Ostorlab - A Security Scanning Platform That Enables Running Complex Security Scanning Tasks Involving Multiple Tools In An Easy, Scalable And Distributed Way

The Sales Pitch If this is the first time you are visiting the Ostorlab Github page, here is the sales pitch. Security testing requires often chaining tools together, taking the output from one, mangling it, filtering it and then pushing it to another tool. Several tools have tried to make the...

Fedora: Security Advisory for flac (FEDORA-2022-ee96acc54f)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 36 Update: python-pillow-9.0.1-5.fc36

Python image processing library, fork of the Python Imaging Library PIL This library provides extensive file format support, an efficient internal representation, and powerful image processing capabilities. There are four subpackages: tk tk interface, qt PIL image wrapper for Qt, devel developmen...

[SECURITY] Fedora 36 Update: flac-1.3.4-1.fc36

FLAC stands for Free Lossless Audio Codec. Grossly oversimplified, FLAC is similar to Ogg Vorbis, but lossless. The FLAC project consists of the stream format, reference encoders and decoders in library form, flac, a command-line program to encode and decode FLAC files, metaflac, a command-line...

Moderate: Red Hat Security Advisory: Release of OpenShift Serverless 1.21.0

Release of OpenShift Serverless 1.21.0 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References...

GHSA-R9CR-HVJJ-496V Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server

Impact All unpatched versions of Argo CD starting with v1.3.0 are vulnerable to a path traversal bug, compounded by an improper access control bug, allowing a malicious user with read-only repository access to leak sensitive files from Argo CD's repo-server. A malicious Argo CD user who has been...

Market expiry behaviour differs in implementation and documentation

Lines of code Vulnerability details Description The docs say that “If a market has not settled by its expiry date, it will automatically settle at the lower bound of its Valuation Range.” However, in the implementation, the expiry date is entirely ignored. The default settlement after expiry is a...

CVE-2021-46107

creationtimestamp| type| source ---|---|--- 2022-03-17 23:26:47+00:00| seen| https://t.me/cibsecurity/39173 2023-09-01 01:19:52+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-46107.yaml...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.10.4 security update

Red Hat OpenShift Container Platform release 4.10.4 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, whic...

ijsclubstavoren.nl Improper Access Control vulnerability OBB-2426738

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Codecat v0.56 - An Open-Source Tool To Help You Find/Track User Input Sinks And Security Bugs Using Static Code Analysis

CodeCat is an open-source tool to help you find/track user input sinks and security bugs using static code analysis. These points follow regex rules. Current rules for C,C++,GO,Python,javascript,Swift,PHP,Ruby,ASP,Kotlin,Dart and Java.you can create your rules video How too install, step by step:...

Cloudflare Public Bug Bounty: API docs expose an active token for the sample domain theburritobot.com

A screenshot featured on API token creation documentation page exposed a valid API token with permissions sufficient to modify DNS records of one of Cloudflare’s demo zones. The token has since been revoked...

CVE-2022-23277

creationtimestamp| type| source ---|---|--- 2022-03-09 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=752 2022-06-29 11:03:01+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/6298 2022-08-19 16:31:57+00:00| seen|...

Unbreakable Enterprise kernel-container security update

4.14.35-2047.511.5.4.el7 - x86/speculation: Add knob for eibrsretpolineenabled Patrick Colp Orabug: 33922122 CVE-2021-26341 - x86/speculation: Extend our code to properly support eibrs+lfence and eibrs+retpoline Patrick Colp Orabug: 33922122 CVE-2021-26341 - x86/speculation: Update link to AMD...

Security update for libeconf, shadow and util-linux (moderate)

openSUSE Security Update: Security update for libeconf, shadow and util-linux Announcement ID: openSUSE-SU-2022:0727-1 Rating: moderate References: 1188507 1192954 1193632 1194976 SLE-23384 SLE-23402 Cross-References: CVE-2021-3995 CVE-2021-3996 CVSS scores: CVE-2021-3995 SUSE: 4.7...

Citrix Endpoint Management (aka XenMobile Server) 10.13.0 Rolling Patch 7

Package name: xms10.13.0.10723.bin For: XenMobile Server 10.13.0 Deployment type: On-premises only Replaces: xms10.13.0.10603.bin, xms10.13.0.10528.bin, xms10.13.0.10426.bin, xms10.13.0.10329.bin, xms10.13.0.10212.bin, and xms10.13.0.10129.bin. Date: March 2022 Languages supported: English US...

rubygem-rdoc: Command injection vulnerability in RDoc

An operating system command injection flaw was found in RDoc. Using the rdoc command to generate documentation for a malicious Ruby source code could lead to execution of arbitrary commands with the privileges of the user running rdoc...

WordPress Knowledge Base documentation & wiki plugin – BasePress plugin <= 2.15.13 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Knowledge Base documentation & wiki plugin – BasePress plugin versions = 2.15.13. Solution Update the WordPress Knowledge Base documentation & wiki plugin – BasePress plugin to the latest available...

What’s New for Developers: February 2022

A lot has happened since we published our January recap blog. Akamai launched a new documentation site on readme.io, we started a new season of Terraform Tapas, and we saw many amazing contributions from our Developer Champions...

QA Report

LOW : 1. Title : permitAndMulticall can be frontrun, that will lead to the user must reasign the TX Impact : In the permitAndMulticall it takes from as a user input, since all tx in the blockchain is public, a malicious user might frontrun the permitAndMulticall and providing 0 data, which will...