SUSE-SU-2021:3940-1 Security update for nodejs12

This update for nodejs12 fixes the following issues: - CVE-2021-22959: Fixed HTTP Request Smuggling due to spaced in headers bsc1191601. - CVE-2021-22960: Fixed HTTP Request Smuggling when parsing the body bsc1191602. - CVE-2021-37701: Fixed arbitrary file creation and overwrite in nodejs-tar...

CVE-2021-43041

An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. A crafted HTTP request could induce a format string vulnerability in the privileged vaultServer application...

Format string

An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. A crafted HTTP request could induce a format string vulnerability in the privileged vaultServer application...

CVE-2021-43041

An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. A crafted HTTP request could induce a format string vulnerability in the privileged vaultServer application...

CVE-2021-43041

Summary: CVE-2021-43041 affects the Kaseya Unitrends Backup Appliance prior to 10.5.5. The vulnerability is in the privileged vaultServer component and is triggered by a crafted HTTP request that causes a format string vulnerability. The CVSS data in the initial record indicates high impact (C/H/...

Croogo 3.0.2 - Remote Code Execution (Authenticated) Vulnerability

Exploit Title: Croogo 3.0.2 - Remote Code Execution Authenticated Exploit Author: Deha Berkin Bir Vendor Homepage: https://croogo.org/ Software Link: https://downloads.croogo.org/v3.0.2.zip Version: 3.0.2 Tested on: Windows 10 Home Single Language 20H2 & WampServer 3.2.3 == Tutorial $command"; ? ...

Croogo 3.0.2 Remote Code Execution

Exploit Title: Croogo 3.0.2 - Remote Code Execution Authenticated Date: 05/12/2021 Exploit Author: Deha Berkin Bir Vendor Homepage: https://croogo.org/ Software Link: https://downloads.croogo.org/v3.0.2.zip Version: 3.0.2 Tested on: Windows 10 Home Single Language 20H2 & WampServer 3.2.3 ==...

Armeria path traversal vulnerability

Armeria is an open source library for building asynchronous microservers that use HTTP/2 as the session layer protocol.Armeria is vulnerable to a path traversal vulnerability that stems from a flaw in the software's path validation logic. An attacker could send an HTTP request with a path...

HTTP Request Smuggling in github.com/hyperledger/fabric

A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.0.1, v2.3.0. It can easily break down as many orderers as the attacker wants. This bug can be leveraged by constructing a message whose header is invalid to the interface Order. This bug has been admitted and fixed by the...

Path Traversal

com.linecorp.armeria:armeria is vulnerable th path traversal. A remote attacker is able to gain access to sensitive user data in server's local file system by sending a specifically crafted HTTP request capable of bypassing armeria's path validation logic...

SUSE: Security Advisory (SUSE-SU-2021:3886-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLES12 Security Update : nodejs14 (SUSE-SU-2021:3886-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3886-1 advisory. nodejs14 was updated to 14.18.1: deps: update llhttp to 2.1.4 Security fixes: - HTTP Request Smuggling due to spaced in headers bsc1191601,...

Path Traversal in com.linecorp.armeria:armeria

Impact An attacker can access an Armeria server's local file system beyond its restricted directory by sending an HTTP request whose path contains %2F encoded /, such as /files/..%2Fsecrets.txt, bypassing Armeria's path validation logic. Patches Armeria 1.13.4 or above contains the hardened path...

CVE-2021-43795

Armeria is an open source microservice framework. In affected versions an attacker can access an Armeria server's local file system beyond its restricted directory by sending an HTTP request whose path contains %2F encoded /, such as /files/..%2Fsecrets.txt, bypassing Armeria's path validation...

CVE-2021-43795 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in com.linecorp.armeria:armeria

Armeria is an open source microservice framework. In affected versions an attacker can access an Armeria server's local file system beyond its restricted directory by sending an HTTP request whose path contains %2F encoded /, such as /files/..%2Fsecrets.txt, bypassing Armeria's path validation...

SUSE-SU-2021:3886-1 Security update for nodejs14

This update for nodejs14 fixes the following issues: nodejs14 was updated to 14.18.1: deps: update llhttp to 2.1.4 Security fixes: - HTTP Request Smuggling due to spaced in headers bsc1191601, CVE-2021-22959 - HTTP Request Smuggling when parsing the body bsc1191602, CVE-2021-22960 Changes in...

SUSE: Security Advisory (SUSE-SU-2021:3837-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Yealink Device Management Command Injection (CVE-2021-27561)

A command injection vulnerability exists in Yealink Device Management. The vulnerability is due to improper handling of a crafted HTTP request...

SUSE-SU-2021:3837-1 Security update for ruby2.1

This update for ruby2.1 fixes the following issues: - CVE-2020-25613: Fixed potential HTTP request smuggling in WEBrick bsc1177125. - CVE-2021-31799: Fixed Command injection vulnerability in RDoc bsc1190375. - CVE-2021-31810: Fixed trusting FTP PASV responses vulnerability in Net:FTP bsc1188161. ...

RHEL 7 / 8 : Red Hat JBoss Web Server 5.6.0 Security (Important) (RHSA-2021:4861)

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4861 advisory. Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the...