Denial of Service and Data Integrity vulnerability in features command

An authenticated user without any specific authorizations may be able to repeatedly invoke the features command where at a high volume may lead to resource depletion or generate high lock contention. This may result in denial of service and in rare cases could result in id field collisions...

IaC: Azure Resource Manager Templates vs. Terraform

Dive into a hands-on comparison of Azure Resource Manager templates and Terraform. This article highlights the primary features of each solution, comparing and contrasting their capabilities and performance...

Virtuozzo Hybrid Server 9 Alpha

The purpose of Virtuozzo Hybrid Server 9 alpha is to demonstrate the work in progress. The alpha version offers a few new features and supports creating virtual machines and containers with a limited number of guest operating systems...

OneBlog Cross-Site Scripting Vulnerability

OneBlog is a simple and beautiful , powerful and adaptive Java blog. The use of springboot development , front-end use Bootstrap. support for mobile adaptive , with a complete front-end and back-end management functions . OneBlog in version 2.2.8 before the existence of XSS vulnerability , the...

Debian DSA-5047-1 : prosody - security update

The remote Debian 10 / 11 host has a package installed that is affected by a vulnerability as referenced in the dsa-5047 advisory. Matthew Wild discovered that the WebSockets code in Prosody, a lightweight Jabber/XMPP server, was susceptible to denial of service. For the oldstable distribution...

Atlassian Jira Access Control Error Vulnerability (CNVD-2022-05435)

Atlassian Jira is a defect tracking management system from Atlassian Australia. Atlassian Jira Center is vulnerable to an access control error that occurs when a networked system or product does not properly restrict access to resources from unauthorized roles, which can be exploited by an...

4 things that you didn’t know your smartphone could do

By Owais Sultan Did you know there are 2.63 billion more cellphone connections than people worldwide? This is a post from HackRead.com Read the original post: 4 things that you didn’t know your smartphone could do...

hu.blackbelt.osgi.filestore:features (>=1.2.1 <=1.3.0), hu.blackbelt.osgi.filestore:kar (>=1.2.1 <=1.3.0) +40 more potentially affected by CVE-2021-44832 via org.ops4j.pax.logging:pax-logging-log4j2 (>=2.0.0 <=2.0.13)

org.ops4j.pax.logging:pax-logging-log4j2 MAVEN version =2.0.0, =1.2.1, =1.2.1, =1.0.12, =1.0.12, =2.14.2, =2.19.0, =3.12.0, =3.12.0, =3.5.0, =4.3.3, =4.3.3, =4.3.3, =4.3.3, =4.3.3, =4.3.3, =4.3.5 and more Source cves: CVE-2021-44832 Source advisory: OSV:GHSA-8489-44MV-GGJ8...

Domain Persistence – AdminSDHolder

Utilizing existing Microsoft features for offensive operations is very common during red team assessments as it provides the opportunity to blend in with the environment… Continue reading - Domain Persistence - AdminSDHolder...

Apple AirTags Are Being Used to Track People and Cars

This development suprises no one who has been paying attention: Researchers now believe AirTags, which are equipped with Bluetooth technology, could be revealing a more widespread problem of tech-enabled tracking. They emit a digital signal that can be detected by devices running Apples mobile...

OPENSUSE-SU-2021:1611-1 Security update for p11-kit

This update for p11-kit fixes the following issues: - CVE-2020-29361: Fixed multiple integer overflows in rpc code bsc1180064 - Add support for CKANSSSERVER,EMAILDISTRUSTAFTER bsc1187993. This update was imported from the SUSE:SLE-15:Update update project...

OPENSUSE-SU-2021:4154-1 Security update for p11-kit

This update for p11-kit fixes the following issues: - CVE-2020-29361: Fixed multiple integer overflows in rpc code bsc1180064 - Add support for CKANSSSERVER,EMAILDISTRUSTAFTER bsc1187993...

SonicWALL SMA100 安全漏洞

The SonicWALL SMA100 is a secure access gateway device from SonicWALL, Inc. A security vulnerability exists in the SonicWALL SMA100 that can be exploited by an attacker to gain unauthorized access to other restricted features...

Security update for barrier (moderate)

openSUSE Security Update: Security update for barrier Announcement ID: openSUSE-SU-2021:1595-1 Rating: moderate References: Cross-References: CVE-2021-42072 CVE-2021-42073 Affected Products: openSUSE Backports SLE-15-SP3 An update that fixes two vulnerabilities is now available. Description: This...

com.savoirtech.aetos:aetos (>=4.2.0.1 <=4.2.1), org.apache.karaf.examples:karaf-docker-example-dynamic-dist (=4.2.13) +13 more potentially affected by CVE-2021-45105 via org.ops4j.pax.logging:pax-logging-log4j2 (>=1.11.10 <=1.11.11)

org.ops4j.pax.logging:pax-logging-log4j2 MAVEN version =1.11.10, =4.2.0.1, =1.11.10, =1.11.10, =1.11.10, =1.11.11 Source cves: CVE-2021-45105 Source advisory: OSV:GHSA-P6XC-XR62-6R2G...

hu.blackbelt.osgi.filestore:features (>=1.2.1 <=1.3.0), hu.blackbelt.osgi.filestore:kar (>=1.2.1 <=1.3.0) +40 more potentially affected by CVE-2021-45105 via org.ops4j.pax.logging:pax-logging-log4j2 (>=2.0.0 <=2.0.12)

org.ops4j.pax.logging:pax-logging-log4j2 MAVEN version =2.0.0, =1.2.1, =1.2.1, =1.0.12, =1.0.12, =2.14.2, =2.19.0, =3.12.0, =3.12.0, =4.3.3, =4.3.3, =4.3.3, =4.3.3, =4.3.3, =4.3.3, =4.3.4 and more Source cves: CVE-2021-45105 Source advisory: OSV:GHSA-P6XC-XR62-6R2G...

CVE-2021-43840

messagebus is a messaging bus for Ruby processes and web clients. In versions prior to 3.3.7 users who deployed message bus with diagnostics features enabled default off are vulnerable to a path traversal bug, which could lead to disclosure of secret information on a machine if an unintended user...

openSUSE 15 Security Update : log4j (openSUSE-SU-2021:4094-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:4094-1 advisory. - Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not...

Log4Shell HTTP Scanner

Versions of Apache Log4j2 impacted by CVE-2021-44228 which allow JNDI features used in configuration, log messages, and parameters, do not protect against attacker controlled LDAP and other JNDI related endpoints. This module will scan an HTTP end point for the Log4Shell vulnerability by injectin...

Debian DSA-5022-1 : apache-log4j2 - security update

The remote Debian 10 / 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-5022 advisory. It was found that the fix to address CVE-2021-44228 in Apache Log4j, a Logging Framework for Java, was incomplete in certain non-default configurations. This...