PT-2023-24114 · Jenkins · Jenkins Pipeline Utility Steps Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Pipeline Utility Steps Plugin versions 2.15.2 and earlier Description: The issue allows attackers to create or replace arbitrary files on the agent file system with attacker-specified content by providing crafted archives as parameter...

php: phar: infinite loop when decompressing quine gzip file

A vulnerability was found in PHP due to an infinite loop within the phar uncompressor code when processing "quines" gzip files. This vulnerability allows a remote attacker to pass a specially crafted archive to the application, and consume all available system resources, causing a denial of servi...

Rekor 安全漏洞

Rekor is open source software that provides an immutable, tamper-proof ledger for metadata generated in the supply chain of software projects. A security vulnerability exists in versions of Rekor prior to 1.1.1, which stems from reading archived metadata files into memory without first checking t...

maryknollmissionarchives.libraryhost.com Cross Site Scripting vulnerability OBB-3296140

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

typecho 跨站脚本漏洞

typecho is a PHP blogging platform for typecho individual developers. It is simple and powerful. A security vulnerability exists in typecho v1.2.0, which can be exploited by an attacker to execute arbitrary web script or HTML using a crafted payload via the url parameter in...

PT-2023-23359 · Unknown · Cauldron Cbang

Name of the Vulnerable Software and Affected Versions: Cauldron cbang versions prior to bastet-v8.1.17 Description: The issue allows for directory traversal during extraction, enabling an attacker to create or write to files outside the current directory by using a crafted tar archive. This is du...

DEBIAN-CVE-2023-29415

An issue was discovered in libbzip3.a in bzip3 before 1.3.0. A denial of service process hang can occur with a crafted archive because bzip3 does not follow the required procedure for interacting with libsais...

PT-2023-22243 · Bzip3 · Bzip3

Name of the Vulnerable Software and Affected Versions: bzip3 versions prior to 1.3.0 Description: An issue was discovered in libbzip3.a in bzip3. A denial of service process hang can occur with a crafted archive because bzip3 does not follow the required procedure for interacting with libsais...

Hackers Using Self-Extracting Archives Exploit for Stealthy Backdoor Attacks

An unknown threat actor used a malicious self-extracting archive SFX file in an attempt to establish persistent backdoor access to a victim's environment, new findings from CrowdStrike show. SFX files are capable of extracting the data contained within them without the need for dedicated software...

Researchers Uncover Chinese Nation State Hackers' Deceptive Attack Strategies

A recent campaign undertaken by Earth Preta indicates that nation-state groups aligned with China are getting increasingly proficient at bypassing security solutions. The threat actor, active since at least 2012, is tracked by the broader cybersecurity community under Bronze President, HoneyMyte,...

Important: golang

Issue Overview: A vulnerability was found in archive/zip of the Go standard library. Applications written in Go can panic or potentially exhaust system memory when parsing malformed ZIP files. CVE-2021-33196 A validation flaw was found in golang. When invoking functions from WASM modules built...

CVE-2022-48309

A CSRF vulnerability allows malicious websites to retrieve logs and technical support archives in Sophos Connect versions older than 2.2.90...

CVE-2022-48310

An information disclosure vulnerability allows sensitive key material to be included in technical support archives in Sophos Connect versions older than 2.2.90...

Cross site request forgery (csrf)

A CSRF vulnerability allows malicious websites to retrieve logs and technical support archives in Sophos Connect versions older than 2.2.90...

Information disclosure

An information disclosure vulnerability allows sensitive key material to be included in technical support archives in Sophos Connect versions older than 2.2.90...

CVE-2022-48310

An information disclosure vulnerability allows sensitive key material to be included in technical support archives in Sophos Connect versions older than 2.2.90...

CVE-2022-48309

A CSRF vulnerability allows malicious websites to retrieve logs and technical support archives in Sophos Connect versions older than 2.2.90...

PT-2023-15689 · Sophos · Sophos Connect

Name of the Vulnerable Software and Affected Versions: Sophos Connect versions prior to 2.2.90 Description: An information disclosure issue allows sensitive key material to be included in technical support archives. Recommendations: For Sophos Connect versions prior to 2.2.90, update to version...

CVE-2022-48309

A CSRF vulnerability allows malicious websites to retrieve logs and technical support archives in Sophos Connect versions older than 2.2.90...

CVE-2022-48310

Sophos Connect has an information disclosure vulnerability affecting versions earlier than 2.2.90, where sensitive key material can be included in technical support archives. This issue is confirmed across multiple sources (e.g., Red Hat, PT Security, CVE records) and is resolved by upgrading to ...