SUSE SLED15: libopenssl-3-devel / libopenssl-3-devel-32bit / libopenssl3 / etc (SUSE-SU-2024:0815-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:0815-1 advisory. - CVE-2024-0727: Denial of service when processing a maliciously formatted PKCS12 file bsc1219243. Tenabl...

Ladder 0.0.21 Server-Side Request Forgery

Exploit Title: Ladder v0.0.21 Server-side request forgery SSRF Date: 2024-01-20 Exploit Author: @chebuya Software Link: https://github.com/everywall/ladder Version: v0.0.1 - v0.0.21 Tested on: Ubuntu 20.04.6 LTS on AWS EC2 ami-0fd63e471b04e22d0 CVE: CVE-2024-27620 Description: Ladder fails to app...

Fedora: Security Advisory for jakarta-json (FEDORA-2024-129d8ca6fc)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for slf4j (FEDORA-2024-129d8ca6fc)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for xml-commons-apis (FEDORA-2024-129d8ca6fc)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for google-guice (FEDORA-2024-129d8ca6fc)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 40 Update: xml-commons-apis-1.4.01-46.fc40

xml-commons-apis is designed to organize and have common packaging for the various externally-defined standard interfaces for XML. This includes the DOM, SAX, and JAXP...

[SECURITY] Fedora 40 Update: openjfx-17.0.11.0-2.fc40

JavaFX/OpenJFX is a set of graphics and media APIs that enables Java developers to design, create, test, debug, and deploy rich client applications that operate consistently across diverse platforms. The media module have been removed due to missing dependencies...

[SECURITY] Fedora 40 Update: openjfx8-8.0.202-40.b07.fc40

JavaFX/OpenJFX is a set of graphics and media APIs that enables Java developers to design, create, test, debug, and deploy rich client applications that operate consistently across diverse platforms. The media and web module have been removed due to missing dependencies. The swt module has been...

[SECURITY] Fedora 40 Update: jakarta-json-2.1.3-4.fc40

Jakarta JSON Processing provides portable APIs to parse, generate, transform, and query JSON documents...

[SECURITY] Fedora 40 Update: icu4j-74.2-4.fc40

The International Components for Unicode ICU library provides robust and full-featured Unicode services on a wide variety of platforms. ICU supports the most current version of the Unicode standard, and provides support for supplementary characters needed for GB 18030 repertoire support. Java...

[SECURITY] Fedora 40 Update: google-guice-5.1.0-11.fc40

Put simply, Guice alleviates the need for factories and the use of new in your Java code. Think of Guice's @Inject as the new new. You will still need to write factories in some cases, but your code will not depend directly on them. Your code will be easier to change, unit test and reuse in other...

BIT-NODE-2023-32004

A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of Buffers in file system APIs causing a traversal path to bypass when verifying file permissions. This vulnerability affects all users using th...

BIT-JUPYTER-NOTEBOOK-2021-32798 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in notebook

The Jupyter notebook is a web-based notebook environment for interactive computing. In affected versions untrusted notebook can execute code on load. Jupyter Notebook uses a deprecated version of Google Caja to sanitize user inputs. A public Caja bypass can be used to trigger an XSS when a victim...

BIT-ELASTICSEARCH-2023-31417 Elasticsearch Insertion of sensitive information in audit logs

Elasticsearch generally filters out sensitive information and credentials before logging to the audit log. It was found that this filtering was not applied when requests to Elasticsearch use certain deprecated URIs for APIs. The impact of this flaw is that sensitive information such as passwords...

CVE-2024-27931

CVE-2024-27931 concerns Deno, a JavaScript/TypeScript runtime. The issue is insufficient validation of parameters in the Deno.makeTemp* APIs, which can allow a user to create files outside of the intended directories via path traversal in the provided prefix/suffix. The documented impact is poten...

CVE-2024-27931 Insufficient permission checking in `Deno.makeTemp*` APIs

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. Insufficient validation of parameters in Deno.makeTemp APIs would allow for creation of files outside of the allowed directories. This may allow the user to overwrite important files on the system that may affect othe...

Amazon Linux 2 : openssl11 (ALAS-2024-2478)

The version of openssl11 installed on the remote host is prior to 1.1.1g-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2478 advisory. Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack The...

Exploit for Authentication Bypass Using an Alternate Path or Channel in Jetbrains Teamcity

TeamCity Exploit Script 🛠️ This script is designed to demonst...

Medium: libuv

Issue Overview: libuv is a multi-platform support library with a focus on asynchronous I/O. The uvgetaddrinfo function in src/unix/getaddrinfo.c and its windows counterpart src/win/getaddrinfo.c, truncates hostnames to 256 characters before calling getaddrinfo. This behavior can be exploited to...