Security Bulletin: A vulnerability in Apache Struts affects IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products

Summary A vulnerability in Apache Struts affects the product's management GUI. The Command Line Interface is unaffected. Vulnerability Details CVEID:CVE-2023-34396 DESCRIPTION: Apache Struts is vulnerable to a denial of service, caused by a flaw when processing Multipart request containing non-fi...

What a Bloody San Francisco Street Brawl Tells Us About the Age of Citizen Surveillance

When a homeless man attacked a former city official, footage of the onslaught became a rallying cry. Then came another video, and another—and the story turned inside out...

Security Bulletin: Vulnerability in FOS firmware used by IBM b-type SAN directors and switches.

Summary The b-type products are vulnerable due to an OpenSSL issue in the FOS firmware. The vulnerability has been addressed and can be resolved by applying the FOS code level listed below. Vulnerability Details CVEID: CVE-2022-4304 DESCRIPTION: OpenSSL could allow a remote attacker to obtain...

Security Bulletin: Vulnerability in SANNav Software used by IBM b-type SAN directors and switches.

Summary The SANnav Management Portal and Global View products are vulnerable due to a Jave SE issue. The vulnerability has been addressed and can be resolved by applying the SANnav code level listed below. Vulnerability Details CVEID: CVE-2022-21426 DESCRIPTION: An unspecified vulnerability in Ja...

Security Bulletin: Vulnerability in SANNav Software used by IBM b-type SAN directors and switches.

Summary The SANnav Management Portal and Global View products are vulnerable due to Jave SE issues. The vulnerabilities have been addressed and can be resolved by applying the SANnav code level listed below. Vulnerability Details CVEID: CVE-2023-21830 DESCRIPTION: An unspecified vulnerability in...

Security Bulletin: Vulnerability in SANNav software and FOS firmware used by IBM b-type SAN directors and switches.

Summary The SANnav Management Portal, Global View, and FOS firmware for IBM b-type products are vulnerable due to an OpenSSL issue. The vulnerability has been addressed and can be resolved by applying the SANnav and FOS code levels listed below. Vulnerability Details CVEID: CVE-2022-2068...

sanfranciscocondomania.com Cross Site Scripting vulnerability OBB-3767263

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2023-7073 · Elastic · Apm Server +3

Name of the Vulnerable Software and Affected Versions: Beats affected versions not specified Elastic Agent affected versions not specified APM Server affected versions not specified Fleet Server affected versions not specified Description: The issue is related to errors in the TLS certificate...

farmaciasanantonio.hn Cross Site Scripting vulnerability OBB-3761907

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

san-francisco-theater.com Cross Site Scripting vulnerability OBB-3747572

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

H3C ER Series Path Traversal Vulnerability

The H3C ER Series is a series of routers from China's Xinhua San H3C Corporation. A path traversal vulnerability exists in the H3C ER Series, which stems from a portion of the code in /userLogin.asp that could lead to path traversal...

Upcoming Speaking Engagements

This is a current list of where and when I am scheduled to speak: Im speaking at swampUP 2023 in San Jose, California, on September 13, 2023 at 11:35 AM PT. The list is maintained on this page...

GHSA-P45J-VFV5-WPRQ RKE2 supervisor port is vulnerable to unauthenticated remote denial-of-service (DoS) attack via TLS SAN stuffing attack

Impact An issue was found in RKE2 where an attacker with network access to RKE2 servers' supervisor port TCP 9345 can force the TLS server to add entries to the certificate's Subject Alternative Name SAN list, through a stuffing attack, until the certificate grows so large that it exceeds the...

RKE2 supervisor port is vulnerable to unauthenticated remote denial-of-service (DoS) attack via TLS SAN stuffing attack

Impact An issue was found in RKE2 where an attacker with network access to RKE2 servers' supervisor port TCP 9345 can force the TLS server to add entries to the certificate's Subject Alternative Name SAN list, through a stuffing attack, until the certificate grows so large that it exceeds the...

K3s apiserver port is vulnerable to unauthenticated remote denial-of-service (DoS) attack via TLS SAN stuffing attack

Impact An issue was found in K3s where an attacker with network access to K3s servers' apiserver/supervisor port TCP 6443 can force the TLS server to add entries to the certificate's Subject Alternative Name SAN list, through a stuffing attack, until the certificate grows so large that it exceeds...

GHSA-M4HF-6VGR-75R2 K3s apiserver port is vulnerable to unauthenticated remote denial-of-service (DoS) attack via TLS SAN stuffing attack

Impact An issue was found in K3s where an attacker with network access to K3s servers' apiserver/supervisor port TCP 6443 can force the TLS server to add entries to the certificate's Subject Alternative Name SAN list, through a stuffing attack, until the certificate grows so large that it exceeds...

san-francisco-theater.com Cross Site Scripting vulnerability OBB-3665947

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

sandiegoflowerdelivery.net Cross Site Scripting vulnerability OBB-3655350

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

sandiegofamilymedicine.com Cross Site Scripting vulnerability OBB-3655349

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PostgreSQL vulnerability in SANnav 2.2.0.2

A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension in that schema, and the ability to lure or wait for a victim to use the objec...