PT-2025-54217

theshit is a command-line utility that automatically detects and fixes common mistakes in shell commands. Prior to version 0.1.1, the application loads custom Python rules and configuration files from user-writable locations e.g., /.config/theshit/ without validating ownership or permissions when...

matrix-sdk-base: Denial of service due to custom `m.room.join_rules` events

The matrix-sdk-base crate is unable to handle responses that include custom m.room.joinrules values due to a serialization bug. This can be exploited to cause a denial-of-service condition, if a user is invited to a room with non-standard join rules, the crate's sync process will stall, preventin...

Malicious code in eslint-plugin-custom-eslint-rules (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 290264bf054a89de7b611685ab2f5a9720fd03d6e90c3631d42bbef29259ec48 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1033 Malicious code in eslint-plugin-scp-custom-rules (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8860b8044f2adb9c969cdcf764976c8f9e110be9d0b0a03d095998595aec3938 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1032 Malicious code in eslint-config-scp-custom-rules (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 73a0feb02dac8e9a44d4dfef753d5e64e20660b0f07333ca0660f422036d468d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Streamlining OS and Application Hardening: Revealing Misconfigurations with Wiz’s Agentless Custom Host Configuration Rules

Shell commands that once had to be run manually now can be coded into a custom rule and run daily using Wiz agentless workload scanning...

CVE-2021-4038

Cross Site Scripting XSS vulnerability in McAfee Network Security Manager NSM prior to 10.1 Minor 7 allows a remote authenticated administrator to embed a XSS in the administrator interface via specially crafted custom rules containing HTML. NSM did not correctly sanitize custom rule content in a...

CVE-2021-4038

Cross Site Scripting XSS vulnerability in McAfee Network Security Manager NSM prior to 10.1 Minor 7 allows a remote authenticated administrator to embed a XSS in the administrator interface via specially crafted custom rules containing HTML. NSM did not correctly sanitize custom rule content in a...

CVE-2021-4038

Cross Site Scripting XSS vulnerability in McAfee Network Security Manager NSM prior to 10.1 Minor 7 allows a remote authenticated administrator to embed a XSS in the administrator interface via specially crafted custom rules containing HTML. NSM did not correctly sanitize custom rule content in a...

Cross site scripting

Cross Site Scripting XSS vulnerability in McAfee Network Security Manager NSM prior to 10.1 Minor 7 allows a remote authenticated administrator to embed a XSS in the administrator interface via specially crafted custom rules containing HTML. NSM did not correctly sanitize custom rule content in a...

CVE-2021-4038 NSM vulnerable to XSS

Cross Site Scripting XSS vulnerability in McAfee Network Security Manager NSM prior to 10.1 Minor 7 allows a remote authenticated administrator to embed a XSS in the administrator interface via specially crafted custom rules containing HTML. NSM did not correctly sanitize custom rule content in a...

PT-2021-5438 · Mcafee · Mcafee Network Security Management

Name of the Vulnerable Software and Affected Versions: McAfee Network Security Manager versions prior to 10.1 Minor 7 Description: The issue is related to a Cross Site Scripting XSS vulnerability that allows a remote authenticated administrator to embed a XSS in the administrator interface via...

HaE - BurpSuite Highlighter And Extractor

HaE is used to highlight HTTP requests and extract information from HTTP response messages or request messages. Read Chinese simplified version READMEzh. Public Rules Website: https://gh0st.cn/HaE/ Introduction HaE is used to highlight HTTP requests and extract information from HTTP response...

PT-2020-10042 · Esoms · Esoms

Name of the Vulnerable Software and Affected Versions: eSOMS versions 4.0 to 6.0.3 Description: The issue is related to the lack of password complexity settings enforcement, potentially leading to lower access security due to insecure user passwords. Recommendations: For eSOMS versions 4.0 to...

A Leader in the 2019 Gartner Magic Quadrant for WAF, Six Years Running

Gartner has published its 2019 Gartner Magic Quadrant for Web Application Firewalls WAF and Imperva has been named a Leader for the sixth consecutive year! Along with our WAF Gateways and easy-to-deploy Cloud WAF we recently added API Security, RASP, Account Takeover Protection, Bot Management, a...

eslint-utils Arbitrary Code Execution Vulnerability

eslint-utils is a utility for ESLint plugins and custom rules. An arbitrary code execution vulnerability exists in versions of eslint-utils prior to 1.4.1. An attacker can exploit this vulnerability to execute arbitrary code via the getStaticValue function...

HiddenWall - Linux Kernel Module Generator For Custom Rules With Netfilter (Block Ports, Hidden Mode, Rootkit Functions, Etc)

HiddenWall is a Linux kernel module generator for custom rules with netfilter. block ports, Hidden mode, rootkit functions etc. The motivation: on bad situation, attacker can put your iptables/ufw to fall... but if you have HiddenWall, the attacker will not find the hidden kernel module that bloc...

FTW - Framework For Testing WAFs

This project was created by researchers from ModSecurity and Fastly to help provide rigorous tests for WAF rules. It uses the OWASP Core Ruleset V3 as a baseline to test rules on a WAF. Each rule from the ruleset is loaded into a YAML file that issues HTTP requests that will trigger these rules...

What’s New in Wallarm

New features in Wallarm Cloud Dashboard At Wallarm, we subscribe to the continuous delivery methodology. Some of you may have already seen these features as we have been releasing them over the past weeks. For those of you who haven’t, this post will point out all the new shiny improvements for...

Mobile Security Framework: MobSF

Mobile Security Framework is an intelligent, all-in-one open source mobile application Android/iOS automated pen-testing framework capable of performing static and dynamic analysis. We’ve been depending on multiple tools to carry out reversing, decoding, debugging, code review, and pen-test and...