CVE-2022-30698: Insufficient Session Expiration

NLnet Labs Unbound, up to and including version 1.16.1 is vulnerable to a novel type of the "ghost domain names" attack. The vulnerability works by targeting an Unbound instance. Unbound is queried for a subdomain of a rogue domain name. The rogue nameserver returns delegation information for the...

CVE-2022-30699: Insufficient Session Expiration

NLnet Labs Unbound, up to and including version 1.16.1, is vulnerable to a novel type of the "ghost domain names" attack. The vulnerability works by targeting an Unbound instance. Unbound is queried for a rogue domain name when the cached delegation information is about to expire. The rogue...

CVE-2022-30699

NLnet Labs Unbound, up to and including version 1.16.1, is vulnerable to a novel type of the "ghost domain names" attack. The vulnerability works by targeting an Unbound instance. Unbound is queried for a rogue domain name when the cached delegation information is about to expire. The rogue...

PT-2022-6740

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.16.1 and earlier Description The issue is related to a novel type of the "ghost domain names" attack, where an Unbound instance is targeted. The attack works by querying Unbound for a rogue domain name when the...

North Korean hacker group targets victims globally with Holy Ghost ransomware

Threat Level Vulnerability Report For a detailed advisory, download the pdf file here Summary The H0lyGh0st ransomware group, also tracked as DEV-0530 have been using ransomware payloads to compromise several small to mid-sized organizations across the world...

MAL-2022-3282 Malicious code in gatsby-plugin-ghost-manifest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 208b0073fdc86db167902fa294a66a32fe90b183dd98eaaa72b0bba5f887e2cc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in gatsby-plugin-ghost-manifest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 208b0073fdc86db167902fa294a66a32fe90b183dd98eaaa72b0bba5f887e2cc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Ghost vulnerable to remote code execution in locale setting change

Impact A vulnerability in an upstream library means an authenticated attacker can abuse locale input to execute arbitrary commands from a file that has previously been uploaded using the file upload functionality in the post editor. Patches Fixed in 5.2.3, all 5.x sites should update as soon as...

GHSA-7V28-G2PQ-GGG8 Ghost vulnerable to remote code execution in locale setting change

Impact A vulnerability in an upstream library means an authenticated attacker can abuse locale input to execute arbitrary commands from a file that has previously been uploaded using the file upload functionality in the post editor. Patches Fixed in 5.2.3, all 5.x sites should update as soon as...

Security Bulletin: GNU C library (glibc) vulnerability affects DS8000 (CVE-2015-0235)

Summary GNU C library glibc vulnerability that has been referred to as GHOST affects DS8000 Vulnerability Details CVEID: CVE-2015-0235 DESCRIPTION:The gethostbyname functions of the GNU C Library glibc are vulnerable to a buffer overflow. By sending a specially crafted, but valid hostname argumen...

PT-2022-4985

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.16.1 and earlier Description The issue is related to a novel type of "ghost domain names" attack, where an Unbound instance is targeted. This attack works by querying Unbound for a subdomain of a rogue domain name...

Remote Code Execution (RCE)

ghost is vulnerable to remote code execution. The vulnerability exists due to a lack of sanitization of the upload and update function allowing an attacker inject maliciously crafted script via an SVG file. NOTE: Vendor states that as outlined in Ghost's security documentation, upload of SVGs is...

GHSA-FVC6-QJP7-M4G4 Arbitrary file upload in Ghost

An arbitrary file upload vulnerability in the file upload module of Ghost v4.39.0 allows attackers to execute arbitrary code via a crafted SVG file...

Arbitrary file upload in Ghost

An arbitrary file upload vulnerability in the file upload module of Ghost v4.39.0 allows attackers to execute arbitrary code via a crafted SVG file...

Arbitrary file upload in Ghost

An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitrary code via a crafted file...

GHSA-FFHQ-G856-9F2P Arbitrary file upload in Ghost

An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitrary code via a crafted file...

CVE-2022-28397

An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitrary code via a crafted file. NOTE: Vendor states as detailed in Ghost's security documentation, files can only be uploaded and published by trusted users, this is intentional...

CVE-2022-28397

An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitrary code via a crafted file. NOTE: Vendor states as detailed in Ghost's security documentation, files can only be uploaded and published by trusted users, this is intentional...

CVE-2022-27139

An arbitrary file upload vulnerability in the file upload module of Ghost v4.39.0 allows attackers to execute arbitrary code via a crafted SVG file. NOTE: Vendor states that as outlined in Ghost's security documentation, upload of SVGs is only possible by trusted authenticated users. The uploadin...

CVE-2022-27139

An arbitrary file upload vulnerability in the file upload module of Ghost v4.39.0 allows attackers to execute arbitrary code via a crafted SVG file. NOTE: Vendor states that as outlined in Ghost's security documentation, upload of SVGs is only possible by trusted authenticated users. The uploadin...