Reddit: Domain Takeover of Reddit.ru via DNS Hijacking

Summary I discovered that Reddit.ru was vulnerable to DNS hijacking via DNS provider, Reg.ru. This would allow a malicious attacker to control the content on this domain, as well as, create email addresses associated with it... I'm going to be totally honest and say that any of us ethical hackers...

GitLab CE/EE 日志信息泄露漏洞

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. An information disclosure vulnerability exists in GitLab...

GitLab 安全漏洞

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab CE EE, which...

Nextcloud Access Control Error Vulnerability (CNVD-2021-39029)

Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. An access control error vulnerability exists in Nextcloud Mail versions prior to 1.4.3, and prior to 1.8.2, which can be exploited by an authenticated attacke...

Wallarm NG WAF is ranked as a “High Performer” by G2, Spring 2021!

We are proud to announce that Wallarm NG WAF was ranked as a “High performer” by G2 in the Web Application Firewall category. This award from the G2 platform confirms that our solution is highly rated by current verified Wallarm WAF users, who left unbiased reviews and answers to WAF-related...

The vulnerability of the Java Management Extensions (JMX) component of the Cisco Hosted Collaboration Mediation Fulfillment software allows a attacker to trigger a service failure.

The vulnerability of the Java Management Extensions JMX component of the Cisco Hosted Collaboration Mediation Fulfillment software is related to access control deficiencies. Exploiting this vulnerability could allow an attacker to cause service interruptions...

Security Bulletin: A security vulnerability in Node.js hosted-git-info module affects IBM Cloud Pak for Multicloud Management Managed Service

Summary A security vulnerability in Node.js hosted-git-info module affects IBM Cloud Pak for Multicloud Management Managed Service. Vulnerability Details CVEID: CVE-2021-23362 DESCRIPTION: Node.js hosted-git-info module is vulnerable to a denial of service, caused by a regular expression denial o...

Security Bulletin: A security vulnerability in Node.js hosted-git-info module affects IBM Cloud Automation Manager

Summary A security vulnerability in Node.js hosted-git-info module affects IBM Cloud Automation Manager. Vulnerability Details CVEID: CVE-2021-23362 DESCRIPTION: Node.js hosted-git-info module is vulnerable to a denial of service, caused by a regular expression denial of service ReDoS flaw in the...

BTCPay Server Cross-Site Scripting Vulnerability (CNVD-2021-34110)

BTCPay Server is a self-hosted open source cryptocurrency payment processor. It is secure, private, uncensored and free. A stored cross-site scripting vulnerability exists in the "POS Add Products" feature in BTCPay Server 1.0.7.0 and earlier versions. An attacker could exploit this vulnerability...

Regular Expression Denial of Service

Overview hosted-git-info before versions 2.8.9 and 3.0.8 are vulnerable to Regular Expression Denial of Service ReDoS via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity Recommendation Upgrade to...

@fengshangwuqi/appkit (>=1.0.22, <=1.0.29), @koj/strapi (>=1.4.1, <=1.4.3) +30 more potentially affected by CVE-2021-23362 via hosted-git-info (>=3.0.0, <=3.0.7)

hosted-git-info NPM version =3.0.0, =1.0.22, =1.4.1, =0.1.0, =4.0.0, =1.0.0, =3.0.0, =0.0.0-2020520224551, =0.1.0, =0.0.0-2020520224551, =0.0.0-2020520224551, =0.1.0, =0.0.0-2020520224551, =0.1.0, =0.0.0-2020520224551, =0.1.0, =0.1.10 and more Source cves: CVE-2021-23362 Source advisory:...

Regular Expression Denial of Service in hosted-git-info

The npm package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service ReDoS via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity...

GHSA-43F8-2H32-F4CJ Regular Expression Denial of Service in hosted-git-info

The npm package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service ReDoS via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity...

421752593pro (5.6.0), @concisejs/docz-theme-ext (>=0.0.1, <=0.0.3) +81 more potentially affected by CVE-2021-23362 via hosted-git-info (>=2.1.5, <=2.8.8)

hosted-git-info NPM version =2.1.5, =0.0.1, =0.1.0, =1.3.13, =3.0.0, =2.0.0, =1.16.0, =0.0.2, =2.3.1, =1.0.0, =1.0.0, =1.3.0, =1.3.16 and more Source cves: CVE-2021-23362 Source advisory: OSV:GHSA-43F8-2H32-F4CJ...

OESA-2021-1168 nodejs-hosted-git-info security update

Provides metadata and conversions from repository urls for Github, Bitbucket and Gitlab Security Fixes: The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service ReDoS via regular expression shortcutMatch in the fromUrl function in index.js. The affected...

The software vulnerabilities of SonicWall Email Security and SonicWall Hosted Email Security, related to insecure privilege management, allow attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of SonicWall Email Security and SonicWall Hosted Email Security software-related to insecure privilege management. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

The software vulnerabilities of SonicWall Email Security and SonicWall Hosted Email Security allow for unlimited downloading of malicious files, enabling attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of SonicWall Email Security and SonicWall Hosted Email Security software lies in their ability to allow unlimited download of malicious files. Exploiting this vulnerability can enable a malicious actor to compromise the confidentiality, integrity, and accessibility of the...

CVE-2021-29484 DOM XSS in Theme Preview

Ghost is a Node.js CMS. An unused endpoint added during the development of 4.0.0 has left sites vulnerable to untrusted users gaining access to Ghost Admin. Attackers can gain access by getting logged in users to click a link containing malicious code. Users do not need to enter credentials and m...

GitLab 授权问题漏洞

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. An authorization issue vulnerability exists in GitLab CE/...

GitLab 权限许可和访问控制问题漏洞

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. GitLab suffers from a privilege-permission and...