NewsSANS ISC Diary
CVE-2024-40766: The Patch Fixed the Bug. Nobody Fixed the Configuration., (Tue, Jun 23rd)
Teaser from the source
The vulnerability
This is the RSS-feed teaser. Read the full article at the original source.
Read at SANS ISC DiaryAffected vendors and products
More on Configuration
Other advisories
- LowCVE-2026-113715virtualenv: Venv configuration readback can reinterpret path boundaries
- LowCVE-2026-113715virtualenv: Venv configuration readback can reinterpret path boundaries
- Not ratedosv:CLEANSTART-2026-FA41726Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation wou...
- Not ratedosv:CVE-2026-115363OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 ACME EAB MAC Key Disclosure via Sanitized Configuration
- CriticalCVE-2026-83938Azure Kubernetes Configuration Service Elevation of Privilege Vulnerability
- Not ratedosv:CLEANSTART-2026-VP80967Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, and only the private key (with no associated certificate) configured locally, a NULL pointer derefere...
- Not ratedosv:CLEANSTART-2026-VX19313Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation wou...
- MediumCVE-2026-111450Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application. If no explicit error-email recipient is configured, a mail server is configured, and the server accepts an attacker-chosen Host, an attacker whose request triggers a cold start can direct later error emails to an address under their control for that application's lifetime. Emails disclose error and request metadata; on engines/versions where scope dumps render, they may also disclose configuration secrets and other users' session/cookie data. On the Lucee 7 engine, scope dumps fail to render, limiting disclosure to header fields. This is fixed in 4.1.2.
Other news entries
- Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release PipelineNewsThe Hacker News
- PHP shares mitigation for new RCE vulnerability with no patchNewsBleepingComputer
- Hackers hijack AOMEI update servers to secretly spread malwareNewsBleepingComputer
- Microsoft, Nvidia push provenance checks as open-weight AI adoption acceleratesNewsCSO Online
- Microsoft SystemCenter (Defender und Configuration Manager): Mehrere SchwachstellenVulnerabilityBSI CERT-Bund
- NCSC-2026-0425 [1.00] [M/H] Kwetsbaarheden verholpen in Microsoft System CenterNewsNCSC-NL
- GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to HijackingNewsThe Hacker News
- Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLsNewsThe Hacker News
Source: https://isc.sans.edu/diary/rss/33094
ID