Older releases of better_errors open to Cross-Site Request Forgery attack

Impact bettererrors prior to 2.8.0 did not implement CSRF protection for its internal requests. It also did not enforce the correct "Content-Type" header for these requests, which allowed a cross-origin "simple request" to be made without CORS protection. These together left an application with...

GHSA-W3J4-76QW-WWJM Older releases of better_errors open to Cross-Site Request Forgery attack

Impact bettererrors prior to 2.8.0 did not implement CSRF protection for its internal requests. It also did not enforce the correct "Content-Type" header for these requests, which allowed a cross-origin "simple request" to be made without CORS protection. These together left an application with...

Cross site request forgery (csrf)

bettererrors is an open source replacement for the standard Rails error page with more information rich error pages. It is also usable outside of Rails in any Rack app as Rack middleware. bettererrors prior to 2.8.0 did not implement CSRF protection for its internal requests. It also did not...

CVE-2021-39197

CVE-2021-39197 affects the Ruby gem better_errors. It describes that versions prior to 2.8.0 did not implement CSRF protection for internal requests and did not enforce the correct Content-Type header, allowing cross-origin (CORS) attacks in applications with better_errors enabled. The issue is l...

Nextcloud: RCE on 17 different Docker containers on your network

Summary: I was able to get RCE on 17 different docker containers, ranging from postgres and some prod enviroments Steps To Reproduce: I found that there was a unconfigured portainer.io service running on http://spreed-demo.nextcloud.com:9000 1. I created an administrator account with the login...

CVE-2021-22253

Improper authorization in GitLab EE affecting all versions since 13.4 allowed a user who previously had the necessary access to trigger deployments to protected environments under specific conditions after the access has been removed...

CVE-2021-22253

Improper authorization in GitLab EE affecting all versions since 13.4 allowed a user who previously had the necessary access to trigger deployments to protected environments under specific conditions after the access has been removed...

UBUNTU-CVE-2021-22253

Improper authorization in GitLab EE affecting all versions since 13.4 allowed a user who previously had the necessary access to trigger deployments to protected environments under specific conditions after the access has been removed...

CVE-2021-22253

Improper authorization in GitLab EE affecting all versions since 13.4 allowed a user who previously had the necessary access to trigger deployments to protected environments under specific conditions after the access has been removed...

CVE-2021-22253

Removed by vendor...

CVE-2021-22253: Incorrect Authorization

Improper authorization in GitLab EE affecting all versions since 13.4 allowed a user who previously had the necessary access to trigger deployments to protected environments under specific conditions after the access has been removed...

PT-2021-6752 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 13.4 and later Description: The issue is related to improper authorization, allowing a user who previously had necessary access to trigger deployments to protected environments under specific conditions, even after their...

The vulnerability of the gluster_shared_storage function on storage platforms for physical, virtual, and cloud environments allows attackers to increase their privileges.

The vulnerability of the glustersharedstorage function on storage platforms in physical, virtual, and cloud environments is related to the improper assignment of privileges. Exploiting this vulnerability can allow attackers to enhance their privileges...

vulhub

This repository is an offensive tool for vulnerability research and exploitation. It contains a collection of vulnerable environments and exploits for various software and frameworks, including Docker, Git, and Oracle Java. The repository is maintained by phith0n and is licensed under the MIT...

Domain Escalation – PrintNightmare

Printers are part of every corporate infrastructure therefore Windows environments they have a number of embedded drivers installed. The Print Spooler spoolsv.exe service is responsible… Continue reading - Domain Escalation - PrintNightmare...

Microsoft Azure Sphere 输入验证错误漏洞

Microsoft Azure Sphere is an appliance from Microsoft Corporation USA that is used to provide security in cloud environments. An input validation error vulnerability exists in Microsoft Azure Sphere. The following products and versions are affected:Azure Sphere...

vulhub111

This repository is an offensive tool for vulnerability research and exploitation. It contains a collection of vulnerable environments and exploits for various software and frameworks, including CouchDB, FFmpeg, Git, and more. The repository is maintained by Vulhub, a community-driven project for...

Universal Privilege Escalation and Persistence – Printer

The Print Spooler is responsible to manage and process printer jobs. It runs as a service with SYSTEM level privileges on windows environments. Abuse of… Continue reading - Universal Privilege Escalation and Persistence - Printer...

DEBIAN-CVE-2021-37600

An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to use system resources in a way that leads to a large number in the /proc/sysvipc/sem file. NOTE: this is unexploitable in GNU C Library environments, and possibly in all realistic...

vulhub

This is an open-source collection of vulnerable web applications and environments for testing and learning about web application security. It is a project maintained by phith0n and hosted on GitHub. The repository contains a variety of applications and environments, including CouchDB, FFmpeg, Git...