CVE-2021-29451 Missing validation of JWT signature in `ManyDesigns/Portofino`

Portofino is an open source web development framework. Portofino before version 5.2.1 did not properly verify the signature of JSON Web Tokens. This allows forging a valid JWT. The issue will be patched in the upcoming 5.2.1 release...

CVE-2021-29451

Portofino is an open-source web framework. Versions before 5.2.1 fail to properly verify the signature of JSON Web Tokens, allowing forging a valid JWT. Affected component: JWT validation logic in Portofino prior to 5.2.1. Impact: compromised authentication/session integrity for tokens forged wit...

Google Project Zero Cuts Bug Disclosure Timeline to a 30-Day Grace Period

Google Project Zero will now give organizations a 30-day grace period to patch zero-day flaws it discovers in a new disclosure policy revealed this week aimed at speeding up the time it takes for patches to be adopted. Known for discovering a number of high-profile zero days—in Google’s own...

CVE-2021-28484

An issue was discovered in the /api/connector endpoint handler in Yubico yubihsm-connector before 3.0.1 in YubiHSM SDK before 2021.04. The handler did not validate the length of the request, which can lead to a state where yubihsm-connector becomes stuck in a loop waiting for the YubiHSM to send ...

瞻博网络 Juniper Networks Junos OS 安全漏洞

Juniper Networks Junos OS is a Juniper Networks network operating system for the company's hardware devices. The operating system provides a secure programming interface and the Junos SDK. There is a security vulnerability in Junos OS. No information about this vulnerability is available at this...

Logic Flaw Vulnerability in Vigor Series Products

Shanghai Juyi Technology Development Co., Ltd, Legal Representative: Wang Nan, Registered Capital: 1,000,000 yuan, Address: JT1225, Room 2201, No. 888, Moyu South Road, Anting Town, Jiading District, Shanghai, Business Scope: General Items: technical services, technology development, technology...

SUSE SLED15 / SLES15 Security Update : spamassassin (SUSE-SU-2021:1163-1)

This update for spamassassin fixes the following issues : CVE-2019-12420: memory leak via crafted messages bsc1159133 CVE-2020-1946: security update bsc1184221 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has...

CVE-2021-28471

Remote Development Extension for Visual Studio Code Remote Code Execution Vulnerability...

CVE-2021-28471

Remote Development Extension for Visual Studio Code Remote Code Execution Vulnerability...

CVE-2021-28471

Remote Development Extension for Visual Studio Code Remote Code Execution Vulnerability...

CVE-2021-28471 Remote Development Extension for Visual Studio Code Remote Code Execution Vulnerability

...

CVE-2021-28471 Remote Development Extension for Visual Studio Code Remote Code Execution Vulnerability

...

CVE-2021-28471

CVE-2021-28471 is a Remote Development Extension for Visual Studio Code remote code execution vulnerability. The NVD/OSV entries rate it HIGH (CVSS v3.1: LOCAL, LOW/LOCAL, UI REQUIRED, C/H/I/H/A/H). The vulnerability affects Visual Studio Code components and related tools (e.g., Remote Developmen...

Ronin - A Ruby Platform For Vulnerability Research And Exploit Development

Ronin is a Ruby platform for vulnerability research and exploit development. Ronin allows for the rapid development and distribution of code, Exploits, Payloads, Scanners, etc, via Repositories. Console Ronin provides users with a powerful Ruby Console, pre-loaded with powerful convenience method...

PT-2021-2731 · Microsoft · Visual Studio Code

Name of the Vulnerable Software and Affected Versions: Visual Studio Code Remote Development Extension Pack affected versions not specified Description: The issue is related to incorrect code generation management in the Remote Development Extension Pack for Microsoft Visual Studio Code...

Microsoft Azure Sphere Linux namespace ptrace unsigned code execution vulnerability

Summary An unsigned code execution vulnerability exists in the Linux namespace ptrace functionality of Microsoft Azure Sphere 21.01. Specially crafted shellcode could allow an adversary to execute unsigned code. An attacker can change the namespace and use ptrace to modify the code of a running...

Debian DLA-2622-1 : python-django security update

It was discovered that there was a potential directory traversal issue in Django, a Python-based web development framework. The vulnerability could have been exploited by maliciously crafted filenames. However, the upload handlers built into Django itself were not affected. For Debian 9 'Stretch'...

Debian: Security Advisory (DLA-2622-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 2622-1] python-django security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2622-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb April 09, 2021 https://wiki.debian.org/LTS -...

Cross-site scripting in actionpack

In actionpack gem = 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed in another page a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This...