CVE-2018-25022

The Onion module in toxcore before 0.2.2 doesn't restrict which packets can be onion-routed, which allows a remote attacker to discover a target user's IP address when knowing only their Tox Id by positioning themselves close to target's Tox Id in the DHT for the target to establish an onion...

Guidance for preventing, detecting, and hunting for exploitation of the Log4j 2 vulnerability

January 10, 2022 recap – The Log4j vulnerabilities represent a complex and high-risk situation for companies across the globe. This open-source component is widely used across many suppliers’ software and services. By nature of Log4j being a component, the vulnerabilities affect not only...

Mozilla: XMLHttpRequest error codes could have leaked the existence of an external protocol handler

Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading external protocols. This vulnerability affects Thunderbird 91.4.0, Firefox ESR 91.4.0, and Firefox 95...

USN-5183-1 bluez vulnerability

Julian Rauchberger discovered that BlueZ incorrectly handled memory when processing SDP attribute requests. A remote attacker could use this issue to cause BlueZ to crash, leading to a denial of service, or possibly execute arbitrary code...

7 data privacy solution features your organization needs to have

The worldwide data privacy regulation landscape is changing National laws and state/provincial laws continue to be enacted and strengthened to ensure their citizens’ data is protected and give individuals more control over how personal data is collected, used, and shared. No matter what industry...

The vulnerability of the implementations of the Cisco Discovery Protocol and Link Layer Discovery Protocol (LLDP) in the Cisco Video Surveillance Series 7000 software-based IP cameras allows a intruder to trigger a service failure or cause the device to restart.

The vulnerability of the Cisco Discovery Protocol and Link Layer Discovery Protocol LLDP implementations in Cisco Video Surveillance devices of the 7000 series is related to a memory reclamation error. Exploiting this vulnerability can allow an attacker to trigger a system reboot or cause a servi...

STEWS - A Security Tool For Enumerating WebSockets

STEWS is a tool suite for security testing of WebSockets This research was first presented at OWASP Global AppSec US 2021 Features STEWS provides the ability to: Discover : find WebSockets endpoints on the web by testing a list of domains Fingerprint : determine what WebSockets server is running ...

PT-2021-16366 · WordPress · Wps Hide Login

Name of the Vulnerable Software and Affected Versions: WPS Hide Login WordPress plugin versions prior to 1.9.1 Description: The issue allows an unauthenticated user to discover the secret login page by setting a random referer string and making a request to /wp-admin/options.php. This can be...

dlc.ibsedu.bg Cross Site Scripting vulnerability OBB-2291383

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2021-36327

creationtimestamp| type| source ---|---|--- 2021-12-01 00:34:41+00:00| seen| https://t.me/cibsecurity/33152...

The vulnerability of Cisco Small Business LLDP switches, related to copying buffers without checking input data, allows a perpetrator to execute arbitrary code.

The vulnerability of Cisco Small Business LLDP switches lies in the copying of buffers without checking the input data. Exploiting this vulnerability allows an attacker to execute arbitrary code...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Java

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Java. Vulnerability Details CVEID: CVE-2021-2369 DESCRIPTION: An unspecified vulnerability in Java SE related to the Library component could allow an unauthenticated attacker to cause no confidentiality impac...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Apache Commons Compress

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Apache Commons Compress. Vulnerability Details CVEID: CVE-2021-35517 DESCRIPTION: Apache Commons Compress is vulnerable to a denial of service, caused by an out of memory error when allocating large amounts o...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Python Pillow

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Python Pillow. Vulnerability Details CVEID: CVE-2021-23437 DESCRIPTION: Python Pillow is vulnerable to a denial of service, caused by a regular expression denial of service ReDoS flaw in the getrgb function. ...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Axios

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Axios. Vulnerability Details CVEID: CVE-2021-3749 DESCRIPTION: axios is vulnerable to a denial of service, caused by a regular expression denial of service ReDoS flaw in the trim function. By sending a...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Node.js

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Node.js. Vulnerability Details CVEID: CVE-2021-23440 DESCRIPTION: Nodejs set-value module could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution flaw. By adding...

GSD-2021-1002342 arm64: dts: qcom: msm8998: Fix CPU/L2 idle state latency and residency

arm64: dts: qcom: msm8998: Fix CPU/L2 idle state latency and residency This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.5 by commit...

GSD-2021-1002338 usb: host: ohci-tmio: check return value after calling platform_get_resource()

usb: host: ohci-tmio: check return value after calling platformgetresource This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.5 by commit...

GSD-2021-1002332 ALSA: gus: fix null pointer dereference on pointer block

ALSA: gus: fix null pointer dereference on pointer block This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.5 by commit...

GSD-2021-1002331 ALSA: usb-audio: fix null pointer dereference on pointer cs_desc

ALSA: usb-audio: fix null pointer dereference on pointer csdesc This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.5 by commit...