40 matches found
CVE-2024-12087
A path traversal vulnerability exists in rsync. It stems from behavior enabled by the --inc-recursive option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the --inc-recursive option, a lack of proper...
curl Incorrect Certificate Verification
The vulnerability of the software for interacting with servers using curl is related to improper verification of the certificate. Exploiting this vulnerability allows a remote attacker to influence the integrity of the system...
UEM SafeMobile Information Disclosure
The vulnerability of the UEM SafeMobile platform, a centralized management platform for mobile devices, is related to insufficient protection of operational data. Exploiting this vulnerability could allow an attacker, operating remotely, to obtain information about application users by sending...
CURL Permission Error Information Disclosure
The vulnerability of the software for interacting with servers via CURL is related to errors during permission storage. This vulnerability allows a malicious actor to disclose sensitive information or cause service failures...
CURL Unbounded Memory DoS
The vulnerability of the software for interacting with servers via CURL is related to the allocation of unlimited memory. Exploiting this vulnerability allows a remote attacker to cause service interruptions...
CVE-2022-40296
The application was vulnerable to a Server-Side Request Forgery attacks, allowing the backend server to interact with unexpected endpoints, potentially including internal and local services, leading to attacks in other downstream systems...
curl: CVE-2022-35252: control code in cookie denial of service
Summary: I took a look at https://github.com/curl/curl/pull/9048/commits/d7bcbc7d8d4b6d972d3da12d54819169a19c287b a sneak peek on a vulnerability to be announced tomorrow. My guess for that vulnerability is that since cookies are persistent, someone who can trick curl into storing cookies can sto...
CURL Registration Data Access
The vulnerability of the software for interacting with servers via CURL is related to insufficient protection of registration data. Exploiting this vulnerability allows a malicious actor to gain access to confidential information...
CURL Buffer Overflow DoS
The vulnerability of the software for interacting with servers via CURL is related to the execution of operations within the acceptable data buffer limits. Exploiting this vulnerability allows a malicious actor to cause service failures...
curl Credential Error Unauthorized Access
The vulnerability of the software for interacting with servers using curl is related to errors in handling user credentials. Exploiting this vulnerability can allow a perpetrator to gain unauthorized access to protected information...
Information disclosure
An issue was discovered in core/assets/form/formquestiontypes/formquestiontypefileupload/formquestiontypefileupload.inc in Squiz Matrix CMS 5.5.0 prior to 5.5.0.3, 5.5.1 prior to 5.5.1.8, 5.5.2 prior to 5.5.2.4, and 5.5.3 prior to 5.5.3.3 where a user can delete arbitrary files from the server...
libssh2: Integer overflow in user authenticate keyboard interactive allows out-of-bounds writes
A flaw was found in libssh2. A server could send a multiple keyboard interactive response messages, whose total length are greater than the unsigned char max characters. This value is used as an index to copy memory causing in an out of bounds memory write error. The highest threat from this...
Threat Roundup for August 24-31
Today, as we do every week, Talos is giving you a glimpse into the most prevalent threats we’ve observed this week — covering the dates between Aug. 24 and 31. As with previous roundups, this post isn’t meant to be an in-depth analysis. Instead, we will summarize the threats we’ve observed by...
syntax analyzer Heap Buffer Overflow Read Beyond Buffer
The vulnerability of the software tool’s syntax analyzer for interacting with servers using curl is related to an error during registration on the server using the FTP protocol. Exploiting this vulnerability allows a malicious actor to gain access to data beyond the boundaries of the allocated...
CVE-2017-1340
IBM Jazz Reporting Service JRS 6.0.4 could allow an authenticated user to obtain information on another server that the current report builder interacts with. IBM X-Force ID: 126455...
CVE-2017-1340
IBM Jazz Reporting Service JRS 6.0.4 could allow an authenticated user to obtain information on another server that the current report builder interacts with. IBM X-Force ID: 126455...
FTP PWD response parser out of bounds read
libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in anonymous or not, it asks the server for the current directory with the PWD command. The server then responds with a 257 response containing the path, inside double...
Design/Logic Flaw
The handleheaders function in modproxyfcgi.c in the modproxyfcgi module in the Apache HTTP Server 2.4.10 allows remote FastCGI servers to cause a denial of service buffer over-read and daemon crash via long response headers...
CVE-2013-0887
The developer-tools process in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, does not properly restrict privileges during interaction with a connected server, which has unspecified impact and attack vectors...
Page attack the theory and implementation-vulnerability warning-the black bar safety net
Page attack can be divided into two categories One is the use of a browser vulnerability in the access page to write malicious code for visitors of the attack. Here we can be understood as the service end-to-client attacks. Another just opposite, is the visitors use the page of the vulnerability ...