EUVD-2021-1123

Malware in sbrugna...

EUVD-2019-0196

Malware in sbrugna...

EUVD-2015-3307

Malware in sbrugna...

EUVD-2022-5087

Malicious code in bioql PyPI...

EUVD-2022-5184

Malicious code in bioql PyPI...

Security Bulletin: IBM Operations Analytics - Log Analysis is affected by a potential denial of service attack due to Apache Thrift

Summary Apache Thrift is used by IBM Operations Analytics - Log Analysis as part of the Remote Procedure Call interface in Apache Solr. CVE-2020-13949 Vulnerability Details CVEID:CVE-2020-13949 DESCRIPTION: In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which...

Linux Distros Unpatched Vulnerability : CVE-2016-5397

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache...

Security Bulletin: IBM Security Guardium Insights is affected by multiple vulnerabilities

Summary IBM Security Guardium Insights has addressed the following vulnerabilities Vulnerability Details CVEID:CVE-2020-13949 DESCRIPTION: Apache Thrift is vulnerable to a denial of service, caused by improper input validation. By sending specially-crafted messages, a remote attacker could exploi...

Linux Distros Unpatched Vulnerability : CVE-2020-13949

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial...

Facebook Thrift 安全漏洞

Facebook Thrift is a fork of Apache Thrift, a serialization and RPC framework for service communication from Facebook, USA. A security vulnerability exists in versions prior to Facebook Thrift v2024.09.09.00, which stems from reuse after release and could cause an application crash...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to Apache Thrift denial of service vulnerability [CVE-2020-13949]

Summary Potential Apache Thrift denial of service vulnerability CVE-2020-13949 have been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. The vulnerability have been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2020-13949...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to Apache Thrift security bypass vulnerability[ CVE-2018-1320]

Summary Potential Apache Thrift security bypass vulnerability CVE-2018-1320 have been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. The vulnerability have been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2018-1320...

Advisory ROSA-SA-2023-2270

software: thrift 0.10.0 WASP: ROSA-CHROME packageevrstring: thrift-0.10.0-18.src.rpm CVE-ID: CVE-2018-1320 BDU-ID: 2019-04255 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the org.apache.thrift.transport.TSaslTransport class of the Apache Thrift interface description language is related to...

Exploit for Command Injection in Vmware Aria_Operations_For_Networks

CVE-2023-20887 POC for CVE-2023-20887 VMWare Aria Operations f...

Security Bulletin: Multiple vulnerabilities in libthrift affect IBM Application Performance Management products

Summary libthrift jar is used by IBM Application Performance Management. Vulnerability Details CVEID:CVE-2018-1320 DESCRIPTION: Apache Thrift could allow a remote attacker to bypass security restrictions, caused by the disablement of an assert used to determine if the SASL handshake had...

Metasploit Weekly Wrap up

Unauthenticated RCE in VMware Product This week, community contributor h00die added an exploit module that leverages a command injection vulnerability in VMWare Aria Operations for Networks, formerly known as vRealize Network Insight. Versions 6.2 to 6.10 are vulnerable CVE-2023-20887. A remote...

VMWare Aria Operations For Networks Remote Command Execution Exploit

VMWare Aria Operations for Networks vRealize Network Insight is vulnerable to command injection when accepting user input through the Apache Thrift RPC interface. This vulnerability allows a remote unauthenticated attacker to execute arbitrary commands on the underlying operating system as the ro...

VMWare Aria Operations For Networks Remote Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'VMWare Aria Operations for Networks vRealize Network Insight pre-authenticated RCE', 'Description' = %q VMWare Aria Operations for Networks...

Security Bulletin: Vulnerability of Apache Thrift (libthrift-0.12.0.jar ) have affected APM WebSphere Application Server Agent , APM SAP NetWeaver Agent and APM WebLogic Agent

Summary APM WebSphere Application Server Agent, APM SAP NetWeaver Agent and APM WebLogic Agent is vulnerable to Apache Thrift libthrift-0.12.0.jar CVE-2019-0205. The fix for WebSphere Application Server Agent and SAP NetWeaver Agent includes libthrift-0.12.0.jar upgraded to libthrift-0.17.0.jar,...

The Bug Report - June 2023 Edition

The Bug Report – June 2023 Edition By Trellix · July 05, 2023 This story was also written by Jesse Chick. Can I have a word with the developers who greenlit these vulns? Why am I here? "To our newcomers, welcome! To our old hands, welcome back!" Iykyk. Every month, we chronicle the disruptive new...