Koppeling - Adaptive DLL Hijacking / Dynamic Export Forwarding

This project is a demonstration of advanced DLL hijack techniques. It was released in conjunction with the "Adaptive DLL Hijacking" blog post. I recommend you start there to contextualize this code. This project is comprised of the following elements: Harness.exe: The "victim" application which i...

Mozilla: Opportunistic Encryption in HTTP2 could be used to bypass the Same-Origin-Policy on services hosted on other ports

The Mozilla Foundation Security Advisory describes this flaw as: The Opportunistic Encryption feature of HTTP2 RFC 8164 allows a connection to be transparently upgraded to TLS while retaining the visual properties of an HTTP connection, including being same-origin with unencrypted connections on...

Exploit for Cross-site Scripting in Wp_Html_Author_Bio_Project Wp_Html_Author_Bio

CVE-2021-24545 현재는 plugin으로 배포가 중단되어 있는 플러그인에서 발견된 XSS 취약점입니다...

CVE-2021-42763

Couchbase Server before 6.6.3 and 7.x before 7.0.2 stores Sensitive Information in Cleartext. The issue occurs when the cluster manager forwards a HTTP request from the pluggable UI query workbench etc to the specific service. In the backtrace, the Basic Auth Header included in the HTTP request,...

Mozilla Firefox 访问控制错误漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the U.S. An access control error vulnerability exists in Mozilla Firefox, which stems from the opportunity encryption feature of HTTP2 RFC 8164 that allows connections to be transparently upgraded to TLS while retaining...

CLSA-2021-1635458969 Fix CVE(s): CVE-2021-40438, CVE-2021-34798, CVE-2021-39275

SECURITY UPDATE: Buffer overflow with crafted input - debian/patches/CVE-2021-39275.patch:apescapequotes may write beyond the end of a buffer when given malicious input - CVE-2021-39275 SECURITY UPDATE: Malformed requests may cause the server to dereference a NULL pointer -...

NewStart CGSL MAIN 6.02 : flatpak Vulnerability (NS-SA-2021-0132)

The remote NewStart CGSL host, running version MAIN 6.02, has flatpak packages installed that are affected by a vulnerability: - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In Flatpack since version 0.9.4 and before version 1.10.2 has a...

Vulnerability fixed in Juniper Junos OS

Juniper has fixed a vulnerability in Junos OS on the QFX5000 Series. The vulnerability results in potentially sensitive system information, including kernel versions, being leaked in communication between the routing engine and the packet forwarding engine. A malicious person with access to the...

Arista Networks Arista EOS 安全漏洞

Arista Networks Arista EOS is a scalable operating system for data centers and cloud network centers from Arista Networks, U.S. A security vulnerability exists in Arista Networks Arista EOS and clouddeos, which could be exploited by an attacker to obtain passwords for use in Bidirectional...

CVE-2021-31370

An Incomplete List of Disallowed Inputs vulnerability in Packet Forwarding Engine PFE of Juniper Networks Junos OS on QFX5000 Series and EX4600 Series allows an adjacent unauthenticated attacker which sends a high rate of specific multicast traffic to cause control traffic received from the netwo...

CVE-2021-31370

An Incomplete List of Disallowed Inputs vulnerability in Packet Forwarding Engine PFE of Juniper Networks Junos OS on QFX5000 Series and EX4600 Series allows an adjacent unauthenticated attacker which sends a high rate of specific multicast traffic to cause control traffic received from the netwo...

CVE-2021-31376

An Improper Input Validation vulnerability in Packet Forwarding Engine manager FXPC process of Juniper Networks Junos OS allows an attacker to cause a Denial of Service DoS by sending specific DHCPv6 packets to the device and crashing the FXPC service. Continued receipt and processing of this...

CVE-2021-31367

A Missing Release of Memory after Effective Lifetime vulnerability in the Packet Forwarding Engine PFE of Juniper Networks Junos OS on PTX Series allows an adjacent attacker to cause a Denial of Service DoS by sending genuine BGP flowspec packets which cause an FPC heap memory leak. Once having r...

Input validation

An Improper Input Validation vulnerability in Packet Forwarding Engine manager FXPC process of Juniper Networks Junos OS allows an attacker to cause a Denial of Service DoS by sending specific DHCPv6 packets to the device and crashing the FXPC service. Continued receipt and processing of this...

Design/Logic Flaw

An Incomplete List of Disallowed Inputs vulnerability in Packet Forwarding Engine PFE of Juniper Networks Junos OS on QFX5000 Series and EX4600 Series allows an adjacent unauthenticated attacker which sends a high rate of specific multicast traffic to cause control traffic received from the netwo...

CVE-2021-31376

CVE-2021-31376 affects Juniper Networks Junos OS on ACX Series (ACX500, ACX1000, ACX1100, ACX2100, ACX2200, ACX4000, ACX5048, ACX5096). The issue is an improper input validation in the FXPC (Packet Forwarding Engine manager) that can be triggered by specific DHCPv6 packets, crashing FXPC and caus...

CVE-2021-31370 Junos OS: QFX5000 Series and EX4600 Series: Control traffic might be dropped if a high rate of specific multicast traffic is received

An Incomplete List of Disallowed Inputs vulnerability in Packet Forwarding Engine PFE of Juniper Networks Junos OS on QFX5000 Series and EX4600 Series allows an adjacent unauthenticated attacker which sends a high rate of specific multicast traffic to cause control traffic received from the netwo...

CVE-2021-31370

CVE-2021-31370 concerns Juniper Networks Junos OS on QFX5000 Series and EX4600 Series, where an Incomplete List of Disallowed Inputs vulnerability in the Packet Forwarding Engine (PFE) can be exploited by an adjacent unauthenticated attacker sending a high rate of specific multicast traffic. This...

CVE-2021-31367

CVE-2021-31367 is a memory leak CVE affecting Juniper Networks Junos OS on PTX Series. The issue is a Missing Release of Memory after Effective Lifetime in the Packet Forwarding Engine (PFE) that allows an adjacent attacker to trigger a Denial of Service (DoS) by sending legitimate BGP flowspec p...

CVE-2021-28496

On systems running Arista EOS and CloudEOS with the affected release version, when using shared secret profiles the password configured for use by BiDirectional Forwarding Detection BFD will be leaked when displaying output over eAPI or other JSON outputs to other authenticated users on the devic...