CVE-2022-0154

An issue has been discovered in GitLab affecting all versions starting from 7.7 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0 before 14.6.2. GitLab was vulnerable to a Cross-Site Request Forgery attack that allows a malicious user to have their...

What is API Abuse ❓ Prevention measures.

APIs are paramount for constructing a steadfast and constant communication bridge that empowers devices to pass-on desired information seamlessly. Hackers adopt many ways to exploit the APIs and corrupt the targeted device. This API exploitation is a potential threat to API security and needs...

Moderate: Red Hat Security Advisory: EAP XP 2 security update to CVE fixes in the EAP 7.3.x base

This advisory resolves CVE issues filed against XP2 releases that have been fixed in the underlying EAP 7.3.x base. There are no changes to the EAP XP2 code base. NOTE: This advisory is informational only. There are no code changes associated with it. No action is required. Red Hat Product Securi...

CVE-2021-42559

An issue was discovered in CALDERA 2.8.1. It contains multiple startup "requirements" that execute commands when starting the server. Because these commands can be changed via the REST API, an authenticated user can insert arbitrary commands that will execute when the server is restarted...

Mozilla: Browser window spoof using fullscreen mode

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as: When navigating from inside an iframe while requesting full screen access, an attacker-controlled tab could have made the browser unable to leave full screen mode...

CVE-2022-20614

CVE-2022-20614 affects Jenkins Mailer Plugin 391.ve4a_38c1b_cf4b_ and earlier. The issue is a missing permission check that allows attackers with Overall/Read access to cause the Jenkins instance DNS to resolve an attacker‑specified hostname, potentially leaking information or enabling attacker‑c...

Abuse and Fraud Prevention's Co-Created Future — Predictions for 2022 and Beyond

Explore some of the Akamai Abuse and Fraud Prevention team’s predictions for the future of abuse and fraud protection in 2022 and beyond...

CVE-2021-25994

In Userfrosting, versions v0.3.1 to v4.6.2 are vulnerable to Host Header Injection. By luring a victim application user to click on a link, an unauthenticated attacker can use the “forgot password” functionality to reset the victim’s password and successfully take over their account...

CVE-2021-20134

Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 are affected by an absolute path traversal vulnerability that allows a remote, authenticated attacker to set an arbitrary file on the router's filesystem as the log file used by either Quagga service zebra or ripd. Subsequen...

Avast Antivirus Access Control Error Vulnerability

Avast antivirus is a suite of antivirus software from the Czech company Avast.Avast Antivirus has an access control error vulnerability in versions prior to 20.4, which can be exploited by attackers to abuse the privilege to control the scan results and thus escape detection or delete arbitrary...

CVE-2021-45335

CVE-2021-45335 affects Avast Antivirus: the sandbox component prior to version 20.4 has an insecure permission, enabling a local user to influence scan outcomes and potentially evade detection or delete arbitrary system files. Affected product is Avast Antivirus (sandbox module); root cause is an...

PT-2022-4988 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: MediaWiki versions 1.35.5 and earlier, 1.36.x before 1.36.3, 1.37.x before 1.37.1 Description: The issue is related to the mishandling of the EditFilterMergedContent hook return value in the Special:ChangeContentModel function. This can allow...

An issue in Atomix v3.1.5 allows a malicious Atomix node to remove states of ONOS storage via abuse of primitive operations.

An issue in Atomix v3.1.5 allows a malicious Atomix node to remove states of ONOS storage via abuse of primitive operations...

CVE-2020-35214

An issue in Atomix v3.1.5 allows a malicious Atomix node to remove states of ONOS storage via abuse of primitive operations...

llhttp: HTTP Request Smuggling when parsing the body of chunked requests

An HTTP Request Smuggling HRS vulnerability was found in the llhttp library, used by Node.JS. During the parsing of chunked messages, the chunk size parameter was not validated properly. In situations where HTTP conversations are being proxied such as proxy, reverse-proxy, load-balancer, an...

Lame cache can be abused to severely degrade resolver performance

...

CVE-2021-44023

A link following denial-of-service DoS vulnerability in the Trend Micro Security Consumer 2021 familiy of products could allow an attacker to abuse the PC Health Checkup feature of the product to create symlinks that would allow modification of files which could lead to a denial-of-service...

CVE-2021-44023

A link following denial-of-service DoS vulnerability in the Trend Micro Security Consumer 2021 familiy of products could allow an attacker to abuse the PC Health Checkup feature of the product to create symlinks that would allow modification of files which could lead to a denial-of-service...

CVE-2021-44023

A link following denial-of-service DoS vulnerability in the Trend Micro Security Consumer 2021 familiy of products could allow an attacker to abuse the PC Health Checkup feature of the product to create symlinks that would allow modification of files which could lead to a denial-of-service...

CVE-2021-44023

CVE-2021-44023 affects Trend Micro Security (Consumer) 2021 family. The issue arises in the PC Health Checkup feature, where an attacker who can run code locally and with low privileges can abuse the feature to create symbolic links via the Platinum Host Service, enabling modification of files an...