Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2021-9534)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9534 advisory. - Bluetooth: hciuart: check for missing tty operations Vladis Dronov Orabug: 30244627 CVE-2019-10207 CVE-2019-10207 - Bluetooth: hciuart: Add basic...

The Pixel 6 Chip’s Best Upgrade Isn’t Speed. It’s Security

Google’s new flagship smartphone is its most secure yet, thanks to a little vertical integration...

CentOS 8 : redis:6 (CESA-2021:3945)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:3945 advisory. - redis: Lua scripts can overflow the heap-based Lua stack CVE-2021-32626 - redis: Integer overflow issue with Streams CVE-2021-32627 - redis: Integer...

SUSE: Security Advisory (SUSE-SU-2021:3473-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle Linux 8 : redis:6 (ELSA-2021-3945)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-3945 advisory. - fix denial of service via Redis Standard Protocol RESP request CVE-2021-32675 - fix lua scripts can overflow the heap-based Lua stack CVE-2021-32626 ...

SUSE: Security Advisory (SUSE-SU-2021:3469-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Sql injection

Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments. Prior to version 11.16.99.173 of Community Edition and versions 11.16-6 and 11.15-8 of Enterprise Edition, an attacker with the ability to add one the CI widget to its personal...

CVE-2019-17567 affecting package httpd 2.4.46-6

CVE-2019-17567 affecting package httpd 2.4.46-6. An upgraded version of the package is available that resolves this issue...

CVE-2021-39275 affecting package httpd 2.4.46-6

CVE-2021-39275 affecting package httpd 2.4.46-6. An upgraded version of the package is available that resolves this issue...

CVE-2021-36160 affecting package httpd 2.4.46-6

CVE-2021-36160 affecting package httpd 2.4.46-6. An upgraded version of the package is available that resolves this issue...

Enalean Tuleap Open Alm SQL注入漏洞

Enalean Tuleap Open Alm is a free and open source tool from Enalean France. End-to-end traceability for application and system development. A SQL injection vulnerability exists in Community Edition version 11.16.99.173 and Enterprise Edition versions prior to 11.16-6 and 11.15-8 of Enalean Tuleap...

Aviatrix Controller 6.x Path Traversal / Code Execution Exploit

!/usr/bin/env python3 import requests from requests.structures import CaseInsensitiveDict from colorama import Fore, Style import argparse from requests.packages.urllib3.exceptions import InsecureRequestWarning requests.packages.urllib3.disablewarningsInsecureRequestWarning printf""" ░█▀▀█ ░█──░█...

aslcore.org Cross Site Scripting vulnerability OBB-2158385

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

aem.org Cross Site Scripting vulnerability OBB-2158287

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Facebook shoots own foot, hits Instagram and WhatsApp too

Mark Zuckerberg was left counting the personal cost of bad PR yesterday about $6 billion, according to Bloomberg on a day when his company couldnt get out of the news headlines, for all the wrong reasons. The billionaire Facebook CEOs bad day at the office started with whistleblower Frances Hauge...

Elastic: CVE-2021-40870 on [52.204.160.31]

An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal. The IP has a SSL certificate pointing to ElasticSearch. curl -kv...

How Google Geofence Warrants Helped Catch Capitol Rioters

A WIRED investigation has found 45 federal criminal cases that cite Google geolocation data to place suspects inside the US Capitol during the January 6 riot...

Design/Logic Flaw

The build of some language stacks of Eclipse Che version 6 includes pulling some binaries from an unsecured HTTP endpoint. As a consequence the builds of such stacks are vulnerable to MITM attacks that allow the replacement of the original binaries with arbitrary ones. The stacks involved are Jav...

CVE-2021-41034

The CVE concerns Eclipse Che v6: builds of language stacks (Java 8 on Alpine/CentOS, Android, and PHP) pull binaries from an unsecured HTTP endpoint, enabling MITM substitution during the build process. The vulnerability affects the build-time retrieval of binaries, not runtime execution. Root ca...

Network Time Protocol (NTP) Mode 6 Query Response Check (UDP)

Services which are supporting the Network Time Protocol NTP and respond to Mode 6 queries are prone to an information disclosure and might be misused for Distributed Denial of Service DDoS attacks. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenc...