Knot Resolver 安全漏洞

Knot Resolver is a caching DNS resolver implementation that includes a resolver library and daemon. A security vulnerability exists in Knot Resolver versions prior to 5.5.1, which stems from a possible DNS cache poisoning when attempting to limit forwarding operations via a filter...

Authorization

NestJS Proxy is a NestJS module to decorate and proxy calls. Prior to version 0.7.0, the nestjs-proxy library did not have a way to control when Authorization headers should should be forwarded for specific backend services configured by the application developer. This could have resulted in...

Default configuration

NestJS Proxy is a NestJS module to decorate and proxy calls. Prior to version 0.7.0, the nestjs-proxy library did not have a way to block sensitive cookies e.g. session cookies from being forwarded to backend services configured by the application developer. This could have led to sensitive cooki...

PT-2022-20505

Name of the Vulnerable Software and Affected Versions @finastra/nestjs-proxy versions prior to 0.7.0 @ffdc/nestjs-proxy affected versions not specified Description The nestjs-proxy library did not have a way to block sensitive cookies, such as session cookies, from being forwarded to backend...

WhatsApp accounts hijacked by call forwarding

In a short post on LinkedIn Rahul Sasi, founder and CEO of CloudSEK, explains how WhatsApp account takeovers are possible. The methods consists of several steps and it takes some social engineering skills, but it’s good to be aware of the possibility and how it works. It starts with the threat...

CVE-2022-29248 Cross-domain cookie leakage in Guzzle

Guzzle is a PHP HTTP client. Guzzle prior to versions 6.5.6 and 7.4.3 contains a vulnerability with the cookie middleware. The vulnerability is that it is not checked if the cookie domain equals the domain of the server which sets the cookie via the Set-Cookie header, allowing a malicious server ...

Sysaid Technologies Sysaid 输入验证错误漏洞

Sysaid Technologies SysAid is a suite of IT service management solutions from Sysaid Technologies, Israel. Sysaid Technologies Sysaid suffers from a security vulnerability that stems from a lack of validation of the input accepted by the program.Unauthenticated redirection and forwarding may occu...

Moderate: Red Hat Security Advisory: fetchmail security update

An update for fetchmail is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

ALSA-2022:1964 Moderate: fetchmail security update

Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC for retrieval...

NewStart CGSL CORE 5.04 / MAIN 5.04 : flatpak Vulnerability (NS-SA-2022-0010)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has flatpak packages installed that are affected by a vulnerability: - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In Flatpack since version 0.9.4 and before version 1.10...

NewStart CGSL CORE 5.05 / MAIN 5.05 : flatpak Vulnerability (NS-SA-2022-0043)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has flatpak packages installed that are affected by a vulnerability: - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In Flatpack since version 0.9.4 and before version 1.10...

GSD-2022-1002293 ipv6: fix panic when forwarding a pkt with no in6 dev

ipv6: fix panic when forwarding a pkt with no in6 dev This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.239 by commit...

GSD-2022-1002157 ipv6: fix panic when forwarding a pkt with no in6 dev

ipv6: fix panic when forwarding a pkt with no in6 dev This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.190 by commit...

GSD-2022-1000962 ipv6: fix panic when forwarding a pkt with no in6 dev

ipv6: fix panic when forwarding a pkt with no in6 dev This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.4 by commit...

PT-2022-30221

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 5.10.54 through 5.10.111 Description A potential issue exists when forwarding a packet with no in6 device, which could lead to a panic. The actual impact and attack plausibility have not yet been proven. Recommendations F...

PT-2022-30430

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 5.4.136 through 5.4.189 Description A potential issue exists in the Linux Kernel related to IPv6 packet forwarding, which could lead to a panic when forwarding a packet with no in6 device. The actual impact and attack...

PT-2022-29235

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.17.4 Description A potential issue exists when forwarding a packet with no in6 device, which could lead to a panic. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux...

PT-2022-30566

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 4.19.199 through 4.19.238 Description A potential issue exists when forwarding a packet with no in6 device, which could lead to a panic. The actual impact and attack plausibility have not yet been proven. Recommendations...

Slackware: Security Advisory (SSA:2020-106-01)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-22188

An Uncontrolled Memory Allocation vulnerability leading to a Heap-based Buffer Overflow in the packet forwarding engine PFE of Juniper Networks Junos OS allows a network-based unauthenticated attacker to flood the device with traffic leading to a Denial of Service DoS. The device must be configur...