[SECURITY] Fedora 35 Update: golang-github-cloudflare-0.17.0-3.fc35

A Go library for interacting with Cloudflare's API v4. This library allows you to: - Manage and automate changes to your DNS records within Cloudflare - Manage and automate changes to your zones domains on Cloudflare, includi ng adding new zones to your account - List and modify the status of WAF...

CVE-2022-31055 Improper Access Control in kctf

kCTF is a Kubernetes-based infrastructure for capture the flag CTF competitions. Prior to version 1.6.0, the kctf cluster set-src-ip-ranges was broken and allowed traffic from any IP. The problem has been patched in v1.6.0. As a workaround, those who want to test challenges privately can mark the...

PT-2022-20493 · Kctf · Kctf

Name of the Vulnerable Software and Affected Versions: kCTF versions prior to 1.6.0 Description: The kCTF cluster set-src-ip-ranges feature was broken, allowing traffic from any IP. This issue has been patched in version 1.6.0. As a workaround for private challenge testing, users can mark...

Server-Side Request Forgery in private-ip

Insufficient RegEx in private-ip npm package v1.0.5 and below insufficiently filters reserved IP ranges resulting in indeterminate SSRF. An attacker can perform a large range of requests to ARIN reserved IP ranges, resulting in an indeterminable number of critical attack vectors, allowing remote...

GHSA-43CH-2H55-2VJ7 Server-Side Request Forgery in private-ip

Insufficient RegEx in private-ip npm package v1.0.5 and below insufficiently filters reserved IP ranges resulting in indeterminate SSRF. An attacker can perform a large range of requests to ARIN reserved IP ranges, resulting in an indeterminable number of critical attack vectors, allowing remote...

Purple Fox Rootkit Can Now Spread Itself to Other Windows Computers

Purple Fox, a Windows malware previously known for infecting machines by using exploit kits and phishing emails, has now added a new technique to its arsenal that gives it worm-like propagation capabilities. The ongoing campaign makes use of a "novel spreading technique via indiscriminate port...

CVE-2020-27836

A flaw was found in cluster-ingress-operator. A change to how the router-default service allows only certain IP source ranges could allow an attacker to access resources that would otherwise be restricted to specified IP ranges. The highest threat from this vulnerability is to data confidentialit...

Mozilla: DoH did not filter IPv4 mapped IP Addresses

When DNS over HTTPS is in use, it intentionally filters RFC1918 and related IP ranges from the responses as these do not make sense coming from a DoH resolver. However when an IPv4 address was mapped through IPv6, these addresses were erroneously let through, leading to a potential DNS Rebinding...

CVE-2020-28360

CVE-2020-28360 describes an SSRF vulnerability in the npm package private-ip (versions 1.0.5 and earlier). The root cause is an insufficient RegEx filter for reserved IP ranges, allowing an attacker to craft requests to ARIN/other reserved ranges, which can lead to remote server-side resource req...

Mozilla Firefox 安全漏洞

Mozilla Firefox and Mozilla Firefox ESR are both products of the Mozilla Foundation in the U.S. Mozilla Firefox is an open source web browser.Mozilla Firefox ESR is an extended support version of Firefox web browser. The FireFox product suffers from a resource management error vulnerability that...

Fitbit Spyware Steals Personal Data via Watch Face

A wide-open app-building API would allow an attacker to build a malicious application that could access Fitbit user data, and send it to any server. Kev Breen, director of cyber threat research for Immersive Labs, created a proof-of-concept for just that scenario, after realizing that Fitbit...

CVE-2020-15595

An issue was discovered in Zoho Application Control Plus before version 10.0.511. The Element Configuration feature to configure elements included in the scope of elements managed by the product allows an attacker to retrieve the entire list of the IP ranges and subnets configured in the product...

CVE-2020-15595

An issue was discovered in Zoho Application Control Plus before version 10.0.511. The Element Configuration feature to configure elements included in the scope of elements managed by the product allows an attacker to retrieve the entire list of the IP ranges and subnets configured in the product...

Design/Logic Flaw

An issue was discovered in Zoho Application Control Plus before version 10.0.511. The Element Configuration feature to configure elements included in the scope of elements managed by the product allows an attacker to retrieve the entire list of the IP ranges and subnets configured in the product...

CVE-2020-15595

CVE-2020-15595 affects Zoho Application Control Plus versions prior to 10.0.511. The issue lies in the Element Configuration feature, which can be abused to retrieve the full list of configured IP ranges and subnets, enabling an attacker to map the internal networks the product can reach. Impact ...

CVE-2020-15595

An issue was discovered in Zoho Application Control Plus before version 10.0.511. The Element Configuration feature to configure elements included in the scope of elements managed by the product allows an attacker to retrieve the entire list of the IP ranges and subnets configured in the product...

Preferred Network Rule for Hyper-V Host Not Using IP Specified

Challenge Backup network traffic does not use the NICs associated with IPs configured within the preferred network rules for a Microsoft Hyper-V Host. Cause This can occur because, by default, Veeam Backup & Replication stores only the IP addresses for Hyper-V hosts that DNS provides. Solution To...

Authentication flaw

Yachtcontrol through 2019-10-06: It's possible to perform direct Operating System commands as an unauthenticated user via the "/pages/systemcall.php?command=COMMAND" page and parameter, where COMMAND will be executed and returning the results to the client. Affects Yachtcontrol webservers disclos...

CVE-2019-17270

Yachtcontrol through 2019-10-06: It's possible to perform direct Operating System commands as an unauthenticated user via the "/pages/systemcall.php?command=COMMAND" page and parameter, where COMMAND will be executed and returning the results to the client. Affects Yachtcontrol webservers disclos...

Yachtcontrol Webapplication 1.0 - Unauthenticated Remote Code Execution

Yachtcontrol Webapplication 1.0 - Unauthenticated Remote Code Execution Exploit Title: Yachtcontrol Webapplication 1.0 - Unauthenticated Remote Code Execution Google Dork: N/A Date: 2019-12-06 Exploit Author: Hodorsec Vendor Homepage: http://www.yachtcontrol.nl/en/ Version: 1.0 Software Link:...