CVE-2022-29166 Improper handling of multiline messages in matrix-appservice-irc

matrix-appservice-irc is a Node.js IRC bridge for Matrix. The vulnerability in node-irc allows an attacker to manipulate a Matrix user into executing IRC commands by having them reply to a maliciously crafted message. The vulnerability has been patched in matrix-appservice-irc 0.33.2. Refrain fro...

CIA Wants Russians to Share Secret Info with the Agency via its Darknet Site

By Waqas CIA’s darknet website will be accessible to Russians through the Tor internet browser. The Central Intelligence Agency CIA… This is a post from HackRead.com Read the original post: CIA Wants Russians to Share Secret Info with the Agency via its Darknet Site...

CVE-2022-29473

On F5 BIG-IP 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when an IPSec ALG profile is configured on a virtual server, undisclosed responses can cause Traffic Management MicrokernelTMM to terminate. Note: Software versions which have...

India to Collect User Data from VPNs, Data Centers, and Cloud Service Providers

By Deeba Ahmed The Indian government recently passed a new law that mandates all internet service providers to collect and store… This is a post from HackRead.com Read the original post: India to Collect User Data from VPNs, Data Centers, and Cloud Service Providers...

CANs Reinvent LANs for an All-Local World

In an article I wrote over a year ago called “Securing the New Normal of Network Access,” I presented four access scenarios that modern organizations needed to enable users to stay securely connected and protected in the new normal of a work-from-anywhere world. Of course, “new” is a relative ter...

Every ISP in the US Must Block These 3 Pirate Streaming Services

The 96 internet service providers were told to enforce the orders “by any technological means available.”...

Matrix matrix-appservice-irc 注入漏洞

Matrix is an ambitious new ecosystem for open federated instant messaging and VoIP. matrix-appservice-irc is a bridge for Matrix. This bridge passes all IRC messages to Matrix and all Matrix messages to IRC. An injection vulnerability exists in Matrix matrix-appservice-irc version 0.33.1 and...

CVE-2022-26071

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, a flaw in the way reply ICMP packets are limited in the Traffic Management Microkernel TMM allows an attack...

Ransomware Insights from the FBI’s 2021 Internet Crime Report

The FBI has published its annual report on Internet crime. Qualys has analyzed its trends and statistics. In this post, we review our findings, especially with regards to the prevalence of Ransomware, and our recommendations for actions that enterprises should take to mitigate their risk. Every...

SAP Web Dispatcher HTTP Request Smuggling

Onapsis Security Advisory 2022-0001: HTTP Request Smuggling in SAP Web Dispatcher Impact on Business By injecting an HTTP request as a prefix into a victim's request, a malicious user is able to cause damage in different ways, such as producing a Denial of Service by setting an invalid request as...

F5 BIG-IP 安全漏洞

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing, etc. F5 BIG-IP has a security vulnerability that can be exploited by attackers to cause a denial of service on the BIG-IP system...

Mitel 6900 SIP 安全漏洞

Mitel 6900 SIP is a 6900 SIP series IP phone from Mitel Canada. A security vulnerability exists in Mitel 6900 SIP. An attacker could exploit this vulnerability to bypass the restrictions of the Mitel 6900 Series IP Phone SIP via system boot to elevate its privileges...

Microsoft Internet Explorer Use-After-Free Vulnerability

Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute code...

Tenda AX1806 操作系统命令注入漏洞

The Tenda AX1806 is a WiFi6 wireless router from Tenda China. The Tenda AX1806 suffers from a command injection vulnerability that stems from the SetIPv6Status function failing to properly filter construct command special characters, commands, etc. No detailed vulnerability details are provided a...

GHSA-W7X2-57F7-3P3X Trac Cross-site Scripting (XSS) vulnerability

Cross-site scripting XSS vulnerability in the "download wiki page as text" feature in Trac before 0.10.3.1, when Microsoft Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters...

Trac Cross-site Scripting (XSS) vulnerability

Cross-site scripting XSS vulnerability in the "download wiki page as text" feature in Trac before 0.10.3.1, when Microsoft Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters...

Multicloud, Multi-CDNs (Content Delivery Networks) Architecture – A Deceptive Future of the Internet

The last two years stood witness to multiple internet outages that caused massive disruptions across the globe. One prevalent theory is that multicloud, multi-CDNs content delivery networks are the inevitable future of the internet. This article conducts a litmus test on this theory and tries to...

[SECURITY] Fedora 34 Update: golang-github-theupdateframework-notary-0.7.0-4.fc34

The Notary project comprises a server and a client for running and interacting with trusted collections. See the service architecture documentation for more information. Notary aims to make the internet more secure by making it easy for people to publish and verify content. We often rely on TLS t...

ALPINE-CVE-2022-29869

cifs-utils through 6.14, with verbose logging, can cause an information leak when a file contains = equal sign characters but is not a valid credentials file...

Northern.tech Mender Enterprise 跨站请求伪造漏洞

Northern.tech Mender Enterprise is a wireless update manager for IoT devices from Northern.tech. A security vulnerability exists in Northern.tech Mender Enterprise prior to version 3.2.2, which stems from a cross-domain websocket hijacking allowed via the Deviceconnect microservice from 1.3.0...