38678 matches found
PT-2022-8878 · Unknown · Cluster-Ingress-Operator
Name of the Vulnerable Software and Affected Versions: cluster-ingress-operator affected versions not specified Description: A flaw was found in the cluster-ingress-operator, related to how the router-default service allows only certain IP source ranges. This could allow an attacker to access...
GHSA-2FVV-QXRQ-7JQ6 apollo-server-core vulnerable to URL-based XSS attack affecting IE11 on default landing page
Impact The default landing page contained HTML to display a sample curl command which is made visible if the full landing page bundle could not be fetched from Apollo's CDN. The server's URL is directly interpolated into this command inside the browser from window.location.href. On some older...
washingtoninternetdaily.com Cross Site Scripting vulnerability OBB-2847816
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Apache HTTPD: Multiple Vulnerabilities
Background The Apache HTTP server is one of the most popular web servers on the Internet. Description Multiple vulnerabilities have been discovered in Apache HTTPD. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details...
Internet Bug Bounty: Pause-based desync in Apache HTTPD
Apache was vulnerable to a pause-based desync. This vulnerability is described in detail in my whitepaper here: https://portswigger.net/research/browser-powered-desync-attackspause Impact This enables server-side HTTP Request Smuggling when Apache is deployed as a back-end server, and it also...
smartinternet.com.au Cross Site Scripting vulnerability OBB-2837713
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Meet Tim Vereecke: Technical Solutions Architect
Tim Vereecke, technical solutions architect at Akamai, discusses how he uses a developer-first mindset to find internet performance solutions...
Now it's BlenderBot's turn to make shocking, inappropriate, and untrue remarks
Last Friday, Meta unveiled its new BlenderBot 3 AI chatbot, a conversational AI prototype. The company said its chatbot is designed to learn by having natural conversations with people online. It also improves its skills via human feedback. Meta also asserts with confidence that the more the AI...
Malicious code in magic-internet-money (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3065bd17ca30e939b9bf955fa81882d1780a378815a851b615d44f5c042df38f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-4449 Malicious code in magic-internet-money (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3065bd17ca30e939b9bf955fa81882d1780a378815a851b615d44f5c042df38f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
WordPress plugin Adminer Login has an unspecified vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress plugin Adminer Login version 1.4.4 contains a security vulnerability that can be exploited by...
PT-2022-6332 · Linux +2 · Linux Kernel +2
Name of the Vulnerable Software and Affected Versions: Linux Kernel affected versions not specified Description: A vulnerability was found in the Linux Kernel, affecting the vsock connect function of the net/vmw vsock/af vsock.c file. This issue is related to incorrect handling of socket block...
Internet Bug Bounty: CVE-2022-35948: CRLF Injection in Nodejs ‘undici’ via Content-Type
undici library should be protects HTTP headers from CRLF injection vulnerabilities. However, CRLF injection exists in the ‘content-type’ header of undici.request api. Impact = [email protected] users are vulnerable to CRLF Injection on headers when using unsanitized input as request headers, more...
Internet Bug Bounty: [CVE-2022-35949]: undici.request vulnerable to SSRF using absolute / protocol-relative URL on pathname
GHSA: https://github.com/nodejs/undici/security/advisories/GHSA-8qr4-xgw6-wmr3 Report: https://hackerone.com/reports/1642017 Impact SSRF...
Microsoft Windows Internet Information Services 安全漏洞
Microsoft Windows Internet Information Services IIS is a Web server for the Windows Server platform from Microsoft, USA. A security vulnerability exists in Microsoft Windows Internet Information Services. The following products and versions are affected:Windows Server 2022,Windows Server 2022...
[SECURITY] Fedora 36 Update: clamav-0.103.7-1.fc36
Clam AntiVirus is an anti-virus toolkit for UNIX. The main purpose of this software is the integration with mail servers attachment scanning. The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet. The programs ar...
CVE-2022-36835
Implicit Intent hijacking vulnerability in Samsung Internet Browser prior to version 17.0.7.34 allows attackers to access arbitrary files...
AZL-10468 CVE-2022-1012 affecting package kernel for versions less than 5.15.67.1-4
A memory leak problem was found in the TCP source port generation algorithm in net/ipv4/tcp.c due to the small table perturb size. This flaw may allow an attacker to information leak and may cause a denial of service problem...
