Monthly
Server-side script source disclosure in Algernon web server on Windows allows unauthenticated remote attackers to retrieve verbatim script source by appending NTFS filename-equivalent suffixes (::$DATA, trailing dot, trailing space) to any public-path script URL. Algernon versions 1.17.8 and earlier are affected when deployed on Windows/NTFS; Linux and macOS are entirely unaffected. A detailed proof-of-concept is included in the GitHub Security Advisory GHSA-mm6c-5j6x-hq8m, and successful exploitation leaks embedded database credentials and SetCookieSecret values - enabling secondary authentication bypass through session cookie forgery.
Improper Handling of Windows ::DATA Alternate Data Stream vulnerability in Tridium Niagara Framework on Windows, Tridium Niagara Enterprise Security on Windows allows Input Data Manipulation.14.2,. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
JPress through 5.1.1 on Windows has an arbitrary file upload vulnerability that could cause arbitrary code execution via ::$DATA to AttachmentController, such as a .jsp::$DATA file to. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Server-side script source disclosure in Algernon web server on Windows allows unauthenticated remote attackers to retrieve verbatim script source by appending NTFS filename-equivalent suffixes (::$DATA, trailing dot, trailing space) to any public-path script URL. Algernon versions 1.17.8 and earlier are affected when deployed on Windows/NTFS; Linux and macOS are entirely unaffected. A detailed proof-of-concept is included in the GitHub Security Advisory GHSA-mm6c-5j6x-hq8m, and successful exploitation leaks embedded database credentials and SetCookieSecret values - enabling secondary authentication bypass through session cookie forgery.
Improper Handling of Windows ::DATA Alternate Data Stream vulnerability in Tridium Niagara Framework on Windows, Tridium Niagara Enterprise Security on Windows allows Input Data Manipulation.14.2,. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
JPress through 5.1.1 on Windows has an arbitrary file upload vulnerability that could cause arbitrary code execution via ::$DATA to AttachmentController, such as a .jsp::$DATA file to. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.