Harbor 'Ping()' Function Server-Side Cross-Site Forgery Vulnerability

Harbor is an open source, enterprise-grade registry server that also provides advanced security features such as user management, access control and activity auditing. A server-side cross-site forgery vulnerability exists in the 'Ping' function of the ui/api/targets.go file in Harbor 1.3.0-rc4 an...

Server side request forgery (ssrf)

The Ping function in ui/api/target.go in Harbor through 1.3.0-rc4 has SSRF via the endpoint parameter to /api/targets/ping...

CVE-2017-17697

The Ping function in ui/api/target.go in Harbor through 1.3.0-rc4 has SSRF via the endpoint parameter to /api/targets/ping...

PT-2017-14957

Name of the Vulnerable Software and Affected Versions Harbor versions prior to 1.3.0-rc4 Description The issue concerns the Ping function in ui/api/target.go, which is susceptible to Server-Side Request Forgery SSRF via the endpoint parameter to "/api/targets/ping". Recommendations For Harbor...

Octopus Deploy Information Disclosure Vulnerability

Octopus allows attackers to obtain sensitive cleartext information by reading a variable JSON file in certain situations involving Offline Drop Targets. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

DDoS attacks in Q3 2017

News Overview In the third quarter of 2017, the trends of the preceding quarters continued to develop further. The number of DDoS attacks in China, the United States, South Korea and Russia increased, which were reflected in the statistics we gathered for botnets. A sharp surge in the number more...

Target Credential Status by Authentication Protocol - Failure for Provided Credentials

Nessus failed to successfully authenticate directly to the remote target on an available authentication protocol. Nessus was able to connect to the remote port and identify that the service running on the port supports an authentication protocol, but Nessus failed to authenticate to the remote...

Updated irssi packages fix security vulnerabilities

While waiting for the channel synchronization, Irssi may incorrectly fail to remove destroyed channels from the query list, resulting in use after free conditions when updating the state later on CVE-2017-15227. When installing themes with unterminated color formatting sequences, Irssi may access...

ALPINE-CVE-2017-15723

In Irssi before 1.0.5, overlong nicks or targets may result in a NULL pointer dereference while splitting the message...

CVE-2017-15723

In Irssi before 1.0.5, overlong nicks or targets may result in a NULL pointer dereference while splitting the message...

CVE-2017-15723

In Irssi before 1.0.5, overlong nicks or targets may result in a NULL pointer dereference while splitting the message...

PT-2017-14157

Name of the Vulnerable Software and Affected Versions Irssi versions prior to 1.0.5 Description The issue occurs when overlong nicks or targets are processed, resulting in a NULL pointer dereference while splitting the message. This can happen in Irssi when the software attempts to handle...

CVE-2017-15723: NULL Pointer Dereference

In Irssi before 1.0.5, overlong nicks or targets may result in a NULL pointer dereference while splitting the message...

UBUNTU-CVE-2017-15723

In Irssi before 1.0.5, overlong nicks or targets may result in a NULL pointer dereference while splitting the message...

Code injection

Octopus before 3.17.7 allows attackers to obtain sensitive cleartext information by reading a variable JSON file in certain situations involving Offline Drop Targets...

CVE-2017-15609

Octopus before 3.17.7 allows attackers to obtain sensitive cleartext information by reading a variable JSON file in certain situations involving Offline Drop Targets...

CVE-2017-15609

Octopus Deploy is affected under CVE-2017-15609 up to version 3.17.7. The vulnerability, described by OpenVAS as: “Octopus allows attackers to obtain sensitive cleartext information by reading a variable JSON file in certain situations involving Offline Drop Targets,” stems from reading an insecu...

PT-2017-14128

Name of the Vulnerable Software and Affected Versions Octopus versions prior to 3.17.7 Description The issue allows attackers to obtain sensitive cleartext information by reading a variable JSON file in certain situations involving Offline Drop Targets. Recommendations For versions prior to 3.17....

CVE-2017-15609: Missing Encryption of Sensitive Data

Octopus before 3.17.7 allows attackers to obtain sensitive cleartext information by reading a variable JSON file in certain situations involving Offline Drop Targets...

Q2 2017 Global DDoS Threat Landscape Report

This week we released our latest Global DDoS Threat Landscape Report, a statistical analysis of more than 15,000 network and application layer DDoS attacks mitigated by Imperva Incapsula services during Q2 2017. This quarter, for the fifth one in a row, we saw a decrease in the number of network...