PWAsForFirefox 安全漏洞

PWAsForFirefox is a Filip Š Individual Developer's tool for installing, managing and using Progressive Web Applications PWAs in Mozilla Firefox. A security vulnerability exists in PWAsForFirefox versions prior to v2.12.0, which stems from improper cleanup of web application properties, where a we...

The Windows Registry Adventure #2: A brief history of the feature

Posted by Mateusz Jurczyk, Google Project Zero Before diving into the low-level security aspects of the registry, it is important to understand its role in the operating system and a bit of history behind it. In essence, the registry is a hierarchical database made of named "keys" and "values",...

[SECURITY] Fedora 40 Update: apache-commons-configuration-2.10.1-1.fc40

The Commons Configuration software library provides a generic configuration interface which enables a Java application to read configuration data from a variety of sources. Commons Configuration provides typed access to single, and multi-valued configuration parameters as demonstrated by the...

Asterisk AMI - Partial File Content & Path Disclosure (Authenticated)

Exploit Title: Asterisk AMI - Partial File Content & Path Disclosure Authenticated Date: 2023-03-26 Exploit Author: Sean Pesce Vendor Homepage: https://asterisk.org/ Software Link: https://downloads.asterisk.org/pub/telephony/asterisk/old-releases/ Version: 18.20.0 Tested on: Debian Linux CVE:...

Wordfence CLI 2.1.0 Adds Email Capability and Unattended Configuration

Note: This post refers to Wordfence CLI, the command line tool for operations teams to rapidly scan large numbers of WordPress websites for vulnerabilities and malware, not the Wordfence plugin which is deeply integrated into WordPress and provides additional functionality, like a firewall,...

USN-6486-1 iniparser vulnerability

It was discovered that iniParser incorrectly handled certain files. An attacker could possibly use this issue to cause a crash...

Rocky Linux 8 : nodejs:10 (RLSA-2021:0548)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:0548 advisory. - Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like ://:@::/...

Rocky Linux 8 : nodejs:12 (RLSA-2021:0549)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:0549 advisory. - The utilities function in all versions = 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker...

Rocky Linux 8 : nodejs:14 (RLSA-2022:0350)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:0350 advisory. - This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator...

Rocky Linux 8 : nodejs:14 (RLSA-2021:0551)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:0551 advisory. - An issue was discovered in ajv.validate in Ajv aka Another JSON Schema Validator 6.12.2. A carefully crafted JSON schema could be provided that allows...

[SECURITY] Fedora 39 Update: python-configobj-5.0.8-6.fc39

ConfigObj is a simple but powerful configuration file reader and writer: an i ni file round tripper. Its main feature is that it is very easy to use, with a straightforward programmers interface and a simple syntax for config files...

SUSE CVE-2020-7788

This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context...

The vulnerability of the iniparser_getlongint() function in the iniParser analysis library allows a attacker to cause a service failure.

The vulnerability of the iniparsergetlongint function in the iniParser analysis library is related to pointer arithmetic errors. Exploiting this vulnerability could allow an attacker to cause a service failure...

XAMPPv3.3.0-BOF

XAMPPv3.3.0-BOF Proof-of-Concept exploit code for XAMPP v3.3.0...

[SECURITY] Fedora 37 Update: python-configobj-5.0.8-6.fc37

ConfigObj is a simple but powerful configuration file reader and writer: an i ni file round tripper. Its main feature is that it is very easy to use, with a straightforward programmers interface and a simple syntax for config files...

Advantech R-SeeNet 安全漏洞

Advantech R-SeeNet is an industrial monitoring software from Advantech, China. An information disclosure vulnerability exists in Advantech R-SeeNet, which can be exploited by an attacker to obtain login credentials and the default SNMP group string from the snmpmon.ini file and use this informati...

ShuiZe_0x727 Code Injection Vulnerability

ShuiZe0x727 is an information gathering automation tool from the 0x727 team. A security vulnerability exists in ShuiZe0x727 v1.0, which stems from a Remote Command Execution RCE vulnerability in component/iniFile/config.ini...

PT-2023-26700 · Unknown · Shuize 0X727

Name of the Vulnerable Software and Affected Versions: ShuiZe 0x727 version 1.0 Description: A remote command execution issue was found in the component /iniFile/config.ini, allowing for potential exploitation. Recommendations: For ShuiZe 0x727 version 1.0, consider restricting access to the...

[SECURITY] Fedora 37 Update: iniparser-4.1-11.fc37

iniParser is an ANSI C library to parse "INI-style" files, often used to hold application configuration information...

The vulnerability of the /web_cste/cgi-bin/product.ini component of the Telnet service in TOTOLINK T8 microprogramming device allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the /webcste/cgi-bin/product.ini component of the Telnet service in TOTOLINK T8 microprogramming router software is related to the use of pre-installed user credentials. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...