4042 matches found
CVE-2022-23021
On BIG-IP version 16.1.x before 16.1.2, when any of the following configurations are configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel TMM to terminate: HTTP redirect rule in an LTM policy, BIG-IP APM Access Profile, and Explicit HTTP Proxy in HTTP...
CVE-2022-23021
On BIG-IP version 16.1.x before 16.1.2, when any of the following configurations are configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel TMM to terminate: HTTP redirect rule in an LTM policy, BIG-IP APM Access Profile, and Explicit HTTP Proxy in HTTP...
PT-2022-15789
Name of the Vulnerable Software and Affected Versions BIG-IP versions 16.1.x through 16.1.1 Description The issue arises when specific configurations are set up on a virtual server, including an HTTP redirect rule in an LTM policy, a BIG-IP APM Access Profile, and an Explicit HTTP Proxy in an HTT...
CVE-2022-23021: NULL Pointer Dereference
On BIG-IP version 16.1.x before 16.1.2, when any of the following configurations are configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel TMM to terminate: HTTP redirect rule in an LTM policy, BIG-IP APM Access Profile, and Explicit HTTP Proxy in HTTP...
Cross-site Scripting (XSS)
pimcore/pimcore is vulnerable to cross-site scripting XSS attacks. An attacker is able to bypass the validations due to improper input neutralization during web page generation. The vulnerability can be exploited via changing the rule name in the admin dev page allowing attackers to inject and...
Don't be afraid of XXE vulnerabilities: understand the beast and how to detect them
Today XML External Entities XXE vulnerabilities are still ubiquitous, despite the fact that recommendations to protect against them have been an integral part of security standards for years. In this post, the first in a series of three blog posts, we will try to demystify XXE vulnerabilities and...
AlphaGolang - IDApython Scripts For Analyzing Golang Binaries
AlphaGolang is a collection of IDAPython scripts to help malware reverse engineers master Go binaries. The idea is to break the scripts into concrete steps, thus avoiding brittle monolithic scripts, and mimicking the methodology an analyst might follow when tackling a Go binary. Scripts are...
CVE-2022-23094
A vulnerability was found in libreswan. A malformed packet that is being rejected triggers a logging action that causes a NULL pointer dereference issue, leading to a crash of the pluto daemon. Mitigation If all configured connections are using IKEv2, the IKEv1 subsystem can be disabled by adding...
CVE-2021-43858
MinIO is a Kubernetes native application for cloud storage. Prior to version RELEASE.2021-12-27T07-23-18Z, a malicious client can hand-craft an HTTP API call that allows for updating policy for a user and gaining higher privileges. The patch in version RELEASE.2021-12-27T07-23-18Z changes the...
CVE-2021-43858
MinIO is a Kubernetes native application for cloud storage. Prior to version RELEASE.2021-12-27T07-23-18Z, a malicious client can hand-craft an HTTP API call that allows for updating policy for a user and gaining higher privileges. The patch in version RELEASE.2021-12-27T07-23-18Z changes the...
Minio MinIO 安全漏洞
Minio MinIO is an open source object storage server from MinIO USA. The product supports building infrastructure for machine learning, analytics, and application data workloads.MinIO has a security vulnerability that stems from the fact that MinIO is a native application for Kubernetes cloud...
GHSA-G54H-M393-CPWQ devices resource list treated as a blacklist by default
Impact Contrary to the OCI runtime specification, runc's implementation of the linux.resources.devices list was a black-list by default. This means that users who created their own config.json objects and didn't prefix a deny-all rule "allow": false, "permissions": "rwm" or equivalent were not...
PT-2021-26955
Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.4 through v5.10.83 Description A memory leak issue was discovered in the fib6 rule suppress function related to IPv6. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...
PT-2021-27024
Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.4 through v5.15.6 Description A memory leak issue was discovered in the fib6 rule suppress function related to IPv6. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...
PT-2021-26915
Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.4.164 Description A memory leak issue was discovered in the fib6 rule suppress function related to IPv6. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...
Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware
Cloud One - Workload Security Log4Shell This repo contains a q...
Detect Exploitation Attempts With Qualys XDR (Beta)
The recently announced Log4JShell / CVE-2021-44228 exploit is the latest reminder of why it’s so important to maintain an enterprise-wide view of your security posture. The heart of the exploit centers around misuse of the JNDI lookup function built into log4j. Impact: There are multiple proofs o...
Continuing to Stay Ahead of CVE-2021-44228: Addressing Your Top Questions
Since it was disclosed on Friday, December 11, I have spoken with many customers about CVE-2021-44228 and the ways Imperva is working to ensure that they are protected. Countless others have contacted us with questions about ways to mitigate the impact from the Log4j vulnerability. In the spirit ...