Security Only Update for .NET Framework 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows 7 SP1 and Server 2008 R2 SP1 (KB4498961)

Security Only Update for .NET Framework 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows 7 SP1 and Server 2008 R2 SP1 KB4498961 Applies to: Microsoft .NET Framework 3.5.1 Microsoft .NET Framework 4.5.2 Microsoft .NET Framework 4.6 Microsoft .NET Framework 4.6.1 Microsoft .NET...

PT-2019-2167 · Microsoft +2 · Net Core +3

Name of the Vulnerable Software and Affected Versions: .NET Core and Microsoft .NET Framework affected versions not specified Description: The issue is related to errors in processing regular expressions. It could allow a remote attacker to cause a denial of service. A remote unauthenticated...

KB4499158: Windows Server 2012 May 2019 Security Update (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)

The remote Windows host is missing security update 4499158 or cumulative update 4499171. It is, therefore, affected by multiple vulnerabilities : - A new subclass of speculative execution side channel vulnerabilities, known as Microarchitectural Data Sampling, exist in Windows. An attacker who...

CVE-2018-19989

In the /HNAP1/SetQoSSettings message, the uplink parameter is vulnerable, and the vulnerability affects D-Link DIR-822 Rev.B 202KRb06 and DIR-822 Rev.C 3.10B06 devices. In the SetQoSSettings.php source code, the uplink parameter is saved in the /bwc/entry:1/bandwidth and /bwc/entry:2/bandwidth...

CVE-2018-19990

In the /HNAP1/SetWiFiVerifyAlpha message, the WPSPIN parameter is vulnerable, and the vulnerability affects D-Link DIR-822 B1 202KRb06 devices. In the SetWiFiVerifyAlpha.php source code, the WPSPIN parameter is saved in the $rphyinf1."/media/wps/enrollee/pin" and $rphyinf2."/media/wps/enrollee/pi...

Command injection

In the /HNAP1/SetClientInfoDemo message, the AudioMute and AudioEnable parameters are vulnerable, and the vulnerabilities affect D-Link DIR-868L Rev.B 2.05B02 devices. In the SetClientInfoDemo.php source code, the AudioMute and AudioEnble parameters are saved in the ShellPath script file without...

Design/Logic Flaw

In the /HNAP1/SetQoSSettings message, the uplink parameter is vulnerable, and the vulnerability affects D-Link DIR-822 Rev.B 202KRb06 and DIR-822 Rev.C 3.10B06 devices. In the SetQoSSettings.php source code, the uplink parameter is saved in the /bwc/entry:1/bandwidth and /bwc/entry:2/bandwidth...

CVE-2018-19990

In the /HNAP1/SetWiFiVerifyAlpha message, the WPSPIN parameter is vulnerable, and the vulnerability affects D-Link DIR-822 B1 202KRb06 devices. In the SetWiFiVerifyAlpha.php source code, the WPSPIN parameter is saved in the $rphyinf1."/media/wps/enrollee/pin" and $rphyinf2."/media/wps/enrollee/pi...

CVE-2018-19989

CVE-2018-19989 affects D-Link DIR-822 Rev.B 202KRb06 and DIR-822 Rev.C 3.10B06 via the /HNAP1/SetQoSSettings uplink parameter. In SetQoSSettings.php the uplink value is saved to internal memory at /bwc/entry:1/bandwidth and /bwc/entry:2/bandwidth without any regex validation and later consumed by...

SUSE SLED12 / SLES12 Security Update : glibc (SUSE-SU-2019:1102-1)

This update for glibc fixes the following issues : Security issues fixed : CVE-2019-9169: regex: fix read overrun bsc1127308, BZ 24114 CVE-2016-10739: Fully parse IPv4 address strings bsc1122729, BZ 20018 CVE-2009-5155: ERE '0|0|\1|0' causes regexec undefined behavior bsc1127223, BZ 18986...

Raptor WAF v0.6 - Web Application Firewall using DFA

Raptor is a Web application firewall made in C, uses DFA to block SQL injection, Cross site scripting and path traversal. http://funguscodes.blogspot.com.br/ to run: $ git clone https://github.com/CoolerVoid/raptorwaf $ cd raptorwaf; make; bin/raptor Note: Don't execute with "cd bin; ./raptor" us...

FreeBSD : Gitlab -- Multiple vulnerabilities (da459dbc-5586-11e9-abd6-001b217b3468)

Gitlab reports : DoS potential for regex in CI/CD refs Related branches visible in issues for guests Persistent XSS at merge request resolve conflicts Improper authorization control 'move issue' Guest users of private projects have access to releases DoS potential on project languages page Recuri...

DEBIAN-CVE-2017-16231

In PCRE 8.41, after compiling, a pcretest load test PoC produces a crash overflow in the function match in pcreexec.c because of a self-recursive call. NOTE: third parties dispute the relevance of this report, noting that there are options that can be used to limit the amount of stack that is use...

GitLab: All functions that allow users to specify color code are vulnerable to ReDoS

Summary: Invalid color code leads to DoS. Description: GitLab has some functions that allow users to specify color code. e.g.: Labels/Broadcast Messages All those functions are vulnerable to ReDoS. It seems that there is a problem with the regex in app\validators\colorvalidator.rb to validate a...

Arjun v1.3 - HTTP Parameter Discovery Suite

Features Multi-threading 4 modes of detection A typical scan takes 30 seconds Regex powered heuristic scanning Huge list of 25,980 parameter names Makes just 30-35 requests to the target Usage Note: Arjun doesn't work with python 3.4 Discover parameters To find GET parameters, you can simply do:...

Cuteit v0.2.1 - IP Obfuscator Made To Make A Malicious Ip A Bit Cuter

IP obfuscator made to make a malicious ip a bit cuter A simple python tool to help you to social engineer, bypass whitelisting firewalls, potentially break regex rules for command line logging looking for IP addresses and obfuscate cleartext strings to C2 locations within the payload. All of that...

The vulnerability of the Perl programming language interpreter, related to errors in processing regular expressions, allows attackers to execute arbitrary code.

The vulnerability of the Perl programming language interpreter is related to errors in the processing of regular expressions, which can lead to the execution of the write operation beyond the buffer boundaries when the buffer is overflowing. Exploiting this vulnerability allows a remote attacker ...

The vulnerability of the Perl_my_setenv function in the Perl programming language, related to errors in processing regular expressions, allows a hacker to cause a service failure or execute arbitrary code.

The vulnerability of the Perlmysetenv function in “util.c” of the Perl programming language is related to errors in processing regular expressions. This leads to copying data into a buffer without checking the size of the input data, resulting in integer overflow. Exploiting this vulnerability ca...

DEBIAN-CVE-2019-9192

In the GNU C Library aka glibc or libc6 through 2.29, checkdstlimitscalcpos1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '|\1\1' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs...

UBUNTU-CVE-2009-5155

In the GNU C Library aka glibc or libc6 before 2.28, parseregexp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of service assertion failure and application exit or trigger an incorrect result by attempting a regular-expression match...