[SECURITY] Fedora 31 Update: unbound-1.10.1-1.fc31

Unbound is a validating, recursive, and caching DNSSEC resolver. The C implementation of Unbound is developed and maintained by NLnet Labs. It is based on ideas and algorithms taken from a java prototype developed by Verisign labs, Nominet, Kirei and ep.net. Unbound is designed as a set of modula...

Buffer Overflow Leading toCode Execution in Left4Dead 2

The post Buffer Overflow Leading to Code Execution in Left4Dead 2 appeared first on Rhino Security Labs...

Debian DSA-4692-1 : netqmail - security update

Georgi Guninski and the Qualys Research Labs discovered multiple vulnerabilities in qmail shipped in Debian as netqmail with additional patches which could result in the execution of arbitrary code, bypass of mail address verification and a local information leak whether a file exists or not. C...

[SECURITY] [DSA 4692-1] netqmail security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4692-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 24, 2020 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4692-1] netqmail security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4692-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 24, 2020 https://www.debian.org/security/faq -...

CloudGoat AWS Scenario Walkthrough: “EC2_SSRF”

The post CloudGoat AWS Scenario Walkthrough: “EC2SSRF” appeared first on Rhino Security Labs...

Exploit for OS Command Injection in Docker

RunC-CVE-2019-5736 --- Video: https://bit.ly/2WqvIL...

ManageEngine DataSecurity Plus Path Traversal / Code Execution

XL-2020-001 - DataSecurity Plus Xnode Server - Remote Code Execution via Path Traversal =============================================================================== Identifiers ------------------------------------------------- CVE-2020-11531 XL-20-001 CVSSv3 score...

Kentico CMS 12.0.14 Remote Command Execution Exploit

This Metasploit module exploits a vulnerability in the Kentico CMS platform versions 12.0.14 and earlier. Remote command execution is possible via unauthenticated XML requests to the Staging Service SyncServer.asmx interface ProcessSynchronizationTaskData method stagingTaskData parameter. XML inp...

Privilege Escalation in Google Cloud Platform – Part 2 (Non-IAM)

The post Privilege Escalation in Google Cloud Platform - Part 2 Non-IAM appeared first on Rhino Security Labs...

Privilege Escalation in Google Cloud Platform – Part 1 (IAM)

The post Privilege Escalation in Google Cloud Platform - Part 1 IAM appeared first on Rhino Security Labs...

SaltStack Salt Master/Minion Unauthenticated RCE

This module exploits unauthenticated access to the runner and sendpub methods in the SaltStack Salt master's ZeroMQ request server, for versions 2019.2.3 and earlier and 3000.1 and earlier, to execute code as root on either the master or on select minions. VMware vRealize Operations Manager...

SaltStack Salt Master Server Root Key Disclosure

This module exploits unauthenticated access to the prepauthinfo method in the SaltStack Salt master's ZeroMQ request server, for versions 2019.2.3 and earlier and 3000.1 and earlier, to disclose the root key used to authenticate administrative commands to the master. VMware vRealize Operations...

Working-As-Intended: RCE to IAM Privilege Escalation in GCP Cloud Build

The post Working-As-Intended: RCE to IAM Privilege Escalation in GCP Cloud Build appeared first on Rhino Security Labs...

Malicious Package

Overview acts-ascrafter is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using acts-ascraft...

Malicious Package

Overview active-modelserializers-matchers is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid...

Malicious Package

Overview catarse-paypalexpress is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using...

Malicious Package

Overview acts-asfuzzysearch is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using...

Malicious Package

Overview asset-uploader is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using asset-upload...

Malicious Package

Overview active-subset-validator is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using...