Matrix matrix-appservice-irc 注入漏洞

Matrix is an ambitious new ecosystem for open federated instant messaging and VoIP. matrix-appservice-irc is a bridge for Matrix. This bridge passes all IRC messages to Matrix and all Matrix messages to IRC. An injection vulnerability exists in Matrix matrix-appservice-irc version 0.33.1 and...

CVE-2022-26071

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, a flaw in the way reply ICMP packets are limited in the Traffic Management Microkernel TMM allows an attack...

Ransomware Insights from the FBI’s 2021 Internet Crime Report

The FBI has published its annual report on Internet crime. Qualys has analyzed its trends and statistics. In this post, we review our findings, especially with regards to the prevalence of Ransomware, and our recommendations for actions that enterprises should take to mitigate their risk. Every...

F5 BIG-IP 安全漏洞

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing, etc. F5 BIG-IP has a security vulnerability that can be exploited by attackers to cause a denial of service on the BIG-IP system...

SAP Web Dispatcher HTTP Request Smuggling

Onapsis Security Advisory 2022-0001: HTTP Request Smuggling in SAP Web Dispatcher Impact on Business By injecting an HTTP request as a prefix into a victim's request, a malicious user is able to cause damage in different ways, such as producing a Denial of Service by setting an invalid request as...

Mitel 6900 SIP 安全漏洞

Mitel 6900 SIP is a 6900 SIP series IP phone from Mitel Canada. A security vulnerability exists in Mitel 6900 SIP. An attacker could exploit this vulnerability to bypass the restrictions of the Mitel 6900 Series IP Phone SIP via system boot to elevate its privileges...

Microsoft Internet Explorer Use-After-Free Vulnerability

Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute code...

Tenda AX1806 操作系统命令注入漏洞

The Tenda AX1806 is a WiFi6 wireless router from Tenda China. The Tenda AX1806 suffers from a command injection vulnerability that stems from the SetIPv6Status function failing to properly filter construct command special characters, commands, etc. No detailed vulnerability details are provided a...

Trac Cross-site Scripting (XSS) vulnerability

Cross-site scripting XSS vulnerability in the "download wiki page as text" feature in Trac before 0.10.3.1, when Microsoft Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters...

GHSA-W7X2-57F7-3P3X Trac Cross-site Scripting (XSS) vulnerability

Cross-site scripting XSS vulnerability in the "download wiki page as text" feature in Trac before 0.10.3.1, when Microsoft Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters...

Multicloud, Multi-CDNs (Content Delivery Networks) Architecture – A Deceptive Future of the Internet

The last two years stood witness to multiple internet outages that caused massive disruptions across the globe. One prevalent theory is that multicloud, multi-CDNs content delivery networks are the inevitable future of the internet. This article conducts a litmus test on this theory and tries to...

[SECURITY] Fedora 34 Update: golang-github-theupdateframework-notary-0.7.0-4.fc34

The Notary project comprises a server and a client for running and interacting with trusted collections. See the service architecture documentation for more information. Notary aims to make the internet more secure by making it easy for people to publish and verify content. We often rely on TLS t...

ALPINE-CVE-2022-29869

cifs-utils through 6.14, with verbose logging, can cause an information leak when a file contains = equal sign characters but is not a valid credentials file...

Northern.tech Mender Enterprise 跨站请求伪造漏洞

Northern.tech Mender Enterprise is a wireless update manager for IoT devices from Northern.tech. A security vulnerability exists in Northern.tech Mender Enterprise prior to version 3.2.2, which stems from a cross-domain websocket hijacking allowed via the Deviceconnect microservice from 1.3.0...

Northern.tech Mender Enterprise 代码问题漏洞

Northern.tech Mender Enterprise is a wireless update manager for IoT devices from Northern.tech. A security vulnerability exists in Northern.tech Mender Enterprise prior to version 3.2.2, which stems from the iot-manager microservice 1.0.0 that allows SSRF because the Azure IoT Hub integration...

The vulnerability of the Adobe Flash Player Desktop Runtime, FlashPlayer for Google Chrome, as well as Adobe FlashPlayer for Microsoft Edge and Internet Explorer, relates to reading data beyond the buffer in memory. This allows an attacker to gain unauthorized access to protected information.

The vulnerabilities of Adobe Flash Player Desktop Runtime, Flash Player for Google Chrome, as well as Adobe Flash Player for Microsoft Edge and Internet Explorer, are related to reading data beyond the buffer in memory. Exploiting these vulnerabilities can allow an attacker to gain unauthorized...

Millions of Java Apps Remain Vulnerable to Log4Shell

Four months after the discovery of the zero-day Log4Shell critical flaw, millions of Java applications still remain vulnerable to compromise, researchers have found. Rezilion expected that due to the “massive amount of media coverage” the bug unsurprisingly received, the majority of applications...

Internet Bug Bounty: CVE-2022-27774: Credential leak on redirect

Summary: curl/libcurl can be coaxed to leak user credentials to third-party host by issuing HTTP redirect to ftp:// URL. Steps To Reproduce: 1. Configure for example Apache2 on firstsite.tld to perform redirect with modrewrite: RewriteCond %HTTPUSERAGENT "^curl/" RewriteRule ^/redirectpoc...

cifs-utils缓冲区错误漏洞

cifs-utils is a toolkit from the individual developer Pavel Shilovsky. It provides utilities for managing CIFS network file system installations. A security vulnerability exists in piastry cifs-utils versions prior to 6.14, which stems from a stack-based buffer overflow when the application parse...

Hospitals taken offline after cyberattack

The GHT Coeur Grand Est has become a victim of a cyberattack on the hospital centers of Vitry-le-François and Saint-Dizier. The hospital’s administration has warned French that data have been exfiltrated and might be used for phishing in the future. As a consequence, the GHT Cœur Grand Est has cu...