CVE-2022-39348

CVE-2022-39348 (Twisted) affects the Twisted event-based framework for internet applications. When the host header does not match a configured host (twisted.web.vhost.NameVirtualHost), NoResource is returned and the Host header is unescaped in the 404, enabling HTML and script injection. The issu...

CVE-2022-39348 Twisted vulnerable to NameVirtualHost Host header injection

Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host twisted.web.vhost.NameVirtualHost will return a NoResource resource which renders the Host header unescaped into the 404 response allowing HTML and scri...

CVE-2022-39340

OpenFGA is an authorization/permission engine. Prior to version 0.2.4, the streamed-list-objects endpoint was not validating the authorization header, resulting in disclosure of objects in the store. Users openfga/openfga versions 0.2.3 and prior who are exposing the OpenFGA service to the intern...

Researchers Detail Windows Event Log Vulnerabilities: LogCrusher and OverLog

Cybersecurity researchers have disclosed details about a pair of vulnerabilities in Microsoft Windows, one of which could be exploited to result in a denial-of-service DoS. The exploits, dubbed LogCrusher and OverLog by Varonis, take aim at the EventLog Remoting Protocol MS-EVEN, which enables...

Why Ransomware in Education on the Rise and What That Means for 2023

The breach of LA Unified School District LAUSD highlights the prevalence of password vulnerabilities, as criminal hackers continue to use breached credentials in increasingly frequent ransomware attacks on education. The Labor Day weekend breach of LAUSD brought significant districtwide disruptio...

Internet Bug Bounty: potential denial of service attack via the locale parameter

In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a denial of service attack via the locale parameter, which is treated as a regular expression. Impact By crafting a Python regex, a vulnerable site could suffer a DOS attack. The attack was...

Looking for student debt relief? Watch out for scammers says the FBI

The FBI believes that scammers may be after people applying for the One-Time Federal Student Loan Debt Relief, a program announced by the Biden-Harris Administration in August 2022 that provides up to $20,000 in student loan debt relief. In a recent public service announcement, the agency warned ...

Secure Internet Access Is Needed Everywhere

Internet threats have made businesses and people vulnerable. Learn how to maintain effective security against cyberthreats with Secure Internet Access...

Linux kernel 资源管理错误漏洞

The Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. Linux Kernel has a security vulnerability that affects the functions devlinkparamset/devlinkparamget in the component IPsec's file net/core/devlink.c. The operation leads to free post-use. No details...

Linux kernel 竞争条件问题漏洞

Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. Linux kernel has a security vulnerability that affects the function tsttimer in the component IPsec's file drivers/atm/idt77252.c. The operation leads to free post-use. No details of the vulnerability ar...

Who’s Scanning the IPv6 Space? And, Frankly, Why Do We Even Care?

Securing IPv6 is no longer optional, it's a necessity. In this first of its kind empirical study on the vulnerability scanning landscape of IPv6, you'll learn the challenges and differences between IPv6 and IPv4 to be better prepared for the future...

Improving privacy when browsing web: Alternative browsers and chrome extensions

By Waqas As the internet expands and new technological developments occur, we must look back at what matters most: our… This is a post from HackRead.com Read the original post: Improving privacy when browsing web: Alternative browsers and chrome extensions...

kernel: information leak in the IPv4 implementation

An information leak flaw was found in the Linux kernel’s IPv4 implementation in the iprtinit in net/ipv4/route.c function. The use of a small hash table in IP ID generation allows a remote attacker to reveal sensitive information...

kernel: information leak in the IPv6 implementation

An information leak flaw was found in the Linux kernel’s IPv6 implementation in the ipv6selectident in net/ipv6/outputcore.c function. The use of a small hash table in IP ID generation allows a remote attacker to reveal sensitive information...

kernel: information leak in the IPv6 implementation

An information leak flaw was found in the Linux kernel’s IPv6 implementation in the ipv6selectident in net/ipv6/outputcore.c function. The use of a small hash table in IP ID generation allows a remote attacker to reveal sensitive information...

kernel: information leak in the IPv4 implementation

An information leak flaw was found in the Linux kernel’s IPv4 implementation in the iprtinit in net/ipv4/route.c function. The use of a small hash table in IP ID generation allows a remote attacker to reveal sensitive information...

Linux kernel 资源管理错误漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel suffers from a resource management error vulnerability that originates when the function sessfreebuffer in the file fs/cifs/sess.c is affected, resulting in a doub...

DEBIAN-CVE-2022-3567

A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function inet6streamops/inet6dgramops of the component IPv6 Handler. The manipulation leads to race condition. It is recommended to apply a patch to fix this issue. VDB-211090 is the...

UBUNTU-CVE-2022-3545

A vulnerability has been found in Linux Kernel and classified as critical. Affected by this vulnerability is the function areacacheget of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfpcppcore.c of the component IPsec. The manipulation leads to use after free. It is recommended to apply a...

WordPress Plugin Helpful 信息泄露漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An information disclosure...