CVE-2024-30162

Invision Community through 4.7.16 allows remote code execution via the applications/core/modules/admin/editor/toolbar.php IPS\core\modules\admin\editor\toolbar::addPlugin method. This method handles uploaded ZIP files that are extracted into the...

CVE-2024-23793

The file upload feature in OTRS and OTRS Community Edition has a path traversal vulnerability. This issue permits authenticated agents or customer users to upload potentially harmful files to directories accessible by the web server, potentially leading to the execution of local code like Perl...

CVE-2024-23793

The file upload feature in OTRS and OTRS Community Edition has a path traversal vulnerability. This issue permits authenticated agents or customer users to upload potentially harmful files to directories accessible by the web server, potentially leading to the execution of local code like Perl...

CVE-2024-23793

The file upload feature in OTRS and OTRS Community Edition has a path traversal vulnerability. This issue permits authenticated agents or customer users to upload potentially harmful files to directories accessible by the web server, potentially leading to the execution of local code like Perl...

CVE-2024-23793

The CVE-2024-23793 issue is a path traversal vulnerability in the file upload feature of OTRS and ((OTRS)) Community Edition. An authenticated agent or customer user can upload files to directories accessible by the web server, which could enable local code execution (e.g., Perl scripts). Affecte...

CVE-2024-23793 Upload of files outside application directory

The file upload feature in OTRS and OTRS Community Edition has a path traversal vulnerability. This issue permits authenticated agents or customer users to upload potentially harmful files to directories accessible by the web server, potentially leading to the execution of local code like Perl...

CVE-2024-0912

Under certain circumstances the Microsoft® Internet Information Server IIS used to host the C•CURE 9000 Web Server will log Microsoft Windows credential details within logs. There is no impact to non-web service interfaces C•CURE 9000 or prior versions...

CVE-2024-0912: Insertion of Sensitive Information into Log File

Under certain circumstances the Microsoft® Internet Information Server IIS used to host the C•CURE 9000 Web Server will log Microsoft Windows credential details within logs. There is no impact to non-web service interfaces C•CURE 9000 or prior versions...

PHP CGI Argument Injection Remote Code Execution

This module exploits a PHP CGI argument injection vulnerability affecting PHP in certain configurations on a Windows target. A vulnerable configuration is locale dependant such as Chinese or Japanese, such that the Unicode best-fit conversion scheme will unexpectedly convert a soft hyphen 0xAD in...

CVE-2024-0912 CCURE passwords exposed to administrators

Under certain circumstances the Microsoft® Internet Information Server IIS used to host the C•CURE 9000 Web Server will log Microsoft Windows credential details within logs. There is no impact to non-web service interfaces C•CURE 9000 or prior versions...

CVE-2024-0912

CVE-2024-0912 affects Johnson Controls Software House C•CURE 9000 running on IIS. In certain conditions, the IIS web host can log Windows credentials within the application logs, exposing sensitive information. Affected product/version: Software House C•CURE 9000 v3.00.2 (hosted on IIS). Technica...

GHSA-67WG-6J7R-MQH8 Arbitrary Code Execution in TYPO3 CMS

Due to a missing file extension in the fileDenyPattern, backend user are allowed to upload .pht files which can be executed in certain web server setups. The new default fileDenyPattern is the following, which might have been overridden in the TYPO3 Install Tool...

jetty: stop accepting new connections from valid clients

A flaw was found in Jetty, a Java based web server and servlet engine. If an HTTP/2 connection gets TCP congested, it remains open and idle, and connections may be leaked when it times out. An attacker can cause many connections to end up in this state, and the server may run out of file...

Remote code execution in web server context

Impact User with administrative privileges and upload files that look like images but contain PHP code which can then be executed in the context of the web server...

GHSA-RHC2-23C2-WW7C Remote code execution in web server context

Impact User with administrative privileges and upload files that look like images but contain PHP code which can then be executed in the context of the web server...

NGINX HTTP/3 QUIC Module Unauthorized Access

The vulnerability of the HTTP/3 QUIC module ngxhttpv3module in NGINX Plus and NGINX OSS servers is related to the use of memory after it is freed. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to protected information through specially crafted HTTP/3 reques...

PT-2024-15915 · Microsoft · Windows +1

Name of the Vulnerable Software and Affected Versions: C•CURE 9000 Web Server affected versions not specified Microsoft Internet Information Server IIS affected versions not specified Description: Under certain circumstances, the Microsoft Internet Information Server IIS used to host the C•CURE...

Remote code execution in web server context

User with administrative privileges and upload files that look like images but contain PHP code which can then be executed in the context of the web server...

Duplicate

This advisory duplicates another...

PT-2024-9751

Name of the Vulnerable Software and Affected Versions Lexmark Embedded Web Server affected versions not specified Description The issue is related to insecure privilege management in the Lexmark Embedded Web Server software of Lexmark printers. An attacker, acting remotely, can exploit this issue...