CVE-2024-23838

TrueLayer.NET is the .Net client for TrueLayer. The vulnerability could potentially allow a malicious actor to gain control over the destination URL of the HttpClient used in the API classes. For applications using the SDK, requests to unexpected resources on local networks or to the internet cou...

Information disclosure

TrueLayer.NET is the .Net client for TrueLayer. The vulnerability could potentially allow a malicious actor to gain control over the destination URL of the HttpClient used in the API classes. For applications using the SDK, requests to unexpected resources on local networks or to the internet cou...

CVE-2024-23838 TrueLayer.Client SSRF when fetching payment or payment provider

TrueLayer.NET is the .Net client for TrueLayer. The vulnerability could potentially allow a malicious actor to gain control over the destination URL of the HttpClient used in the API classes. For applications using the SDK, requests to unexpected resources on local networks or to the internet cou...

CVE-2024-23838 TrueLayer.Client SSRF when fetching payment or payment provider

TrueLayer.NET is the .Net client for TrueLayer. The vulnerability could potentially allow a malicious actor to gain control over the destination URL of the HttpClient used in the API classes. For applications using the SDK, requests to unexpected resources on local networks or to the internet cou...

CVE-2024-23838 TrueLayer.Client SSRF when fetching payment or payment provider

TrueLayer.NET is the .Net client for TrueLayer. The vulnerability could potentially allow a malicious actor to gain control over the destination URL of the HttpClient used in the API classes. For applications using the SDK, requests to unexpected resources on local networks or to the internet cou...

CVE-2024-23838

TrueLayer.NET (the .NET client for TrueLayer) has a SSRF-type issue where an attacker could manipulate the destination URL used by HttpClient in the API classes, potentially causing requests to local network resources or external destinations and leading to information disclosure. Affected: TrueL...

CVE-2024-24329

TOTOLINK A3300R V17.0.0cu.557B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setPortForwardRules function...

CVE-2024-0564

A flaw was found in the Linux kernel's memory deduplication mechanism. The max page sharing of Kernel Samepage Merging KSM, added in Linux kernel version 4.4.0-96.119, can create a side channel. When the attacker and the victim share the same host and the default setting of KSM is "max page...

PT-2024-20114 · Truelayer · Truelayer.Client +1

Name of the Vulnerable Software and Affected Versions: TrueLayer.Client versions prior to v1.6.0 Description: The issue could potentially allow a malicious actor to gain control over the destination URL of the HttpClient used in the API classes. For applications using the SDK, requests to...

PT-2024-1545 · Totolink · Totolink A3300R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3300R version V17.0.0cu.557 B20221024 Description: The issue exists due to the lack of measures to neutralize special elements in the setStaticDhcpRules function of the TOTOLINK A3300R router's firmware. This allows a remote attacke...

TOTOLINK A3300R security vulnerabilities

TOTOLINK A3300R is a wireless router from China's Gion Electronics TOTOLINK. A command injection vulnerability exists in the TOTOLINK A3300R version V17.0.0cu.557B20221024, which stems from the enable parameter of the setPortForwardRules method failing to correctly filter construct command specia...

TOTOLINK N200RE setParentalRules function buffer overflow vulnerability

The TOTOLINK N200RE is a wireless router for the SOHO market. The TOTOLINK N200RE suffers from a buffer overflow vulnerability that originates from a stack-based buffer overflow in the eTime parameter of the setParentalRules function of /cgi-bin/cstecgi.cgi. No detailed vulnerability details are...

cstecgi.cgi Parental Rules Compromise

The vulnerability of the setParentalRules function in the cstecgi.cgi script of the Totolink N200RE router’s microprogramming system is related to the issue of the operation exceeding the buffer in memory when processing the parameters eTime, week, and sTime. Exploiting this vulnerability could...

PT-2024-1316 · Totolink · Totolink N200Re

Name of the Vulnerable Software and Affected Versions: Totolink N200RE version 9.3.5u.6139 B20201216 Description: A critical issue affects the setParentalRules function of the /cgi-bin/cstecgi.cgi file, where manipulation of the eTime argument leads to a stack-based buffer overflow. This can be...

OpenStack Security Vulnerabilities

OpenStack is a cloud platform management program of the National Aeronautics and Space Administration NASA. OpenStack has a security vulnerability that stems from the fact that when a user tries to remove an access rule that does not exist in its scope, it removes other existing access rules that...

PT-2024-8621

Name of the Vulnerable Software and Affected Versions OpenStack affected versions not specified Description A flaw was found in OpenStack. When a user tries to delete a non-existing access rule in its scope, it deletes other existing access rules which are not associated with any application...

Totolink LR1200GB setParentalRules Code Execution

The vulnerability of the setParentalRules function in the /cgi-bin/cstecgi.cgi file of the Totolink LR1200GB router’s microprogramming system is related to the occurrence of operations outside the buffer in memory when processing the sTime parameter. Exploiting this vulnerability could allow an...

CVE-2024-22662

TOTOLINK A3700RV9.1.2u.616520211012 has a stack overflow vulnerability via setParentalRules...

PT-2024-19525 · Totolink · Totolink A3700R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3700R version V9.1.2u.6165 20211012 Description: The issue is a stack overflow vulnerability. It can be exploited via the setParentalRules function. Recommendations: For TOTOLINK A3700R version V9.1.2u.6165 20211012, as a temporary...

Free access to ThreatDown Application Block: Elevate your Windows security at no cost

Malwarebytes continues to add value to its ThreatDown Bundles with the inclusion of Application Block as free for all ThreatDown Nebula accounts excluding Mobile only accounts. Users dont need to activate this new feature: the policy has been enabled in their account by default. For as many...