Slackware Linux 14.0 / 14.1 / 14.2 / 15.0 / current libX11 Vulnerability (SSA:2023-166-01)

The version of libX11 installed on the remote host is prior to 1.8.6. It is, therefore, affected by a vulnerability as referenced in the SSA:2023-166-01 advisory. - A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in libX11 do not check that the...

Ubuntu 20.04 LTS / 22.04 LTS / 23.04 : libx11 vulnerability (USN-6168-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by a vulnerability as referenced in the USN-6168-1 advisory. Gregory James Duck discovered that libx11 incorrectly handled certain Request, Event, or Error IDs. If a user were tricked into connecting to ...

RHEL 8 : firefox (RHSA-2023:3138)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3138 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...

CVE-2022-3138

creationtimestamp| type| source ---|---|--- 2022-09-08 14:15:04+00:00| seen| https://t.me/cibsecurity/49450...

CVE-2022-3138

Cross-site Scripting XSS - Generic in GitHub repository jgraph/drawio prior to 20.3.0...

CVE-2022-3138 Cross-site Scripting (XSS) - Generic in jgraph/drawio

Cross-site Scripting XSS - Generic in GitHub repository jgraph/drawio prior to 20.3.0...

CVE-2022-3138

CVE-2022-3138 is a Cross-site Scripting (XSS) vulnerability in the GitHub repository for jgraph/drawio, affecting versions prior to 20.3.0. The issue stems from how the application handles a URL parameter used for refresh/back actions, leading to potential script injection via location.href witho...

CVE-2022-3138 Cross-site Scripting (XSS) - Generic in jgraph/drawio

Cross-site Scripting XSS - Generic in GitHub repository jgraph/drawio prior to 20.3.0...

Security Bulletin: Vulnerabilities in BIND affect Power Hardware Management Console

Summary BIND is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2017-3136 DESCRIPTION: ISC BIND is vulnerable to a denial of service, caused by the improper handling of query requests when using DNS64 with "break-dnssec yes"...

SUSE: Security Advisory (SUSE-SU-2016:2074-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2017:1000-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Discourse 2.7.0 2FA Bypass

Exploit Title: Discourse 2.7.0 - Rate Limit Bypass leads to 2FA Bypass Date: 14/01/2021 Exploit Author: Mesh3l911 Vendor Homepage: https://www.discourse.org/ Software Link:https://github.com/discourse/discourse Version: Discourse 2.7.0 CVE: CVE-2021-3138 import requests username = input"\n input ...

Discourse 2.7.0 - Rate Limit Bypass leads to 2FA Bypass Exploit

Exploit Title: Discourse 2.7.0 - Rate Limit Bypass leads to 2FA Bypass Exploit Author: Mesh3l911 Vendor Homepage: https://www.discourse.org/ Software Link:https://github.com/discourse/discourse Version: Discourse 2.7.0 CVE: CVE-2021-3138 import requests username = input"\n input ur username : "...

Discourse 2.7.0 - Rate Limit Bypass leads to 2FA Bypass

Exploit Title: Discourse 2.7.0 - Rate Limit Bypass leads to 2FA Bypass Date: 14/01/2021 Exploit Author: Mesh3l911 Vendor Homepage: https://www.discourse.org/ Software Link:https://github.com/discourse/discourse Version: Discourse 2.7.0 CVE: CVE-2021-3138 import requests username = input"\n input ...

SUSE: Security Advisory (SUSE-SU-2017:0998-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2017:0999-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Discourse < 2.7.0.beta4 Multiple Vulnerabilities

Discourse is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:discourse:discourse"; ifdescripti...

CVE-2021-3138

creationtimestamp| type| source ---|---|--- 2021-01-14 07:49:03+00:00| seen| https://t.me/cibsecurity/22146 2021-04-21 12:07:07+00:00| published-proof-of-concept| https://t.me/pwnwikizhchannel/226...

CVE-2021-3138

CVE-2021-3138 affects Discourse 2.7.0 through beta1, where a rate-limit bypass enables bypassing the 2FA requirement for certain forms. The vulnerability stems from how 2FA relies on rate-limiting, enabling bypasses under certain conditions. Documented impact is the 2FA bypass; exploitation detai...

CVE-2020-3138

CVE-2020-3138 affects Cisco Enterprise NFV Infrastructure Software (NFV NFVIS) upgrade component. The issue is due to insufficient signature verification in the upgrade process, allowing an authenticated, local attacker who can supply a crafted upgrade file to upload malicious code to an affected...