component Source Code Handler. The manipulation leads to information disclosure. It is possible to launch the attack...

httpd: Security issues via backend applications whose response headers are malicious or exploitable

A flaw was found in httpd. Backend applications whose response headers are malicious or exploitable may allow information disclosure, server-side request forgery SSRF or local script execution...

Important: Red Hat Security Advisory: httpd:2.4 security update

An update for the httpd:2.4 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

aiohttp 安全漏洞

aiohttp is an open source asynchronous HTTP client/server framework for asyncio and Python from aio-libs. A security vulnerability exists in aiohttp versions prior to 3.10.2, which stems from the FileResponse class not performing path checking relative to the root directory when looking for...

Security company ADT announces security breach of customer data

Electronic surveillance equipment provider ADT filed a form 8-K with the Security and Exchange Commision SEC to report “a cybersecurity incident during which unauthorized actors illegally accessed certain databases containing ADT customer order information.” An 8-K is a report of unscheduled...

Key Takeaways From The Take Command Summit: Unlocking Security Success

As cybersecurity threats continue to evolve, so must our defenses. The recent Rapid7 Take Command Summit provided invaluable insights into preparing for, responding to, and recovering from ransomware attacks. Here are three essential takeaways from the session, "Before, During, & After Ransomware...

SUSE-SU-2024:2860-1 Security update for python3-Twisted

This update for python3-Twisted fixes the following issues: - CVE-2024-41671: Fixed HTTP pipelined requests processed out of order in twisted.web bsc1228549 - CVE-2024-41810: Fixed reflected XSS via HTML Injection in Redirect Response bsc1228552...

SUSE CVE-2024-42255

In the Linux kernel, the following vulnerability has been resolved: tpm: Use auth only after NULL check in tpmbufcheckhmacresponse Dereference auth after NULL check in tpmbufcheckhmacresponse. Otherwise, unless tpm2sessionsinit was called, a call can cause NULL dereference, when TCGTPM2HMAC is...

CVE-2024-7615

Tenda FH1206 firmware 1.2.0.8 contains a stack-based buffer overflow in the fromSafeClientFilter(), fromSafeMacFilter(), and fromSafeUrlFilter() functions. The issue can be triggered remotely (special crafted request) and may impact confidentiality, integrity, and availability. A workaround from ...

CVE-2024-7614 Tenda FH1206 qossetting fromqossetting stack-based overflow

A vulnerability was found in Tenda FH1206 1.2.0.88155. It has been classified as critical. Affected is the function fromqossetting of the file /goform/qossetting. The manipulation of the argument page leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit...

CVE-2024-7613

CVE-2024-7613 affects Tenda FH1206 (version 1.2.0.8(8155)). The vulnerability resides in the fromGstDhcpSetSer function in /goform/GstDhcpSetSer, where improper handling of the dips argument leads to a buffer overflow. Exploitation can be performed remotely, and public details of the exploit exis...

CVE-2024-42493

Dorsett Controls InfoScan is vulnerable due to a leak of possible sensitive information through the response headers and the rendered JavaScript prior to user login...

undertow: response write hangs in case of Java 17 TLSv1.3 NewSessionTicket

A vulnerability was found in Undertow, where the chunked response hangs after the body was flushed. The response headers and body were sent but the client would continue waiting as Undertow does not send the expected 0\r\n termination of the chunked response. This results in uncontrolled resource...

CVE-2024-42493

CVE-2024-42493 affects Dorsett Controls InfoScan. The vulnerability is an exposure/leak of sensitive information via response headers and pre-login JavaScript in InfoScan versions prior to 1.38 (notably v1.32/v1.33/v1.35). Red Hat and ICS advisories corroborate exploitation risk and classify the ...

undertow: response write hangs in case of Java 17 TLSv1.3 NewSessionTicket

A vulnerability was found in Undertow, where the chunked response hangs after the body was flushed. The response headers and body were sent but the client would continue waiting as Undertow does not send the expected 0\r\n termination of the chunked response. This results in uncontrolled resource...

Wordfence Intelligence Weekly WordPress Vulnerability Report (July 29, 2024 to August 4, 2024)

Did you know Wordfence runs a Bug Bounty Program for all WordPress plugin and themes at no cost to vendors? Researchers can earn up to $10,400, for all in-scope vulnerabilities submitted to our Bug Bounty Program! Find a vulnerability, submit the details directly to us, and we handle all the rest...

UBUNTU-CVE-2024-42255

In the Linux kernel, the following vulnerability has been resolved: tpm: Use auth only after NULL check in tpmbufcheckhmacresponse Dereference auth after NULL check in tpmbufcheckhmacresponse. Otherwise, unless tpm2sessionsinit was called, a call can cause NULL dereference, when TCGTPM2HMAC is...