Older releases of better_errors open to Cross-Site Request Forgery attack

Impact bettererrors prior to 2.8.0 did not implement CSRF protection for its internal requests. It also did not enforce the correct "Content-Type" header for these requests, which allowed a cross-origin "simple request" to be made without CORS protection. These together left an application with...

CVE-2021-39197: Cross-Site Request Forgery (CSRF)

bettererrors is an open source replacement for the standard Rails error page with more information rich error pages. It is also usable outside of Rails in any Rack app as Rack middleware. bettererrors prior to 2.8.0 did not implement CSRF protection for its internal requests. It also did not...

“FudCo” Spam Empire Tied to Pakistani Software Firm

In May 2015, KrebsOnSecurity briefly profiled "The Manipulaters," the name chosen by a prolific cybercrime group based in Pakistan that was very publicly selling spam tools and a range of services for crafting, hosting and deploying malicious email. Six years later, a review of the social media...

Exploit for Command Injection in Rubyonrails Rails

CVE-2019-5420 A vulnerability can allow an attacker to guess t...

Exploit for Command Injection in Rubyonrails Rails

CVE-2019-5420 A vulnerability can allow an attacker to guess t...

Qualcomm chip buffer error vulnerability

A Qualcomm chip is a chip from Qualcomm Incorporated USA. A way to miniaturize circuits mainly semiconductor devices, but also passive components, etc. and is often manufactured on the surface of semiconductor wafers. The Qualcomm chip has a security vulnerability that arises from an improper...

Qualcomm chip code issues and vulnerabilities

A Qualcomm chip is a chip from Qualcomm Incorporated USA. A way to miniaturize circuits mainly semiconductor devices, but also passive components, etc., and are from time to time fabricated on the surface of semiconductor wafers. The Qualcomm chip has a code issue vulnerability that arises from...

Huawei Smartphone security vulnerabilities

Huawei Smartphone is a smartphone from Huawei, a Chinese company. A security vulnerability exists in Huawei HarmonyOS, which arises from an improperly designed or implemented network system or product code development process...

Huawei HarmonyOS information leakage vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. Huawei HarmonyOS has a security vulnerability that arises from improper design or implementation during code development of a network system or product...

SUSE: Security Advisory (SUSE-SU-2021:2944-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Espressif ESP-IDF code injection vulnerability

Espressif ESP-IDF is an Internet of Things IoT development framework from China's Loxin Information Technology Espressif. A code injection vulnerability exists in the Espressif ESP-IDF that stems from the Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier versions not properly...

libssh buffer overflow vulnerability (CNVD-2021-71262)

Libssh is a C development package from the Libssh organization for accessing SSH services, which can execute remote commands, file transfers, and provide a secure transport channel for remote programs. libssh is vulnerable to a buffer overflow vulnerability, which stems from the fact that libssh...

DEBIAN-CVE-2021-36055

XMP Toolkit SDK versions 2020.1 and earlier are affected by a use-after-free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

UNIX Symbolic Link (Symlink) Following in @npmcli/arborist

Impact Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution @npmcli/arborist, the library that calculates dependency trees and manages the nodemodules folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and t...

Jenkins code issues and vulnerabilities

Jenkins is a Jenkins open source application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project. A code issue vulnerability exists in Jenkins Nested View Plugin 1.20 and earlier, which arises from an improperly designe...

[SECURITY] Fedora 34 Update: nbdkit-1.26.5-1.fc34

NBD is a protocol for accessing block devices hard disks and disk-like things over the network. nbdkit is a toolkit for creating NBD servers. The key features are: Multithreaded NBD server written in C with good performance. Minimal dependencies for the basic server. Liberal license BSD allows...

CVE-2021-39167

OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with the executor role to escalate privileges. Further details about the vulnerability will be disclosed at a later date. As a workaround revoke the executor role...

Code injection

OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with the executor role to escalate privileges. Further details about the vulnerability will be disclosed at a later date. As a workaround revoke the executor role...

CVE-2021-39167

OpenZeppelin Contracts TimelockController vulnerability (CVE-2021-39167) affects the TimelockController in OpenZeppelin’s smart contract library. The issue allows an actor with the executor role to escalate privileges, potentially gaining control over assets. Mitigation in public advisories recom...

CVE-2021-40145

gdImageGd2Ptr in gdgd2.c in the GD Graphics Library aka LibGD through 2.3.2 has a double free. NOTE: the vendor's position is "The GD2 image format is a proprietary image format of libgd. It has to be regarded as being obsolete, and should only be used for development and testing purposes...