CVE-2024-45843

Mattermost Server 9.5.x

CVE-2024-45843 Weak SSRF Filtering

Mattermost versions 9.5.x = 9.5.8 fail to include the metadata endpoints of Oracle Cloud and Alibaba in the SSRF denylist, which allows an attacker to possibly cause an SSRF if Mattermost was deployed in Oracle Cloud or Alibaba...

CVE-2024-45843 Weak SSRF Filtering

Mattermost versions 9.5.x = 9.5.8 fail to include the metadata endpoints of Oracle Cloud and Alibaba in the SSRF denylist, which allows an attacker to possibly cause an SSRF if Mattermost was deployed in Oracle Cloud or Alibaba...

Mattermost 代码问题漏洞

Mattermost is an open source collaboration platform from US-based Mattermost. A code issue vulnerability exists in Mattermost version 9.5.8, which stems from a failure to add Oracle Cloud and Alibaba metadata endpoints to the server-side request forgery denial list, resulting in vulnerability to...

PT-2024-31806 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 9.5.x through 9.5.8 Description: The issue arises from Mattermost's failure to include the metadata endpoints of Oracle Cloud and Alibaba in the SSRF denylist, potentially allowing an attacker to cause a server-side reques...

New Cross-Platform Malware KTLVdoor Discovered in Attack on Chinese Trading Firm

The Chinese-speaking threat actor known as Earth Lusca has been observed using a new backdoor dubbed KTLVdoor as part of a cyber attack targeting an unnamed trading company based in China. The previously unreported malware is written in Golang, and thus is a cross-platform weapon capable of...

CloudBrute - Awesome Cloud Enumerator

A tool to find a company target infrastructure, files, and apps on the top cloud providers Amazon, Google, Microsoft, DigitalOcean, Alibaba, Vultr, Linode. The outcome is useful for bug bounty hunters, red teamers, and penetration testers alike. The complete writeup is available. here Motivation ...

CVE-2021-47536

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix wrong listdel in smclgrcleanupearly smclgrcleanupearly meant to delete the link group from the link group list, but it deleted the list head by mistake. This may cause memory corruption since we didn't remove the rea...

SQL Injection Vulnerability in SpringBlade of Shanghai Breadtech Co.

SpringBlade is a microservice architecture upgraded and optimized from a commercial-grade project, built with core technologies such as Spring Boot 2.5 and Spring Cloud 2020, and fully following Alibaba coding standards. Ltd. SpringBlade exists SQL injection vulnerability, attackers can use the...

The Not-so-True People-Search Network from China

Its not unusual for the data brokers behind people-search websites to use pseudonyms in their day-to-day lives you would, too. Some of these personal data purveyors even try to reinvent their online identities in a bid to hide their conflicts of interest. But its not every day you run across a...

CVE-2021-46925

A flaw was found in the Linux kernel affecting the net/smc Synchronous Message Channel subsystem. This vulnerability is caused by a race condition between the smccdctxhandler and smcrelease functions and can cause kernel panics. Mitigation There are no known mitigations to the problem and Red Hat...

CVE-2021-46925

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix kernel panic caused by race of smcsock A crash occurs when smccdctxhandler tries to access smcsock but smcrelease has already freed it. 4570.695099 BUG: unable to handle page fault for address: 000000002eae9e88...

Exploit for Deserialization of Untrusted Data in Alibaba Fastjson

json.org CVE-2022-45688 true & false positive WTF ?? The p...

WordPress Widgets for Alibaba Reviews Plugin <= 11.0.2 is vulnerable to Arbitrary File Upload

Software Widgets for Alibaba Reviews Type Plugin Vulnerable versions = 11.0.2 Fixed in 11.1 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2023-48275 Patch priority Medium CVSS severity Medium 8 Developer Claim ownership PSID f6196cc9a5d5 Credits Rafie Muhammad Patchstack...

Supply Chain Attack Targeting Telegram, AWS and Alibaba Cloud Users

By Deeba Ahmed KEY FINDINGS Cybersecurity firm Checkmarx has discovered a new wave of supply chain attacks exploiting bugs in popular… This is a post from HackRead.com Read the original post: Supply Chain Attack Targeting Telegram, AWS and Alibaba Cloud Users...

Malicious code in alibabacloud-oss2 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security d804868504b96ba968b7eae99df63e235a0eaa2eab4a7951ae02c98c614f1828 Attack targeted at users of Alibaba, AWS and Telegram via malicious packages published to PyPI. The malicious code was hidden in strategic...

Malicious code in aws-enumerate-iam (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 96d7eea455989a7a10bf2fafd9f9c4a2d5d9a4c2a3ec852e424885f3e51c5edb Attack targeted at users of Alibaba, AWS and Telegram via malicious packages published to PyPI. The malicious code was hidden in strategic...

MAL-2023-8361 Malicious code in enumerate-iam-aws (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 46f8fde812a7274ad1e270e0cc3a8698349365af5d85ee9b89248fa467e5bf2f Attack targeted at users of Alibaba, AWS and Telegram via malicious packages published to PyPI. The malicious code was hidden in strategic...

MAL-2023-8359 Malicious code in aws-enumerate-iam (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 96d7eea455989a7a10bf2fafd9f9c4a2d5d9a4c2a3ec852e424885f3e51c5edb Attack targeted at users of Alibaba, AWS and Telegram via malicious packages published to PyPI. The malicious code was hidden in strategic...

Malicious code in python-alibabacloud-sdk-core (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 1384f0a4ed6515eb7e720621346f74f53217b73863f4c5e3cda4fc90b52f49e3 Attack targeted at users of Alibaba, AWS and Telegram via malicious packages published to PyPI. The malicious code was hidden in strategic...