21926 matches found
Fedora 40 : httpd (2024-937be154d8)
The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-937be154d8 advisory. This update includes httpd version 2.4.59, fixing various security issues and bugs. See https://downloads.apache.org/httpd/CHANGES2.4.59 for complet...
Fedora 37 : pypy3.9 (2023-af5206f71d)
The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-af5206f71d advisory. Update to 7.3.11. See https://doc.pypy.org/en/latest/release-v7.3.11.html Security fix for CVE-2022-37454, CVE-2022-45061, CVE-2022-42919. Tenable h...
Fedora 40 : kernel (2024-6d35739db7)
The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-6d35739db7 advisory. The 6.8.5 stable kernel update contains a number of important fixes across the tree. Tenable has extracted the preceding description block directly from the...
Amazon Linux 2023 : httpd, httpd-core, httpd-devel (ALAS2023-2024-607)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-607 advisory. Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HTTP Server: through 2.4.58...
Ubuntu 24.04 LTS. : Apache HTTP Server vulnerabilities (USN-6729-3)
The remote Ubuntu 24.04 LTS. host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6729-3 advisory. USN-6729-1 fixed vulnerabilities in Apache HTTP Server. This update provides the corresponding updates for Ubuntu 24.04 LTS. Tenable has extracted the...
CVE-2024-4250
CVE-2024-4250 affects Tenda i21 1.0.0.14(4656). The vulnerability is in the function formwrlSSIDset of the file /goform/wifiSSIDset, where manipulation of the ssidIndex argument leads to a stack-based buffer overflow. This is a network-exposed flaw with potential remote exploitation, and public w...
CVE-2024-4249
The CVE-2024-4249 entry affects Tenda i21 firmware 1.0.0.14(4656). The vulnerable component is the function formwrlSSIDget in the file /goform/wifiSSIDget, where manipulating the argument ssidIndex causes a stack-based buffer overflow. The vulnerability can be exploited remotely, and public explo...
CVE-2024-4248
CVE-2024-4248 affects Tenda i21, version 1.0.0.14(4656). The vulnerability stems from the parameter handling in the function formQosManage_user , where manipulating the argument ssidIndex triggers a stack-based buffer overflow. Reported as remotely exploitable with network access and high impact ...
Apache HTTP Server: HTTP Response Splitting in multiple modules
...
RHEL 7 : rh-ruby25-ruby (RHSA-2018:3731)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3731 advisory. - ruby: HTTP response splitting in WEBrick CVE-2017-17742 - ruby: Unintentional file and directory creation with directory traversal in...
RHEL 6 / 7 : rh-ruby23-ruby (RHSA-2018:3729)
The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3729 advisory. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system...
CVE-2024-4242
A vulnerability was found in Tenda W9 1.0.0.74456. It has been rated as critical. This issue affects the function formwrlSSIDget of the file /goform/wifiSSIDget. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has...
CVE-2024-4240
A vulnerability was found in Tenda W9 1.0.0.74456. It has been classified as critical. This affects the function formQosManageDoubleuser. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The associated identifier of...
CVE-2024-32887
Sidekiq is simple, efficient background processing for Ruby. Sidekiq is reflected XSS vulnerability. The value of substr parameter is reflected in the response without any encoding, allowing an attacker to inject Javascript code into the response of the application. An attacker could exploit it t...
CVE-2024-32887 Reflected XSS in sidekiq
Sidekiq is simple, efficient background processing for Ruby. Sidekiq is reflected XSS vulnerability. The value of substr parameter is reflected in the response without any encoding, allowing an attacker to inject Javascript code into the response of the application. An attacker could exploit it t...
CVE-2024-32887
CVE-2024-32887 is a reflected XSS in Sidekiq’s Web UI where the substr parameter is echoed without encoding, enabling injection of JavaScript into responses and potential targeting of users of Sidekiq Web UI and other applications on the same domain. Affected component: Sidekiq Web UI (Ruby). Roo...
CVE-2024-4240
CVE-2024-4240 affects Tenda W9 1.0.0.7(4456). The vulnerability is in the function formQosManageDouble_user where manipulating the argument ssidIndex causes a stack-based buffer overflow . This can be triggered remotely, per multiple sources, indicating a network-delivered risk with potential arb...
SUSE CVE-2024-25583
A crafted response from an upstream server the recursor has been configured to forward-recurse to can cause a Denial of Service in the Recursor. The default configuration of the Recursor does not use recursive forwarding and is not affected...
CVE-2024-33600
A flaw was found in the glibc netgroup cache. After a failed cache insertion, addgetnetgrentX tries to send the non-existing response after the not-found header. This can lead to a null pointer dereference that causes a crash or exit. Mitigation Mitigation for this issue is either not available o...
