AWS Connection Session Provisioner’s SHA256 hash is not fully verified by PCoIP Zero Clients

HP has provided updated versions of Tera2 Zero Client firmware that remediate vulnerabilities found in firmware version 22.04 and earlier. Products can be updated or replaced with the latest release by downloading from the Teradici website and following standard installation or update instruction...

CVE-2021-46825

Symantec Advanced Secure Gateway ASG and ProxySG are susceptible to an HTTP desync vulnerability. When a remote unauthenticated attacker and other web clients communicate through the proxy with the same web server, the attacker can send crafted HTTP requests and cause the proxy to forward web...

Design/Logic Flaw

Symantec Advanced Secure Gateway ASG and ProxySG are susceptible to an HTTP desync vulnerability. When a remote unauthenticated attacker and other web clients communicate through the proxy with the same web server, the attacker can send crafted HTTP requests and cause the proxy to forward web...

Kafka: Timing Attack Vulnerability for Apache Kafka Connect and Clients

Some components in Apache Kafka use Arrays.equals to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been...

RLSA-2022:5526 Important: squid:4 security update

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. Security Fixes: squid: DoS when processing gopher server responses CVE-2021-46784 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and...

ALSA-2022:5526 Important: squid:4 security update

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. Security Fixes: squid: DoS when processing gopher server responses CVE-2021-46784 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and...

rubygem-puma: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in puma

An HTTP Request Smuggling vulnerability was found in puma. When using puma with a proxy, which forwards LF characters as line endings, an attacker could use this flaw to smuggle a request through a proxy, causing the proxy to send a response back to another unknown client...

[SECURITY] Fedora 35 Update: python-twisted-22.4.0-1.fc35

Twisted is a networking engine written in Python, supporting numerous protoco ls. It contains a web server, numerous chat clients, chat servers, mail servers and more...

[SECURITY] Fedora 36 Update: python-twisted-22.4.0-1.fc36

Twisted is a networking engine written in Python, supporting numerous protoco ls. It contains a web server, numerous chat clients, chat servers, mail servers and more...

Nimc2 - A C2 Fully Written In Nim

nimc2 is a very lightweight C2 written fully in nim implant & server. If you want to give it a try check out the wiki to learn how to install and use nimc2. It's features include: Windows & Linux implant generation TCP socket communication with HTTP communication coming soon Ability to create as...

The vulnerability of the Linux operating system’s kernel, related to insufficient entropy, allows attackers to identify clients.

The vulnerability of the Linux operating system’s kernel is related to insufficient entropy. Exploiting this vulnerability allows a remote attacker to identify clients by determining the original TCP ports used by them...

xorg-x11-server and related packages bug fix and enhancement update

An update is available for xorg-x11-xtrans-devel, xorg-x11-server-Xwayland, xorg-x11-server. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Xorg is an open-sour...

CVE-2022-31017 Expression Always True vulnerability in Zulip Server

Zulip is an open-source team collaboration tool. Versions 2.1.0 through and including 5.2 are vulnerable to a logic error. A stream configured as private with protected history, where new subscribers should not be allowed to see messages sent before they were subscribed, when edited causes the...

Design/Logic Flaw

Wire is a secure messaging application. Wire is vulnerable to arbitrary HTML and Javascript execution via insufficient escaping when rendering @mentions in the wire-webapp. If a user receives and views a malicious message, arbitrary code is injected and executed in the context of the victim...

Security Bulletin: IBM Robotic Process Automation is vulnerable to configuration credentials unencrypted in system memory (CVE-2022-22414)

Summary Security Bulletin: IBM Robotic Process Automation is vulnerable to configuration credentials unencrypted in system memory CVE-2022-22414 Vulnerability Details CVEID:CVE-2022-22414 DESCRIPTION: IBM Robotic Process Automation 21.0.2 could allow a local user to obtain sensitive web service...

Denial Of Service (DoS)

OPCFoundation.NetStandard.Opc.Ua is vulnerable to denial of service. The vulnerability exists due to improper configuration of maximum chunk count which allows malicious clients to cause an application crash via a carefully crafted message...

Denial Of Service (DoS)

opcfoundation.netstandard.opc.ua is vulnerable to denial of service. The vulnerability exists due to the lack of maximum chunk count check-in requests which allows malicious clients to cause an application crash...

MAL-2022-3939 Malicious code in iot-central-high-availability-clients (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dc7a6b36f57350ade80621e0671f07ac8cdd22f714e9beb5347ddd63615debc4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in exchange_clients (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 41521ea4d46f70c643c63ffe123ab70db420e022fd320bf7906c1ba39c126a77 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Authentication Bypass

OPCFoundation.NetStandard.Opc.Ua is vulnerable to authentication bypass. The vulnerability exists due to the incorrect implementation of the authentication algorithm in the library, allowing malicious clients or servers to bypass the application authentication mechanism and connect to untrusted...