Deploy tCell More Easily With the New AWS AMI Agent

Rapid7's tCell is a powerful tool that allows you to monitor risk and protect web applications and APIs in real time. Great! It's a fundamental part of our push to make web application security as strong and comprehensive as it needs to be in an age when web application attacks account for roughl...

SonicWALL Hosted Email Security 安全特征问题漏洞

SonicWALL Hosted Email Security is an advanced cloud email security service from SonicWALL, Inc. A security feature issue vulnerability exists in SonicWall Hosted Email Security HES version 10.0.17.7319 and prior versions that stems from the incorrect implementation of certain security features i...

SonicWall Hosted Email Security Capture ATP Bypass

Improperly Implemented Security Check vulnerability in the SonicWall Hosted Email Security leads to bypass of Capture ATP security service in the appliance. CVE: CVE-2022-2324 Last updated: July 14, 2022, 6:43 p.m...

Mealie 安全漏洞

Mealie is a self-hosted recipe manager and meal planner by an individual developer in Hayden, USA. A security vulnerability exists in Mealie v1.0.0beta-2, which stems from a login feature that allows an attacker to enumerate existing usernames by timing the server's response time...

This Week in Spring - July 12th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! How are you? This week Im writing you from sunny Seattle, Washington, where were having our next installment of the SpringOne Tour series. Its been a ton of fun seeing all these fun and friendly faces again and getting to see...

whoogle-search 跨站脚本漏洞

whoogle-search is a software application. Self-hosted, ad-free, privacy-respecting meta-search engine A security vulnerability exists in whoogle-search. An attacker could exploit this vulnerability to perform cross-site scripting attacks...

Rocket.Chat: Rocket.Chat Server RCE

Vulnerability description not provided...

Nextcloud 授权问题漏洞

Nextcloud is an open source, self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. Nextcloud suffers from an authorization issue vulnerability that stems from a lack of user account ownership checks...

TrueConf Server Cross-Site Scripting Vulnerability (CNVD-2022-53538)

TrueConf Server is a self-hosted and secure video collaboration platform from the Russian company TrueConf. version 4.3.7 of TrueConf Server contains a cross-site scripting vulnerability that can be exploited by remote attackers to perform basic cross-site scripting DOM attacks...

MAL-2022-3678 Malicious code in hosted-checkout-tutorial (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b28fec32c2291a635a7818b08faccb32ba2b20f87616d26a8cf6d0604884065d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in hosted-checkout-tutorial (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b28fec32c2291a635a7818b08faccb32ba2b20f87616d26a8cf6d0604884065d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-31038

Gogs is an open source self-hosted Git service. In versions of gogs prior to 0.12.9 DisplayName does not filter characters input from users, which leads to an XSS vulnerability when directly displayed in the issue list. This issue has been resolved in commit 155cae1d which sanitizes DisplayName...

CVE-2022-31038 XSS vulnerability in repository issue list in Gogs

Gogs is an open source self-hosted Git service. In versions of gogs prior to 0.12.9 DisplayName does not filter characters input from users, which leads to an XSS vulnerability when directly displayed in the issue list. This issue has been resolved in commit 155cae1d which sanitizes DisplayName...

Moderate: Red Hat Security Advisory: RHV Engine and Host Common Packages security update

Updated dependency packages for ovirt-engine and ovirt-host that fix several bugs and add various enhancements are now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

Low: Red Hat Security Advisory: RHV RHEL Host (ovirt-host) [ovirt-4.5.0] security update

Updated host packages that fix several bugs and add various enhancements are now available. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

GHSA-4WPP-W5R4-7V5V Server-Side Request Forgery in charm

We've discovered a vulnerability in which attackers could forge HTTP requests to manipulate the charm data directory to access or delete anything on the server. This has been patched in https://github.com/charmbracelet/charm/commit/3c90668f955c7ce5ef721e4fc9faee7053232fd3 and is available in...

Server-Side Request Forgery in charm

We've discovered a vulnerability in which attackers could forge HTTP requests to manipulate the charm data directory to access or delete anything on the server. This has been patched in https://github.com/charmbracelet/charm/commit/3c90668f955c7ce5ef721e4fc9faee7053232fd3 and is available in...

Fslogix Roaming Profile Failing To Load On Windows 10 AWS Hosted VDA

Fslogix roaming profile failing to load on windows 10 AWS hosted VDA Issue was reprodubile in RDP session as well The below errors were logged in the event logs: Operation: FSLogixLogonPROFILE, SessionId: 3, ErrorCode: 1168, Detail: Logon failed, Please check logs and tracelogging and verify that...

CVE-2021-41177

Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, Nextcloud Server did not implement a database backend for rate-limiting purposes. Any component of Nextcloud using rate-limits as as AnonRateThrottle or UserRateThrottle was thus not rat...

Moodle SSRF Vulnerability

The editblog.php script allows a registered user to add external RSS feed resources. It was identified that this feature could be abused to be used as a SSRF attack vector by adding a malicious URL/TCP PORT in order to target internal network or an internet hosted server, bypassing firewall rules...