Fedora: Security Advisory for rubygem-actionpack (FEDORA-2023-d6157bb1e2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 38 Update: rubygem-actionpack-7.0.4.3-1.fc38

Eases web-request routing, handling, and response as a half-way front, half-way page controller. Implemented with specific emphasis on enabling easy unit/integration testing that doesn't require a browser...

Debian dla-3373 : libjson-smart-java - security update

The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3373 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3373-1 [email protected]...

nodejs: HTTP Request Smuggling due to incorrect parsing of header fields

A vulnerability was found in NodeJS due to improper validation of HTTP requests. The llhttp parser in the HTTP module in Node.js does not correctly handle header fields that are not terminated with CLRF. This issue may result in HTTP Request Smuggling. This flaw allows a remote attacker to send a...

Xiongmai NVR devices 缓冲区错误漏洞

Xiongmai NVR devices are a series of network video recorders from China-based Xiongmai Technology Xiongmai. A security vulnerability exists in Xiongmai NVR devices that stems from the presence of a stack-based buffer overflow. An attacker can exploit this vulnerability by sending a specially...

CVE-2023-24366

An arbitrary file download vulnerability in rConfig v6.8.0 allows attackers to download sensitive files via a crafted HTTP request...

CLSA-2023-1679943745 Fix CVE(s): CVE-2023-25690

SECURITY UPDATE: proxy configuration may trigger HTTP request smuggling attack - debian/patches/CVE-2023-25690.patch: don't forward invalid query strings - CVE-2023-25690...

PT-2023-19530 · Rconfig · Rconfig

Name of the Vulnerable Software and Affected Versions: rConfig version 6.8.0 Description: The issue allows attackers to download sensitive files via a crafted HTTP request, potentially exposing sensitive information. Recommendations: For rConfig version 6.8.0, at the moment, there is no informati...

Osprey Pump Controller 安全漏洞

Osprey Pump Controller is a pump controller from Osprey. A security vulnerability exists in Osprey Pump Controller version 1.01. An attacker can exploit this vulnerability to obtain arbitrary files and sensitive system information from an affected device using GET parameters...

PT-2023-2244 · Adobe · Coldfusion

Name of the Vulnerable Software and Affected Versions: Adobe ColdFusion versions 2018 Update 15 and earlier Adobe ColdFusion versions 2021 Update 5 and earlier Description: The issue exists due to improper limitation of a pathname to a restricted directory, allowing an attacker to read arbitrary...

Mozilla Firefox 缓冲区错误漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox's handling of data, which can be exploited by a remote attacker to submit a specially crafted web request that the user can be tricked into parsing,...

The vulnerability of the TrueConf Server software, related to insufficient protection of operational data, allows a intruder to gain unauthorized access to protected information.

The vulnerability of the TrueConf Server software is related to insufficient protection of operational data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information through a specially crafted HTTPS request...

CVE-2022-45861

An access of uninitialized pointer vulnerability CWE-824 in the SSL VPN portal of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9 and before 6.4.11 and FortiProxy version 7.2.0 through 7.2.1, version 7.0.0 through 7.0.7 and before 2.0.11 allows a remote authenticated...

Fortinet FortiSOAR 安全漏洞

Fortinet FortiSOAR is a security orchestration, automation and response SOAR solution from Fortinet. Fortinet FortiSOAR suffers from an Access Control Error vulnerability that stems from improper access control in the program. An authenticated attacker could exploit this vulnerability to perform...

The vulnerability in the Nagios XI monitoring tool’s script located at `/usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php allows a attacker to execute arbitrary commands.

The vulnerability of the Nagios XI monitoring tool’s script /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php is related to the failure to take measures to neutralize special elements used in operating system commands. Exploiting this vulnerability allows a malicious...

The vulnerability in the Nagios XI monitoring tool’s script /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php allows a attacker to execute arbitrary commands.

The vulnerability of the Nagios XI monitoring tool’s script /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php is related to the failure to eliminate special elements used in operating system commands. Exploiting this vulnerability allows an attacker to execute arbitrar...

The vulnerability of Zyxel 5G NR/4G LTE CPE router’s micro-programming software arises from the lack of measures taken to neutralize special elements used in the operating system’s command set. This allows a hacker to execute arbitrary commands.

The vulnerability of Zyxel 5G NR/4G LTE CPE routers’ microprogramming software exists due to the lack of measures taken to neutralize the special elements used in the operating system’s commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands using a speciall...

Aremis 4 Nomad 授权问题漏洞

Aremis 4 Nomad A4N is an application from Aremis, Inc. A security vulnerability exists in Aremis 4 Nomad version 1.5.0. An attacker exploits the vulnerability to send a simple HTTP request to the correct endpoint and gain authorization to retrieve application data...

plugin: CSRF vulnerability in Script Security Plugin

A cross-site request forgery CSRF vulnerability in Jenkins Script Security Plugin 1158.v7c1b73a69a08 and earlier allows attackers to have Jenkins send an HTTP request to an attacker-specified webserver...

The vulnerability of the Nagios XI monitoring tool’s script /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php allows a attacker to execute arbitrary commands.

The vulnerability of the Nagios XI monitoring tool’s script located at /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php is related to the failure to take measures to neutralize special elements used in operating system commands. Exploiting this vulnerability allows a...