Circumvention of file size limits in ActiveStorage

There is a vulnerability in ActiveStorage's S3 adapter that allows the Content-Length of a direct file upload to be modified by an end user. Versions Affected: rails = 5.2.4.3, rails = 6.0.3.1 Impact ------ Utilizing this vulnerability, an attacker can control the Content-Length of an S3 direct...

GHSA-M42X-37P3-FV5W Circumvention of file size limits in ActiveStorage

There is a vulnerability in ActiveStorage's S3 adapter that allows the Content-Length of a direct file upload to be modified by an end user. Versions Affected: rails = 5.2.4.3, rails = 6.0.3.1 Impact ------ Utilizing this vulnerability, an attacker can control the Content-Length of an S3 direct...

keycloak: adapter endpoints are exposed via arbitrary URLs

It was found that keycloak exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. This vulnerability could allow an attacker to access unauthorized information...

Circumvention of file size limits in ActiveStorage

There is a vulnerability in ActiveStorage's S3 adapter that allows the Content-Length of a direct file upload to be modified by an end user. Versions Affected: rails = 5.2.4.3, rails = 6.0.3.1 Impact ------ Utilizing this vulnerability, an attacker can control the Content-Length of an S3 direct...

Intel® PROSet/Wireless WiFi Software x < 21.70.0 Multiple Vulnerabilities

A wireless network adapter driver on the remote host is affected by multiple security vulnerabilities: - Insecure inherited permissions in IntelR PROSet/Wireless WiFi products before version 21.70 on Windows 10 may allow an authenticated user to potentially enable escalation of privilege via loca...

kernel: Kernel: Memory leak in IPMI SSIF module leads to Denial of Service

A flaw was found in the Linux kernel's Intelligent Platform Management Interface IPMI SSIF module. A local user can exploit this vulnerability by repeatedly calling the ssifinfofind function. This improper handling of memory allocation leads to a memory leak, which can result in a Denial of Servi...

UPS Adapter CS141 Path Traversal Vulnerability

GENEREX UPS Adapter CS141 is a UPS Uninterruptible Power System adapter from GENEREX Germany. A path traversal vulnerability exists in GENEREX UPS Adapter CS141 versions prior to 1.90. The vulnerability stems from a failure of a networked system or product to properly filter special elements in t...

CVE-2020-11420

UPS Adapter CS141 before 1.90 allows Directory Traversal. An attacker with Admin or Engineer login credentials could exploit the vulnerability by manipulating variables that reference files and by doing this achieve access to files and directories outside the web root folder. An attacker may acce...

Directory traversal

UPS Adapter CS141 before 1.90 allows Directory Traversal. An attacker with Admin or Engineer login credentials could exploit the vulnerability by manipulating variables that reference files and by doing this achieve access to files and directories outside the web root folder. An attacker may acce...

CVE-2020-11420

CVE-2020-11420 affects GENEREX UPS Adapter CS141 prior to v1.90. Affected component: path handling in the CS141 web-facing interface which allows Directory Traversal. Attack scenario: an attacker with Admin or Engineer credentials can manipulate variables that reference files to access arbitrary ...

CVE-2020-11420

UPS Adapter CS141 before 1.90 allows Directory Traversal. An attacker with Admin or Engineer login credentials could exploit the vulnerability by manipulating variables that reference files and by doing this achieve access to files and directories outside the web root folder. An attacker may acce...

NETGEAR DST6501 and WNR2000 Information Disclosure Vulnerability

NETGEAR WNR2000 and NETGEAR DST6501 are both products of NETGEAR, Inc. NETGEAR WNR2000 is a wireless router and NETGEAR DST6501 is a wireless extender adapter.NETGEAR DST6501 versions prior to 1.1.0.6 and A security vulnerability exists in versions prior to WNR2000v2 1.2.0.8. An attacker could...

Malicious Package

Overview activerecordjdbcsplice-adapter is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid...

Malicious Package

Overview ardmsqlite-adapter is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using...

Remote Code Execution Vulnerability in Weblogic WlsSSLAdapter

Oracle WebLogic Server is a Java application server that fully implements the J2EE 1.5 specification, the latest Web services standards, and the highest level of interoperability standards. A remote code execution vulnerability exists in Weblogic WlsSSLAdapter, which can be exploited by an attack...

STOP Error 0x0000009F in DRIVER_POWER_STATE_FAILURE on Windows 8.1 when your computer resumes from sleep mode

STOP Error 0x0000009F in DRIVERPOWERSTATEFAILURE on Windows 8.1 when your computer resumes from sleep mode Symptoms Symptom 1 On a computer that's running Windows 8.1, you may receive a Stop error 0x0000009F in DRIVERPOWERSTATEFAILURE error message when your computer resumes from sleep mode...

CVE-2020-5862

On BIG-IP 15.1.0-15.1.0.1, 15.0.0-15.0.1.1, and 14.1.0-14.1.2.2, under certain conditions, TMM may crash or stop processing new traffic with the DPDK/ENA driver on AWS systems while sending traffic. This issue does not affect any other platforms, hardware or virtual, or any other cloud provider...

Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Apple Ipados

kr00ker ============ Description This script is a simple ex...

VMware vRealize Operations for Horizon Adapter Multiple Vulnerabilities (VMSA-2020-0003) (disabled)

Due to a deteciton issue this plugin has been temporarily disabled. C Tenable Network Security, Inc. @DEPRECATED@ Disabled on 05/19/2020. Temporarly disabled to address detection issues. include'compat.inc'; if description scriptid134163; scriptversion"1.3";...

vRealize Operations for Horizon Adapter Authentication Bypass Vulnerability

VMware vRealize Operations is operations management software that spans physical, virtual, and cloud environments and supports network environments based on vSphere, Hyper-V, or Amazon Web Services. A security vulnerability exists in vRealize Operations for Horizon Adapter versions 6.7.x before...