CVE-2022-23639

crossbeam-utils provides atomics, synchronization primitives, scoped threads, and other utilities for concurrent programming in Rust. crossbeam-utils prior to version 0.8.7 incorrectly assumed that the alignment of i,u64 was always the same as AtomicI,U64. However, the alignment of i,u64 on a...

GHSA-47WR-426J-FR82 Symbolic links in an unpacking routine may enable attackers to read and/or write to arbitrary locations in dbdeployer

Impact Users unpacking a tarball through dbdeployer may use a maliciously packaged tarball that contains symlinks to files external to the target. In such scenario, an attacker could induce dbdeployer to write into a system file, thus altering the computer defences. Mitigating factors For the...

SAP NetWeaver Application Server ABAP and ABAP Platform信息泄露漏洞

SAP NetWeaver Application Server is an application server from SAP, Germany.An information disclosure vulnerability exists in SAP NetWeaver Application Server ABAP and ABAP Platform, which can be exploited by attackers to read connection details stored in SAP The vulnerability can be exploited to...

SAP NetWeaver Application Server 信息泄露漏洞

SAP NetWeaver Application Server is an application server from SAP, Germany.An information disclosure vulnerability exists in SAP NetWeaver Application Server ABAP and ABAP Platform, which can be exploited by attackers to read connection details stored in SAP The vulnerability can be exploited to...

SocialPwned - An OSINT Tool That Allows To Get The Emails, From A Target, Published In Social Networks Such As Instagram, Linkedin And Twitter To Find Possible Credentials Leaks In PwnDB Or Dehashed And Obtain Google Account Information Via GHunt

SocialPwned is an OSINT tool that allows to get the emails, from a target, published in social networks like Instagram, Linkedin and Twitter to find the possible credential leaks in PwnDB or Dehashed and obtain Google account information via GHunt. The purpose of this tool is to facilitate the...

RUSTSEC-2022-0041 Unsoundness of AtomicCell<*64> arithmetics on 32-bit targets that support Atomic*64

Impact Affected versions of this crate incorrectly assumed that the alignment of i,u64 was always the same as AtomicI,U64. However, the alignment of i,u64 on a 32-bit target can be smaller than AtomicI,U64. This can cause the following problems: - Unaligned memory accesses - Data race Crates usin...

PT-2022-4836 · Unknown +2 · Crossbeam-Utils +2

Name of the Vulnerable Software and Affected Versions: crossbeam-utils versions prior to 0.8.7 Description: The issue is related to the alignment of i,u64 and AtomicI,U64 in crossbeam-utils, which can cause unaligned memory accesses and data race on 32-bit targets. Crates using fetch methods with...

Server side request forgery (ssrf)

A CWE-918 Server-Side Request Forgery SSRF vulnerability exists that could cause the station web server to forward requests to unintended network targets when crafted malicious parameters are submitted to the charging station web server. Affected Products: EVlink City EVC1S22P4 / EVC1S7P4 All...

CVE-2022-0243

Cross-site Scripting XSS - Stored in NuGet OrchardCore.Application.Cms.Targets prior to 1.2.2...

CVE-2022-0274

Cross-site Scripting XSS - Stored in NuGet OrchardCore.Application.Cms.Targets prior to 1.2.2...

Cross site scripting

Cross-site Scripting XSS - Stored in NuGet OrchardCore.Application.Cms.Targets prior to 1.2.2...

CVE-2022-0274

CVE-2022-0274 : A stored cross-site scripting (XSS) vulnerability exists in Orchard Core’s NuGet package OrchardCore.Application.Cms.Targets before 1.2.2. The issue arises from user-controlled input being stored and later reflected in a way that allows arbitrary script execution. Affected compone...

How Can You Leave Log4J in 2021?

With the last month of 2021 dominated by the log4J vulnerabilities discovery, publication, and patches popping up in rapid succession, odds are you have patched your system against Log4J exploitation attempts. At least some systems, if not all. You might even have installed the latest patch – at...

Night Sky: the new corporate ransomware demanding a sky high ransom

Theres a new ransomware in town—isnt there always?—and its, unsurprisingly, after corporation-sized businesses. Its called Night Sky, and it was first spotted and revealed by MalwareHunterTeam, a group on Twitter who hunts malware online, on the first day of 2022. First day of the year, and a new...

LoRaWAN's Protocol Stacks: The Forgotten Targets at Risk

This report is the fourth part of our LoRaWAN security series, and highlights an attack vector that, so far, has not attracted much attention: the LoRaWAN stack. The stack is the root of LoRaWAN implementation and security. We hope to help users secure it and make LoRaWAN communication resistant ...

[SECURITY] Fedora 34 Update: log4j-2.17.1-1.fc34

Log4j is a tool to help the programmer output log statements to a variety of output targets...

[SECURITY] Fedora 34 Update: log4j-2.17.0-1.fc34

Log4j is a tool to help the programmer output log statements to a variety of output targets...

PT-2021-8129 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to the dbgfs component of the Linux kernel and is caused by incorrect locking. This can lead to a use after free bug when the monitoring targets are destroyed...

Malicious code in dbp-polyfills (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 4f59dcb33c6b979c2571b136278d2a4dbb77c122506b74f77ed0bc422fed824a Malicious packages campaign since 2021 targeting developers, steals source code and secrets...

h1-ctf: Saving Christmas from Grinchy Gods

It was a fun CTF to play had some good learning on thinking of how to approach real world targets and more things we can try while testing any target , some nudges were good and reminded of scenarios of actual microservices are built where these security issues can be present huge shoutouts to Ad...