Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Apache Log4j

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Apache Log4j. Vulnerability Details CVEID: CVE-2021-45105 DESCRIPTION: Apache Log4j is vulnerable to a denial of service, caused by the failure to protect from uncontrolled recursion from self-referential...

Analyzing an Old Bug and Discovering CVE-2021-30995

A vulnerability found in 2021 has been patched and re-patched in the months since it was reported. We analyze the bug and outline the process that led to the discovery of CVE-2021-30995...

AlphaGolang - IDApython Scripts For Analyzing Golang Binaries

AlphaGolang is a collection of IDAPython scripts to help malware reverse engineers master Go binaries. The idea is to break the scripts into concrete steps, thus avoiding brittle monolithic scripts, and mimicking the methodology an analyst might follow when tackling a Go binary. Scripts are...

Reflected cross-site scripting (XSS) vulnerability

This security advisory relates to a capability for an attacker to exploit a reflected cross-site scripting vulnerability when using the @keystone-6/auth package. Impact The vulnerability can impact users of the administration user interface when following an untrusted link to the signin or init...

CVE-2022-22172

A Missing Release of Memory after Effective Lifetime vulnerability in the Layer-2 control protocols daemon l2cpd of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a memory leak. Continued exploitation can lead to memory exhaustion and thereby a...

lostandfoundnetworks.com Cross Site Scripting vulnerability OBB-2332197

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

GSD-2022-1000060 fs/mount_setattr: always cleanup mount_kattr

fs/mountsetattr: always cleanup mountkattr This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.13 by commit...

GSD-2022-1000059 nitro_enclaves: Use get_user_pages_unlocked() call to handle mmap assert

nitroenclaves: Use getuserpagesunlocked call to handle mmap assert This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.13 by commit...

GSD-2022-1000057 net/mlx5e: Wrap the tx reporter dump callback to extract the sq

net/mlx5e: Wrap the tx reporter dump callback to extract the sq This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.13 by commit...

GSD-2022-1000046 usb: mtu3: fix list_head check warning

usb: mtu3: fix listhead check warning This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.90 by commit 3b6efe0b7ba03cc2acf0694b46d6ff33c5b4c29...

GSD-2022-1000036 tomoyo: Check exceeded quota early in tomoyo_domain_quota_is_ok().

tomoyo: Check exceeded quota early in tomoyodomainquotaisok. This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.170 by commit...

GSD-2022-1000035 usb: mtu3: fix list_head check warning

usb: mtu3: fix listhead check warning This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.170 by commit 585e2b244dda7ea733274e4b8fa27853d625d3b...

GSD-2022-1000019 usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear.

usb: gadget: ffs: Clear ffseventfd in ffsdataclear. This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.261 by commit...

GSD-2022-1000014 usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear.

usb: gadget: ffs: Clear ffseventfd in ffsdataclear. This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.296 by commit...

CVE-2021-44528

creationtimestamp| type| source ---|---|--- 2022-01-10 16:21:05+00:00| seen| https://t.me/cibsecurity/35167 2023-04-27 09:58:59+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-44528.yaml 2024-02-08 12:26:40+00:00| seen|...

gouwuke.com Cross Site Scripting vulnerability OBB-2327975

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Microsoft Windows SMB Direct Session Takeover Exploit

This Metasploit module will intercept direct SMB authentication requests to another host, gaining access to an authenticated SMB session if successful. If the connecting user is an administrator and network logins are allowed to the target machine, this module will execute an arbitrary payload. T...

Opmantek Open-AudIT Path Traversal Vulnerability

Opmantek Open-AudIT is an open source network discovery and auditing program from Opmantek, Inc. The program intelligently scans networks and network devices and provides status reports.Opmantek Open-AudIT suffers from a path traversal vulnerability that can be exploited by attackers to read file...

WordPress Contact Form Entries 1.1.6 Cross Site Scripting

Exploit Title: WordPress Plugin Contact Form Entries 1.1.6 - Cross Site Scripting XSS Unauthenticated Date: 22/12/2021 Exploit Author: gx1 Vulnerability Discovery: Gaetano Perrone Vendor Homepage: https://www.crmperks.com/ Software Link: https://wordpress.org/plugins/contact-form-entries/ Version...

Security Bulletin: Vulnerability in Elasticsearch affects IBM Cloud Private (CVE-2021-22135, CVE-2021-22137)

Summary There is a vulnerability in the Elasticsearch open source library. The library is used by IBM Cloud Private logging. This bulletin identifies the security fixes to apply to address the Elasticsearch vulnerability CVE-2021-22135, CVE-2021-22137. Vulnerability Details CVEID: CVE-2021-22135...