5354 matches found
Prefix escape
Overview In fastify-reply-from before version 4.0.2, by crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is /pub/, a user expect that accessing /priv on the target service would not be possible. Unfortunately, it is...
Prefix escape
Impact By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is /pub/, a user expect that accessing /priv on the target service would not be possible. Unfortunately, it is. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N...
GHSA-QMW8-3V4G-GWJ4 Prefix escape
Impact By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is /pub/, a user expect that accessing /priv on the target service would not be possible. Unfortunately, it is. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N...
Design/Logic Flaw
fastify-reply-from is an npm package which is a fastify plugin to forward the current http request to another server. In fastify-reply-from before version 4.0.2, by crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server i...
CVE-2021-21321
fastify-reply-from is an npm package which is a fastify plugin to forward the current http request to another server. In fastify-reply-from before version 4.0.2, by crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server i...
CVE-2021-21321 Prefix escape
fastify-reply-from is an npm package which is a fastify plugin to forward the current http request to another server. In fastify-reply-from before version 4.0.2, by crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server i...
CVE-2021-21321
The CVE affects the npm package fastify-reply-from (a Fastify plugin used to forward requests to a backend). In versions prior to 4.0.2, a crafted URL could escape the proxied backend’s prefix (for example base URL /pub/), allowing access to resources that should be out of scope. Impact is data c...
fastify-reply-from 存在输入验证错误漏洞
Matteo Collina fastify-reply-from is Matteo Collina an open source application . It is used to forward the current http request to another server. A security vulnerability exists in fastify-reply-from before version 4.0.2, which can be exploited to escape the prefix of a proxy backend service by...
Experts Find a Way to Learn What You're Typing During Video Calls
A new attack framework aims to infer keystrokes typed by a target user at the opposite end of a video conference call by simply leveraging the video feed to correlate observable body movements to the text being typed. The research was undertaken by Mohd Sabra, and Murtuza Jadliwala from the...
5 Security Lessons for Small Security Teams for the Post COVID19 Era
A full-time mass work from home WFH workforce was once considered an extreme risk scenario that few risk or security professionals even bothered to think about. Unfortunately, within a single day, businesses worldwide had to face such a reality. Their 3-year long digital transformation strategy w...
CVE-2020-36249
creationtimestamp| type| source ---|---|--- 2021-02-19 12:51:05+00:00| seen| https://t.me/cibsecurity/23844...
Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU - Oracle Jul 2020 CPU plus one additional vulnerability and Oracle deferred from Jan 2020
Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7 SR10-FP65 and Version 8 SR6-FP10 used by IBM Tivoli Application Dependency Discovery Manager TADDM. These issues were disclosed as part of the IBM Java SDK updates in Jul2020 and some were deferred from...
Security fix for the ALT Linux 9 package postgresql12-1C version 12.5-alt4
Feb. 11, 2021 Alexei Takaseev 12.5-alt4 - Fix permission checks on constraint violation errors on partitions. Fixes CVE-2021-3393 - Re-applay patch from 1C...
CVE-2021-25141
creationtimestamp| type| source ---|---|--- 2021-02-09 20:46:46+00:00| seen| Telegram/nVnrzSDUUprbONVX5DzYjWxej76ltwvjM-UoQByd3LibEw...
Why Human Error is #1 Cyber Security Threat to Businesses in 2021
Phishing and Malware Among the major cyber threats, the malware remains a significant danger. The 2017 WannaCry outbreak that cost businesses worldwide up to $4 billion is still in recent memory, and other new strains of malware are discovered on a daily basis. Phishing has also seen a resurgence...
Why Human Error is #1 Cyber Security Threat to Businesses in 2021
Phishing and Malware Among the major cyber threats, the malware remains a significant danger. The 2017 WannaCry outbreak that cost businesses worldwide up to $4 billion is still in recent memory, and other new strains of malware are discovered on a daily basis. Phishing has also seen a resurgence...
CVE-2020-36231
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view the metadata of boards they should not have access to via an Insecure Direct Object References IDOR vulnerability. The affected versions are before version 8.5.10, and from version 8.6.0 before 8.13.2...
Dutch Insider Attack on COVID-19 Data
Insider data theft: Dutch police have arrested two individuals on Friday for allegedly selling data from the Dutch health ministrys COVID-19 systems on the criminal underground. … According to Verlaan, the two suspects worked in DDG call centers, where they had access to official Dutch government...
Cybercriminals want your cloud services accounts, CISA warns
On January 13 the Cybersecurity and Infrastructure Security Agency CISA issued a warning about several recent successful cyberattacks on various organizations’ cloud services. What methods did the attackers use? In the initial phase, the victims were targeted by phishing emails trying to capture...
OSV-2018-138 Heap-buffer-overflow in parse_odp_key_mask_attr
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11160 Crash type: Heap-buffer-overflow READ 1 Crash state: parseodpkeymaskattr odpflowfromstring parsekeys...