Directory traversal

An arbitrary file upload and directory traversal vulnerability exist in the file upload functionality of the System Setup menu in AgeVolt Portal prior to version 0.1. A remote authenticated attacker could leverage this vulnerability to upload files to any location on the target operating system...

Design/Logic Flaw

Unauthenticated arbitrary file read in the IDAttend’s IDWeb application 3.1.013 allows the retrieval of any file present on the web server by unauthenticated attackers...

Moderate: Red Hat Security Advisory: nginx:1.22 security update

An update for the nginx:1.22 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

USN-6438-2 .Net regressions

USN-6438-1 fixed vulnerabilities in .Net. It was discovered that the fix for CVE-2023-36799 was incomplete. This update fixes the problem. Original advisory details: Kevin Jones discovered that .NET did not properly process certain X.509 certificates. An attacker could possibly use this issue to...

USN-6438-2: .Net regressions

USN-6438-1 fixed vulnerabilities in .Net. It was discovered that the fix for CVE-2023-36799 was incomplete. This update fixes the problem. Original advisory details: Kevin Jones discovered that .NET did not properly process certain X.509 certificates. An attacker could possibly use this issue to...

Moderate: nginx:1.22 security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fixes: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack Rapid Reset Attack CVE-2023-44487 For more details about the securi...

TEM Opera Plus FM Family Transmitter 35.45 Remote Code Execution

Summary This new line of Opera plus FM Transmitters combines very high efficiency, high reliability and low energy consumption in compact solutions. They have innovative functions and features that can eliminate the costs required by additional equipment: automatic exchange of audio sources,...

AgeVolt Portal Path Traversal Vulnerability

AgeVolt Portal is the web portal of AgeVolt, Inc. A security vulnerability exists in AgeVolt Portal versions prior to 0.1. An attacker could exploit this vulnerability to read files with web server privileges from anywhere on the target operating system...

AgeVolt Portal Path Traversal Vulnerability

AgeVolt Portal is the web portal of AgeVolt, Inc. A security vulnerability exists in AgeVolt Portal versions prior to 0.1. An attacker could exploit this vulnerability to upload files to any location on the target operating system with web server privileges...

ALSA-2023:6120 Moderate: nginx:1.22 security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fixes: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack Rapid Reset Attack CVE-2023-44487 For more details about the securi...

The vulnerability of the Web Server component of the Oracle BI Publisher software, which is used for creating reports, allows a malicious individual to gain access to read, modify, add, or delete data.

The vulnerability of the Web Server component of the Oracle BI Publisher software for creating reports is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain read, modify, add, or delete access to data...

RLSA-2023:5924 Important: varnish security update

Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up. Security Fixes: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack Rap...

[SECURITY] Fedora 38 Update: httpd-2.4.58-1.fc38

The Apache HTTP Server is a powerful, efficient, and extensible web server...

CVE-2022-38484

An arbitrary file upload and directory traversal vulnerability exist in the file upload functionality of the System Setup menu in AgeVolt Portal prior to version 0.1. A remote authenticated attacker could leverage this vulnerability to upload files to any location on the target operating system...

AZL-31611 CVE-2023-45802 affecting package httpd for versions less than 2.4.58-1

When a HTTP/2 stream was reset RST frame by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing...

Moodle < 3.9.24, 3.11.x < 3.11.17, 4.0.x < 4.0.11, 4.1.x < 4.1.6, 4.2.x < 4.2.3 Multiple Vulnerabilities

Moodle is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:moodle:moodle"; ifdescription...

PT-2023-13612 · Unknown · Agevolt Portal

Name of the Vulnerable Software and Affected Versions: AgeVolt Portal versions prior to 0.1 Description: A directory traversal issue exists that leads to Information Disclosure. A remote authenticated attacker could leverage this issue to read files from any location on the target operating syste...

Trane Tracer SC Sensitive Information Disclosure (CVE-2016-0870)

The web server in Trane Tracer SC 4.2.1134 and earlier allows remote attackers to read sensitive configuration files via a direct request. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc...

The vulnerability of the httpd component’s debug credentials in the microprogramming-based industrial Wi-Fi routers Yifan YF325, due to security flaws in the authentication process, allows attackers to bypass the authentication mechanism.

The vulnerability of the httpd component’s debug credentials in the microprogramming-based industrial Wi-Fi routers Yifan YF325 is related to security flaws in the system. Exploiting this vulnerability could allow a malicious actor to bypass the authentication process remotely...

The vulnerability of the web server of the microprogramming software for communication module control devices CP-8031 MASTER MODULE and CP-8050 MASTER MODULE allows attackers to upload arbitrary files and elevate their privileges to the level of administrators.

The vulnerability of the web server of the microprogramming software for communication module control devices CP-8031 MASTER MODULE and CP-8050 MASTER MODULE is related to an incorrect limitation on the path name to the restricted access catalog. Exploiting this vulnerability allows a malicious...