CVE-2021-43858

MinIO is a Kubernetes native application for cloud storage. Prior to version RELEASE.2021-12-27T07-23-18Z, a malicious client can hand-craft an HTTP API call that allows for updating policy for a user and gaining higher privileges. The patch in version RELEASE.2021-12-27T07-23-18Z changes the...

CVE-2021-43858

MinIO is a Kubernetes native application for cloud storage. Prior to version RELEASE.2021-12-27T07-23-18Z, a malicious client can hand-craft an HTTP API call that allows for updating policy for a user and gaining higher privileges. The patch in version RELEASE.2021-12-27T07-23-18Z changes the...

Minio MinIO 安全漏洞

Minio MinIO is an open source object storage server from MinIO USA. The product supports building infrastructure for machine learning, analytics, and application data workloads.MinIO has a security vulnerability that stems from the fact that MinIO is a native application for Kubernetes cloud...

GHSA-G54H-M393-CPWQ devices resource list treated as a blacklist by default

Impact Contrary to the OCI runtime specification, runc's implementation of the linux.resources.devices list was a black-list by default. This means that users who created their own config.json objects and didn't prefix a deny-all rule "allow": false, "permissions": "rwm" or equivalent were not...

XStream: remote code execution due to insecure XML deserialization when relying on blocklists

A flaw was found in xstream. An unsafe deserialization of user-supplied XML, in conjunction with relying on the default deny list, allows a remote attacker to perform a variety of attacks including a remote code execution of arbitrary code in the context of the JVM running the XStream application...

Design/Logic Flaw

A vulnerability found in UniFi Switch firmware Version 5.43.35 and earlier allows a malicious actor who has already gained access to the network to perform a Deny of Service DoS attack on the affected switch.This vulnerability is fixed in UniFi Switch firmware 5.76.6 and later...

Possible deny of service by human error

Handle 0x1f8b Vulnerability details Impact Possible Deny of service. Proof of Concept The method removeFromTokenWhitelist of the contract ProtocolGovernance doesn't check if the argument addr it's inside the tokensAllowed map before remove it, the problem is if the user call twice this method it'...

Stripe: Bypassing domain deny_list rule in Smokescreen via trailing dot leads to SSRF

The Smokescreen proxy is an open source project written and maintained by Stripe to restrict the URLs that internal services can connect to. The primary use case for Smokescreen is to prevent server-side request forgery SSRF attacks in which external attackers leverage the behavior of our...

Intel Corporation: [BrakTooth] Bluetooth vulnerability allows attacker to disconnect or deny reconnection to BT devices connected to a target. Attack #2

This bug was reported directly to Intel Corporation...

VulnCheck KEV: CVE-2021-42013

Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default require all denied or if CGI scripts are enabled. This CVE ID resolves an incomplete patch for...

Defending Assets You Don’t Know About Against Cyberattacks

Back in the 90s, we all used to build massive firewalls around our systems and spent our day-to-day resources looking for holes to patch. In theory, an impenetrable wall around everything you own is a great idea, because it protects even the things you’ve forgotten about. However, if a wall is yo...

in flatcore/flatcore-cms

Description Attackers can trick admin users into performing actions because there is no X-Frame-Options: DENY header set by the application. This header is important because it prevents other websites from Iframing the website. If the website can be iframed, then the attacker can host a malicious...

SUSE SLED15: dbus-1 / dbus-1-devel / dbus-1-x11 / libdbus-1-3 / etc (SUSE-SU-2021:2810-1)

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:2810-1 advisory. - CVE-2020-12049: truncated messages lead to resource exhaustion. bsc1172505 Tenable has extracted the preceding description block directly fro...

XStream: remote code execution due to insecure XML deserialization when relying on blocklists

A flaw was found in xstream. An unsafe deserialization of user-supplied XML, in conjunction with relying on the default deny list, allows a remote attacker to perform a variety of attacks including a remote code execution of arbitrary code in the context of the JVM running the XStream application...

HashiCorp Consul L7 deny intention results in an allow action

In HashiCorp Consul before 1.10.1 and Consul Enterprise, xds can generate a situation where a single L7 deny intention with a default deny policy results in an allow action...

GHSA-8H2G-R292-J8XH HashiCorp Consul L7 deny intention results in an allow action

In HashiCorp Consul before 1.10.1 and Consul Enterprise, xds can generate a situation where a single L7 deny intention with a default deny policy results in an allow action...

Privilege Escalation

github.com/hashicorp/consul is vulnerable to privilege escalation. The vulnerability exists due to a single L7 deny intention bypassing the default deny policy...

CVE-2021-36213

HashiCorp Consul and Consul Enterprise 1.9.0 through 1.10.0 default deny policy with a single L7 application-aware intention deny action cancels out, causing the intention to incorrectly fail open, allowing L4 traffic. Fixed in 1.9.8 and 1.10.1...

Design/Logic Flaw

HashiCorp Consul and Consul Enterprise 1.9.0 through 1.10.0 default deny policy with a single L7 application-aware intention deny action cancels out, causing the intention to incorrectly fail open, allowing L4 traffic. Fixed in 1.9.8 and 1.10.1...

UBUNTU-CVE-2021-36213

HashiCorp Consul and Consul Enterprise 1.9.0 through 1.10.0 default deny policy with a single L7 application-aware intention deny action cancels out, causing the intention to incorrectly fail open, allowing L4 traffic. Fixed in 1.9.8 and 1.10.1...