Bref 安全漏洞

Bref is an open source project by Matthieu Napoli Individual Developer that helps you go serverless on AWS using PHP. A security vulnerability exists in versions prior to Bref 2.1.17, which stems from the fact that an attacker can send specially designed requests that force the server to perform...

AndroxGh0st Malware Targets Laravel Apps to Steal Cloud Credentials

Cybersecurity researchers have shed light on a tool referred to as AndroxGh0st that's used to target Laravel applications and steal sensitive data. "It works by scanning and taking out important information from .env files, revealing login details linked to AWS and Twilio," Juniper Threat Labs...

Important: rust

Issue Overview: RUSTSEC-2024-0006 NOTE: https://rustsec.org/advisories/RUSTSEC-2024-0006.html NOTE: https://github.com/comex/rust-shlex/security/advisories/GHSA-r7qv-8r2h-pg27 Affected Packages: rust Issue Correction: Run dnf update rust --releasever 2023.4.20240319 or dnf update --advisory...

Amazon Linux 2023 : javapackages-bootstrap (ALAS2023-2024-561)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-561 advisory. Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0. Users are recommended to upgrade to...

Amazon Linux 2023 : wireshark-cli, wireshark-devel (ALAS2023-2024-567)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-567 advisory. An issue in Wireshark team Wireshark before v.4.2.0 allows a remote attacker to cause a denial of service via the packet-bgp.c, dissectbgpopentvbuffttvb, prototreetree, packetinfopinfo, optlen component...

Amazon Linux 2023 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2023-2024-569)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-569 advisory. A flaw was found in Node.js. On Linux, Node.js ignores certain environment variables if they have been set by an unprivileged user while the process is running with elevated privileges, with th...

Amazon Linux 2023 : openssh, openssh-clients, openssh-keycat (ALAS2023-2024-570)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-570 advisory. In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example,...

Amazon Linux 2023 : libsndfile, libsndfile-devel, libsndfile-utils (ALAS2023-2024-572)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-572 advisory. An off-by-one error in function wavreadheader in src/wav.c in Libsndfile 1.1.0, results in a write out of bound, which allows an attacker to execute arbitrary code, Denial of Service or other unspecifie...

Medium: nodejs

Issue Overview: NOTE: https://nodejs.org/en/blog/release/v18.19.1 NOTE: https://github.com/nodejs/node/commit/f31d47e135973746c4f490d5eb635eded8bb3dda v18.x NOTE: https://github.com/nodejs/node/commit/9052ef43dc2d1b0db340591a9bc9e45a25c01d90 main CVE-2024-22025 Undici is an HTTP/1.1 client, writt...

Amazon Linux 2023 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2023-2024-568)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-568 advisory. NOTE: https://nodejs.org/en/blog/release/v18.19.1NOTE: https://github.com/nodejs/node/commit/f31d47e135973746c4f490d5eb635eded8bb3dda v18.xNOTE:...

Amazon Linux 2023 : fontforge, fontforge-devel (ALAS2023-2024-565)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-565 advisory. Splinefont in FontForge through 20230101 allows command injection via crafted filenames. CVE-2024-25081 Splinefont in FontForge through 20230101 allows command injection via crafted archives or...

Amazon Linux 2023 : aws-nitro-enclaves-cli, aws-nitro-enclaves-cli-devel, aws-nitro-enclaves-cli-integration-tests (ALAS2023-2024-575)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-575 advisory. RUSTSEC-2024-0006 NOTE: https://rustsec.org/advisories/RUSTSEC-2024-0006.html NOTE: https://github.com/comex/rust-shlex/security/advisories/GHSA-r7qv-8r2h-pg27 Tenable has extracted the preceding...

Amazon Linux 2023 : c-ares, c-ares-devel (ALAS2023-2024-563)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-563 advisory. c-ares is a C library for asynchronous DNS requests. aresreadline is used to parse local configuration files such as /etc/resolv.conf, /etc/nsswitch.conf, the HOSTALIASES file, and if using a c-ares...

Amazon Linux 2023 : cargo, clippy, rust (ALAS2023-2024-574)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-574 advisory. RUSTSEC-2024-0006 NOTE: https://rustsec.org/advisories/RUSTSEC-2024-0006.html NOTE: https://github.com/comex/rust-shlex/security/advisories/GHSA-r7qv-8r2h-pg27 Tenable has extracted the preceding...

Amazon Linux 2023 : nodejs20, nodejs20-devel, nodejs20-full-i18n (ALAS2023-2024-562)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-562 advisory. c-ares is a C library for asynchronous DNS requests. aresreadline is used to parse local configuration files such as /etc/resolv.conf, /etc/nsswitch.conf, the HOSTALIASES file, and if using a c-ares...

Amazon Linux 2023 : apache-commons-compress, apache-commons-compress-javadoc (ALAS2023-2024-560)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-560 advisory. Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0. Users are recommended to upgrade to...

Amazon Linux 2023 : cargo, clippy, rust (ALAS2023-2024-566)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-566 advisory. libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted...

Amazon Linux 2023 : python3-rpm, rpm, rpm-apidocs (ALAS2023-2024-573)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-573 advisory. A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that were introduced in response to CVE-2017-7500 and CVE-2017-7501,...

Amazon Linux AMI : ImageMagick (ALAS-2024-1926)

The version of ImageMagick installed on the remote host is prior to 6.9.10.68-3.22. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2024-1926 advisory. Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial...

Low: grub2

Issue Overview: A flaw was found in the grub2-set-bootflag utility of grub2. After the fix of CVE-2019-14865, grub2-set-bootflag will create a temporary file with the new grubenv content and rename it to the original grubenv file. If the program is killed before the rename operation, the temporar...