CVE-2024-7744 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Progress WS_FTP Server

In WSFTP Server versions before 8.8.8 2022.0.8, an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in the Web Transfer Module allows File Discovery, Probe System Files, User-Controlled Filename, Path Traversal. An authenticated file download flaw has...

PT-2024-38553 · Ipswitch · Ws Ftp Server

Name of the Vulnerable Software and Affected Versions: WS FTP Server versions prior to 8.8.8 Description: A missing critical step in the multi-factor authentication of the Web Transfer Module allows users to skip the second-factor verification and log in with username and password only...

Progress Software WS_FTP Server 安全漏洞

Progress Software WSFTP Server is an effective and highly manageable FTP server from Progress Software, Inc. A security vulnerability exists in Progress Software WSFTP Server versions prior to 8.8.8 that stems from an improper restriction of pathnames...

IBM Sterling Connect:Direct Web Services Encryption Issue Vulnerability

IBM Sterling Connect:Direct Web Services is a file-based, peer-to-peer file transfer solution from International Business Machines IBM. IBM Sterling Connect:Direct Web Services suffers from an encryption issue vulnerability that could be exploited by an attacker to decrypt highly sensitive...

PT-2024-38552 · Ipswitch · Ws Ftp Server

Name of the Vulnerable Software and Affected Versions: WS FTP Server versions prior to 8.8.8 2022.0.8 Description: A vulnerability in the Web Transfer Module of WS FTP Server allows for Path Traversal, enabling file discovery, probing of system files, and user-controlled filename manipulation. An...

FileCatalyst Workflow 信任管理问题漏洞

FileCatalyst Workflow is a browser-based large file transfer solution from FileCatalyst, Inc. A security vulnerability exists in FileCatalyst Workflow that stems from the use of default credentials has been posted in the Vendor Knowledge Base article...

Hitachi Energy MicroSCADA X SYS600 安全漏洞

Hitachi Energy MicroSCADA X SYS600 is a SCADA product from Hitachi, Japan. It ensures optimal control and reliable operation of your switching station through seamless integration and connectivity between different devices and systems. A security vulnerability exists in Hitachi Energy MicroSCADA ...

FileCatalyst Workflow 安全漏洞

FileCatalyst Workflow is a browser-based large file transfer solution from FileCatalyst, Inc. A security vulnerability exists in FileCatalyst Workflow that originates from an SQL injection attack that can be executed by a user with super administrator privileges...

The vulnerability of the aiohttp HTTP client, related to deficiencies in HTTP request processing, allows attackers to execute the “HTTP request hijacking” attack.

The vulnerability of the aiohttp HTTP client is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a remote attacker to execute an “HTTP request hijacking” attack...

Dutch Regulator Fines Uber €290 Million for GDPR Violations in Data Transfers to U.S.

The Dutch Data Protection Authority DPA has fined Uber a record €290 million $324 million for allegedly failing to comply with European Union E.U. data protection standards when sending sensitive driver data to the U.S. "The Dutch DPA found that Uber transferred personal data of European taxi...

netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length header

A flaw was found in Netty before version 4.1.44, where it accepted multiple Content-Length headers and also accepted both Transfer-Encoding, as well as Content-Length headers where it should reject the message under such circumstances. In circumstances where Netty is used in the context of a...

netty: HTTP request smuggling

A HTTP smuggling flaw was found in HttpObjectDecoder.java in Netty in versions prior to version 4.1.44. HTTP headers with an invalid fold, in this case CRLF carriage return, line feed without being followed by SP space or HTAB horizontal tab, result in situations where headers can be misread. Dat...

netty: HTTP request smuggling by mishandled whitespace before the colon in HTTP headers

A flaw was found in Netty, where whitespace before the colon in HTTP headers is mishandled. This flaw allows an attacker to cause HTTP request smuggling...

HTTP/2: flood using HEADERS frames results in unbounded memory growth

A flaw was found in HTTP/2. Using HEADER frames with invalid HTTP headers and queuing of response RSTSTREAM frames, an attacker could cause a flood resulting in unbounded memory growth. The highest threat from this vulnerability is to system availability...

HTTP/2: flood using PING frames results in unbounded memory growth

A flaw was found in HTTP/2. Using PING frames and queuing of response PING ACK frames, a flood attack could occur resulting in unbounded memory growth. The highest threat from this vulnerability is to system availability...

UBUNTU-CVE-2024-23185

Very large headers can cause resource exhaustion when parsing message. The message-parser normally reads reasonably sized chunks of the message. However, when it feeds them to message-header-parser, it starts building up "fullvalue" buffer out of the smaller chunks. The fullvalue buffer has no si...

OPENSUSE-SU-2024:0258-1 Security update for chromium

This update for chromium fixes the following issues: - Chromium 128.0.6613.84 boo1229591 CVE-2024-7964: Use after free in Passwords CVE-2024-7965: Inappropriate implementation in V8 CVE-2024-7966: Out of bounds memory access in Skia CVE-2024-7967: Heap buffer overflow in Fonts CVE-2024-7968: Use...

OPENSUSE-SU-2024:0258-2 Security update for chromium

This update for chromium fixes the following issues: - Chromium 128.0.6613.84 boo1229591 CVE-2024-7964: Use after free in Passwords CVE-2024-7965: Inappropriate implementation in V8 CVE-2024-7966: Out of bounds memory access in Skia CVE-2024-7967: Heap buffer overflow in Fonts CVE-2024-7968: Use...

K000140787: Gunicorn vulnerability CVE-2024-1135

Security Advisory Description Gunicorn fails to properly validate Transfer-Encoding headers, leading to HTTP Request Smuggling HRS vulnerabilities. By crafting requests with conflicting Transfer-Encoding headers, attackers can bypass security restrictions and access restricted endpoints. This iss...

The vulnerability of the Windows Robust Multi-Address Transfer Driver (RMCAST) on Windows operating systems allows a hacker to execute arbitrary code.

The vulnerability of the Windows Robust Multi-Address Transfer Driver RMCAST on Windows operating systems is related to the possibility of using memory after it is freed. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code...