Fork Protection

OpenSSL 1.1.1 introduced a rewritten random number generator RNG. This was intended to include protection in the event of a fork system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A...

PT-2019-3787

Name of the Vulnerable Software and Affected Versions OpenSSL versions 1.1.1 through 1.1.1c Description The issue is related to the random number generator RNG in OpenSSL, which was intended to protect against shared RNG state between parent and child processes after a fork system call. However,...

OpenSSL -- Multiple vulnerabilities

The OpenSSL project reports: ECDSA remote timing attack CVE-2019-1547 Low Fork Protection CVE-2019-1549 Low OpenSSL 1.1.1 only...

Spoon Library Code Injection Vulnerability

Fork CMS is an open source content management system CMS developed in PHP. The system contains blogs , questions and answers , forms and other modules . Spoon Library is used in which a PHP library for building kickass Web applications . A code injection vulnerability exists in Spoon Library...

CVE-2019-15521

Spoon Library through 2014-02-06, as used in Fork CMS before 1.4.1 and other products, allows PHP object injection via a cookie containing an object...

CVE-2019-15521

Spoon Library through 2014-02-06, as used in Fork CMS before 1.4.1 and other products, allows PHP object injection via a cookie containing an object...

Code injection

Spoon Library through 2014-02-06, as used in Fork CMS before 1.4.1 and other products, allows PHP object injection via a cookie containing an object...

CVE-2019-15521

Spoon Library through 2014-02-06, as used in Fork CMS before 1.4.1 and other products, allows PHP object injection via a cookie containing an object...

CVE-2019-15521

Spoon Library through 2014-02-06, as used in Fork CMS before 1.4.1 and other products, allows PHP object injection via a cookie containing an object...

PT-2019-14243

Name of the Vulnerable Software and Affected Versions Spoon Library versions through 2014-02-06 Fork CMS versions prior to 1.4.1 Description The issue allows PHP object injection via a cookie containing an object. This can be exploited by manipulating the cookie to inject malicious PHP objects...

CVE-2019-15521: Deserialization of Untrusted Data

Spoon Library through 2014-02-06, as used in Fork CMS before 1.4.1 and other products, allows PHP object injection via a cookie containing an object...

go-toolset:ol8 security update

go-toolset 1.11.5-2 - Include patch to fix CVE-2019-9741 - Resolves: rhbz1690443 golang 1.11.5-2 - Include patch to fix CVE-2019-9741 - Resolves: rhbz1690443 1.11.5-2 - Switch to pagure fork for Go FIPS...

Prototype Pollution

Overview @sailshq/lodash is a fork of Lodash 3.10.x with ongoing maintenance from the Sails core team. Affected versions of this package are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor...

Malicious Package

destroyer-of-worlds is a malicious package. A malicious bash script resides in the package which will execute as a postinstall script. The script deletes system files and creates a large file, fork bomb and an endless loop in an attempt to crash the host...

polkit: Temporary auth hijacking via PID reuse and non-atomic fork

A vulnerability was found in polkit. When authentication is performed by a non-root user to perform an administrative task, the authentication is temporarily cached in such a way that a local attacker could impersonate the authorized process, thus gaining access to elevated privileges...

CHAOS Framework v3.0 - Generate Payloads And Control Remote Windows Systems

CHAOS is a PoC that allow generate payloads and control remote operating systems. Features Feature | Windows | Mac | Linux ---|---|---|--- Reverse Shell | X | X | X Download File | X | X | X Upload File | X | X | X Screenshot | X | X | X Keylogger | X | | Persistence | X | | Open URL | X | X | X...

USN-3934-1 policykit-1 vulnerability

It was discovered that PolicyKit incorrectly relied on the fork system call in the Linux kernel being atomic. A local attacker could possibly use this issue to gain access to services that have cached authorizations...

EulerOS 2.0 SP2 : polkit (EulerOS-SA-2019-1122)

According to the version of the polkit packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - polkit: Temporary auth hijacking via PID reuse and non-atomic fork CVE-2019-6133 Note that Tenable Network Security has extracted the preceding...

openSUSE Security Update : the Linux Kernel (openSUSE-2019-769)

The openSUSE Leap 15.0 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : - CVE-2018-14633: A security flaw was found in the chapservercomputemd5 function in the ISCSI target code in a way an authentication request from an ISCSI initiator is...

Ubuntu 14.04 LTS : Linux kernel (Xenial HWE) vulnerabilities (USN-3910-2)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3910-2 advisory. USN-3910-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enableme...