container-tools:2.0 security update

buildah 1.11.6-8.0.1 - Reduce unnecessary writable mounts in NaiveDiffDriver Orabug: 31025483 - Fixes troubles with oracle registry login Orabug: 29937283 1.11.6-8 - exclude i686 arch - Related: 1821193 1.11.6-7 - fix 'CVE-2020-10696 buildah: crafted input tar file may lead to local file...

WP File Manager < 7.1 - Reflected Cross-Site Scripting (XSS)

During a quick security auditing of the plugin, in the default configuration a Reflected XSS can occur on the endpoint /wp-admin/admin.php?page=wpfilemanagerproperties when a payload is submitted on the User-Agent parameter. The payload is then reflected back on the web application response...

Remote Desktop Web Access - Authentication Timing Attack (Metasploit Module)

!/usr/bin/env python3 -- coding: utf-8 -- standard modules from metasploit import module extra modules DEPENDENCIESMISSING = False try: import base64 import itertools import os import requests except ImportError: DEPENDENCIESMISSING = True Metasploit Metadata metadata = 'name': 'Microsoft RDP Web...

Denial of Service

Overview Impact Some regexes are vulnerable to regular expression denial of service REDoS due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTPS request to maliciously crafted long strings. Patches Please update uap-core t...

OpenText Content Server 20.3 - multiple Stored Cross-Site Scripting Vulnerabilities

Exploit Title: OpenText Content Server 20.3 - 'multiple' Stored Cross-Site Scripting Exploit Author: Kamil Breński Vendor Homepage: https://www.opentext.com/ Software Link: https://www.opentext.com/products-and-solutions/products/enterprise-content-management/content-management Version: 20.3...

CVE-2021-21317

uap-core in an open-source npm package which contains the core of BrowserScope's original user agent string parser. In uap-core before version 0.11.0, some regexes are vulnerable to regular expression denial of service REDoS due to overlapping capture groups. This allows remote attackers to...

UBUNTU-CVE-2021-21317

uap-core in an open-source npm package which contains the core of BrowserScope's original user agent string parser. In uap-core before version 0.11.0, some regexes are vulnerable to regular expression denial of service REDoS due to overlapping capture groups. This allows remote attackers to...

CVE-2021-21317

uap-core in an open-source npm package which contains the core of BrowserScope's original user agent string parser. In uap-core before version 0.11.0, some regexes are vulnerable to regular expression denial of service REDoS due to overlapping capture groups. This allows remote attackers to...

CVE-2021-21317: Uncontrolled Resource Consumption

uap-core in an open-source npm package which contains the core of BrowserScope's original user agent string parser. In uap-core before version 0.11.0, some regexes are vulnerable to regular expression denial of service REDoS due to overlapping capture groups. This allows remote attackers to...

Shopify: Blind Stored XSS in shopify internal Parquet Viewer

A blind stored XSS vulnerability was found in a Shopify internal tool called Parquet Viewer. On February 14th, an XSS payload fired on an employee's computer. The vulnerable page was accessed locally on the employee's machine. The employee's IP address and user-agent indicate they were using a Ma...

PT-2021-28053

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow read crash has been reported. The crash involves the following functions: http process user agent, process chlo, and ndpi search qui...

Regular Expression Denial Of Service (ReDoS)

uap-core is vulnerable to regular expression denial of service. The vulnerability exists in regexes.yaml as a malicious user can set the User-Agent header in an HTTPS request with a long digit string to overload a server...

Denial of Service in uap-core

Impact Some regexes are vulnerable to regular expression denial of service REDoS due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTPS request to maliciously crafted long strings. Patches Please update uap-core to = v0.11...

PT-2021-14414 · Uap-Core · Uap-Core

Name of the Vulnerable Software and Affected Versions: uap-core versions prior to 0.11.0 Description: The issue concerns regular expression denial of service REDoS due to overlapping capture groups in some regexes. This allows remote attackers to overload a server by setting the User-Agent header...

Quick.CMS 6.7 Remote Code Execution

Exploit Title: Quick.CMS 6.7 - Remote Code Execution Authenticated Date: 2020-12-28 Exploit Author: mari0x00 Vendor Homepage: https://opensolution.org/ Software Link: https://opensolution.org/download/?sFile=Quick.Cmsv6.7-pl.zip Description:...

SonicWall SSL-VPN Security Vulnerabilities

sonicwall ssl-vpn sonicwall ssl-vpn,vpn is a Vpn connectivity solution from SonicWALL Sonicwall. This product is used for remote secure connections. SonicWallSSL-VPN 8.0.0.4 before the version of the security vulnerabilities, remote attackers use the CGI program to deal with logical...

CVE-2020-29016

creationtimestamp| type| source ---|---|--- 2021-01-14 18:49:53+00:00| seen| https://t.me/cibsecurity/22170...

PT-2020-11253

Name of the Vulnerable Software and Affected Versions NukeViet versions prior to 4.3.04 Description The issue concerns a SQL INSERT statement in the click.php file within the modules/banners/funcs directory of NukeViet. This statement inserts raw header data from an HTTP request, including the...

Vinades NukeViet SQL注入漏洞

Vinades NukeViet is an open source content management system CMS from Vinades Vietnam.Vinades NukeViet is vulnerable to a SQL injection vulnerability that originates from a SQL INSERT statement containing raw header data e.g., Referer and User-Agent from HTTP requests. No detailed vulnerability...

Microsoft RDP Web Client Login Enumeration

Enumerate valid usernames and passwords against a Microsoft RDP Web Client by attempting authentication and performing a timing based check against the provided username. Module Options msf use auxiliary/scanner/http/rdp/weblogin msf undefinedweblogin show actions ...actions... msf...