Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServers that use Designer flows may be vulnerable to loss of confidentiality due to CVE-2022-24773

Summary Node.js module node-forge is used by IBM App Connect Enterprise Certified Container by the connectors in a Designer flow to communicate with the connected SaaS application. IBM App Connect Enterprise Certified Container IntegrationServers that run Designer flows containing connectors may ...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in XStream

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of XStream. Vulnerability Details CVEID: CVE-2021-43859 DESCRIPTION: XStream is vulnerable to a denial of service, caused by improper input validation. By injecting highly recursive collections or maps, a remote...

Citrix Endpoint Management (aka XenMobile Server) 10.14.0 Rolling Patch 5

Package name: xms10.14.0.10521.bin For: XenMobile Server 10.14.0 Deployment type: On-premises only Replaces: xms10.14.0.10424.bin, xms10.14.0.10303.bin, xms10.14.0.10206.bin, and xms10.14.0.10118.bin Date: March 2022 Languages supported: English US Important notes about this update As a best...

Ostorlab - A Security Scanning Platform That Enables Running Complex Security Scanning Tasks Involving Multiple Tools In An Easy, Scalable And Distributed Way

The Sales Pitch If this is the first time you are visiting the Ostorlab Github page, here is the sales pitch. Security testing requires often chaining tools together, taking the output from one, mangling it, filtering it and then pushing it to another tool. Several tools have tried to make the...

Fedora: Security Advisory for flac (FEDORA-2022-ee96acc54f)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 36 Update: python-pillow-9.0.1-5.fc36

Python image processing library, fork of the Python Imaging Library PIL This library provides extensive file format support, an efficient internal representation, and powerful image processing capabilities. There are four subpackages: tk tk interface, qt PIL image wrapper for Qt, devel developmen...

[SECURITY] Fedora 36 Update: flac-1.3.4-1.fc36

FLAC stands for Free Lossless Audio Codec. Grossly oversimplified, FLAC is similar to Ogg Vorbis, but lossless. The FLAC project consists of the stream format, reference encoders and decoders in library form, flac, a command-line program to encode and decode FLAC files, metaflac, a command-line...

Tiktok-Scraper - TikTok Scraper. Download Video Posts, Collect User/Trend/Hashtag/Music Feed Metadata, Sign URL And Etc

Scrape and download useful information from TikTok. No login or password are required This is not an official API support and etc. This is just a scraper that is using TikTok Web API to scrape media and related meta information. Important notes As of right now it is NOT possible to download video...

Moderate: Red Hat Security Advisory: Release of OpenShift Serverless 1.21.0

Release of OpenShift Serverless 1.21.0 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References...

GHSA-R9CR-HVJJ-496V Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server

Impact All unpatched versions of Argo CD starting with v1.3.0 are vulnerable to a path traversal bug, compounded by an improper access control bug, allowing a malicious user with read-only repository access to leak sensitive files from Argo CD's repo-server. A malicious Argo CD user who has been...

Market expiry behaviour differs in implementation and documentation

Lines of code Vulnerability details Description The docs say that “If a market has not settled by its expiry date, it will automatically settle at the lower bound of its Valuation Range.” However, in the implementation, the expiry date is entirely ignored. The default settlement after expiry is a...

CVE-2021-46107

creationtimestamp| type| source ---|---|--- 2022-03-17 23:26:47+00:00| seen| https://t.me/cibsecurity/39173 2023-09-01 01:19:52+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-46107.yaml...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.10.4 security update

Red Hat OpenShift Container Platform release 4.10.4 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, whic...

org.cometd:cometd-demo (>=7.0.0 <=7.0.19), org.cometd:cometd-documentation (>=7.0.1 <=7.0.19) potentially affected by CVE-2022-24721 via org.cometd.java:cometd-java-oort (>=7.0.0 <=7.0.5)

org.cometd.java:cometd-java-oort MAVEN version =7.0.0, =7.0.0, =7.0.1, =7.0.19 Source cves: CVE-2022-24721 Source advisory: OSV:GHSA-RJMQ-6V55-4RJV...

org.cometd:cometd-demo (>=1.0.0 <=5.0.10), org.cometd:cometd-documentation (=5.0.10) potentially affected by CVE-2022-24721 via org.cometd.java:cometd-java-oort (>=1.0.beta9 <=5.0.10)

org.cometd.java:cometd-java-oort MAVEN version =1.0.beta9, =1.0.0, =5.0.10 - org.cometd:cometd-documentation =5.0.10 Source cves: CVE-2022-24721 Source advisory: OSV:GHSA-RJMQ-6V55-4RJV...

org.cometd:cometd-demo (>=6.0.0 <=6.0.19), org.cometd:cometd-documentation (>=6.0.1 <=6.0.19) potentially affected by CVE-2022-24721 via org.cometd.java:cometd-java-oort (>=6.0.0 <=6.0.5)

org.cometd.java:cometd-java-oort MAVEN version =6.0.0, =6.0.0, =6.0.1, =6.0.19 Source cves: CVE-2022-24721 Source advisory: OSV:GHSA-RJMQ-6V55-4RJV...

ijsclubstavoren.nl Improper Access Control vulnerability OBB-2426738

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Codecat v0.56 - An Open-Source Tool To Help You Find/Track User Input Sinks And Security Bugs Using Static Code Analysis

CodeCat is an open-source tool to help you find/track user input sinks and security bugs using static code analysis. These points follow regex rules. Current rules for C,C++,GO,Python,javascript,Swift,PHP,Ruby,ASP,Kotlin,Dart and Java.you can create your rules video How too install, step by step:...

Cloudflare Public Bug Bounty: API docs expose an active token for the sample domain theburritobot.com

A screenshot featured on API token creation documentation page exposed a valid API token with permissions sufficient to modify DNS records of one of Cloudflare’s demo zones. The token has since been revoked...

CVE-2022-23277

creationtimestamp| type| source ---|---|--- 2022-03-09 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=752 2022-06-29 11:03:01+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/6298 2022-08-19 16:31:57+00:00| seen|...