SUSE: Security Advisory (SUSE-SU-2018:2358-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-29267

Sherlock SherlockIM through 2021-03-29 allows Cross Site Scripting XSS by leveraging the api/Files/Attachment URI to attack help-desk staff via the chatbot feature...

CVE-2021-3409

creationtimestamp| type| source ---|---|--- 2021-03-23 23:38:32+00:00| seen| https://t.me/cibsecurity/25344 2022-07-04 20:59:21+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/2976 2023-11-29 05:12:44+00:00| seen| https://t.me/arpsyndicate/669...

Threat Roundup for January 29 to February 5

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Jan. 29 and Feb. 5. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threatsx we've observed by highlighting key behavioral characteristics...

CVE-2021-25124

creationtimestamp| type| source ---|---|--- 2021-01-29 23:25:20+00:00| seen| https://t.me/cibsecurity/22863...

CVE-2021-25129

creationtimestamp| type| source ---|---|--- 2021-01-29 23:25:11+00:00| seen| https://t.me/cibsecurity/22856...

CVE-2021-3347

creationtimestamp| type| source ---|---|--- 2021-01-29 21:25:07+00:00| seen| https://t.me/cibsecurity/22848...

CVE-2021-3345

creationtimestamp| type| source ---|---|--- 2021-01-29 19:25:18+00:00| seen| https://t.me/cibsecurity/22844...

CVE-2021-25123

creationtimestamp| type| source ---|---|--- 2021-01-29 17:25:13+00:00| seen| https://t.me/cibsecurity/22834...

CVE-2021-25909

creationtimestamp| type| source ---|---|--- 2021-01-29 17:25:10+00:00| seen| https://t.me/cibsecurity/22832...

Threat Roundup for January 22 to January 29

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Jan. 22 and Jan. 29. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics...

CVE-2021-26305

creationtimestamp| type| source ---|---|--- 2021-01-29 08:25:19+00:00| seen| https://t.me/cibsecurity/22825...

CVE-2021-26303

creationtimestamp| type| source ---|---|--- 2021-01-29 08:25:18+00:00| seen| https://t.me/cibsecurity/22824...

CVE-2021-26306

creationtimestamp| type| source ---|---|--- 2021-01-29 08:25:12+00:00| seen| https://t.me/cibsecurity/22821...

CVE-2021-26307

creationtimestamp| type| source ---|---|--- 2021-01-29 08:25:11+00:00| seen| https://t.me/cibsecurity/22820...

CVE-2021-21270

creationtimestamp| type| source ---|---|--- 2021-01-22 20:29:23+00:00| seen| https://t.me/cibsecurity/22527...

CVE-2021-21603

creationtimestamp| type| source ---|---|--- 2021-01-13 19:25:29+00:00| seen| https://t.me/cibsecurity/22093...

CVE-2020-5802

creationtimestamp| type| source ---|---|--- 2020-12-29 18:29:36+00:00| seen| https://t.me/cibsecurity/21385...

CVE-2020-35245

CVE-2020-35245 affects Flamingo (FlamingoIM) up to 2020-09-29 with a SQL injection vulnerability in UserManager::addUser. Documented risk scores: CVSS2 base 7.5 (HIGH) and CVSS3.1 base 9.8 (CRITICAL). Exploit details are not provided in the connected documents; no remediation or patch version is ...

Directory traversal

Flamingo aka FlamingoIM through 2020-09-29 allows ../ directory traversal because the only ostensibly unpredictable part of a file-transfer request is an MD5 computation; however, this computation occurs on the client side, and the computation details can be easily determined because the product'...