GHSA-63CJ-3R94-234V Persistent XSS vulnerability in Jenkins DRY Plugin

The custom Details view of the Static Analysis Utilities based DRY Plugin, was vulnerable to a persisted cross-site scripting vulnerability: Malicious users able to influence the input to this plugin could insert arbitrary HTML into this view...

MAL-2022-3359 Malicious code in gfg-security-utilities (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 09b1baa087e5a15e5191847e961ff42d2590015816e2d532ceb01dbbe5c65264 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

[SECURITY] Fedora 35 Update: ecdsautils-0.4.1-1.fc35

This collection of ECDSA utilities can be used to sign and verify data in a simple manner...

Fedora: Security Advisory for ecdsautils (FEDORA-2022-111177a5ac)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 36 Update: ecdsautils-0.4.1-1.fc36

This collection of ECDSA utilities can be used to sign and verify data in a simple manner...

GHSA-3QH2-MCCC-Q5M6 Keycloak Open Redirect

A flaw was found in JBOSS Keycloak 3.2.1.Final. The Redirect URL for both Login and Logout are not normalized in org.keycloak.protocol.oidc.utils.RedirectUtils before the redirect url is verified. This can lead to an Open Redirection attack...

RLSA-2022:2081 Low: bluez security update

The bluez packages contain the following utilities for use in Bluetooth applications: hcitool, hciattach, hciconfig, bluetoothd, l2ping, start scripts Rocky Enterprise Software Foundation, and pcmcia configuration files. Security Fixes: bluez: memory leak in the SDP protocol CVE-2021-41229 For mo...

cifs-utils through 6.14 with verbose logging can cause an information leak when a file contains = (equal sign) characters but is not a valid credentials file.

...

[SECURITY] Fedora 36 Update: golang-x-debug-0-0.13.20210123gitc934e1b.fc36

This repository holds utilities and libraries for debugging Go programs...

Cyberespionage APT Now Identified as Three Separate Actors

A threat group responsible for sophisticated cyberespionage attacks against U.S. utilities is actually comprised of three subgroups, all with their own toolsets and targets, that have been operating globally since 2018, researchers have found. TA410 is a cyberespionage umbrella group loosely link...

DEBIAN-CVE-2022-29869

cifs-utils through 6.14, with verbose logging, can cause an information leak when a file contains = equal sign characters but is not a valid credentials file...

CVE-2022-29869

cifs-utils through 6.14, with verbose logging, can cause an information leak when a file contains = equal sign characters but is not a valid credentials file...

UBUNTU-CVE-2022-29869

cifs-utils through 6.14, with verbose logging, can cause an information leak when a file contains = equal sign characters but is not a valid credentials file...

AZL-9587 CVE-2022-27239 affecting package cifs-utils for versions less than 6.14-2

In cifs-utils through 6.14, a stack-based buffer overflow when parsing the mount.cifs ip= command-line argument could lead to local attackers gaining root privileges...

CVE-2022-27239

In cifs-utils through 6.14, a stack-based buffer overflow when parsing the mount.cifs ip= command-line argument could lead to local attackers gaining root privileges...

DEBIAN-CVE-2022-27239

In cifs-utils through 6.14, a stack-based buffer overflow when parsing the mount.cifs ip= command-line argument could lead to local attackers gaining root privileges...

UBUNTU-CVE-2022-27239

In cifs-utils through 6.14, a stack-based buffer overflow when parsing the mount.cifs ip= command-line argument could lead to local attackers gaining root privileges...

Implications of Windows Subsystem for Linux for Adversaries & Defenders (Part 2)

This post is the second of a multi-part blog series that explores and highlights the different risks that Windows Subsystem for Linux WSL poses to an enterprise IT environment. Here we examine different TTPs that abuse WSL and assess different methods to defend against such threats. ← Go to Part ...

USN-5378-2 xz-utils vulnerability

Cleemy Desu Wayo discovered that XZ Utils incorrectly handled certain filenames. If a user or automated system were tricked into performing xzgrep operations with specially crafted filenames, a remote attacker could overwrite arbitrary files...

Security Bulletin: IBM Maximo Asset Management is vulnerable to Java Deserialization (CVE-2020-4521)

Summary IBM Maximo Asset Management is vulnerable to Java Deserialization. Vulnerability Details CVEID:CVE-2020-4521 DESCRIPTION: IBM Maximo Asset Management could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization in Java. By sendin...