Oracle Linux 9 : httpd (ELSA-2022-8067)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-8067 advisory. - Resolves: 2094997 - CVE-2022-26377 httpd: modproxyajp: Possible request smuggling - Resolves: 2097032 - CVE-2022-28615 httpd: out-of-bounds read in...

ASUS RT-AX88U Explains Conflict Vulnerability

The ASUS RT-AX88U is a wireless router from ASUS China. versions prior to ASUS RT-AX88U v3.0.0.4.388.20558 contain an interpretation conflict vulnerability that could be exploited by an attacker to craft a specific URL that would allow an attacker to access cloud storage if an authenticated victi...

ASUS RT-AX88U 注入漏洞

The ASUS RT-AX88U is a wireless router from ASUS China. versions prior to ASUS RT-AX88U v3.0.0.4.388.20558 contain an interpretation conflict vulnerability that could be exploited by an attacker to craft a specific URL that would allow an attacker to access cloud storage if an authenticated victi...

The vulnerability of the Geth client library of the Ethereum programming language GO in Go Ethereum allows a hacker to trigger a service failure.

The vulnerability of the Geth client library for the Ethereum protocol, written in the Go programming language, is related to the occurrence of interpretation conflicts. Exploiting this vulnerability can allow a malicious actor to cause service failures...

CVE-2021-3427

The Deluge Web-UI is vulnerable to XSS through a crafted torrent file. The the data from torrent files is not properly sanitised as it's interpreted directly as HTML. Someone who supplies the user with a malicious torrent file can execute arbitrary Javascript code in the context of the user's...

CVE-2021-3427

The Deluge Web-UI is vulnerable to XSS through a crafted torrent file. The the data from torrent files is not properly sanitised as it's interpreted directly as HTML. Someone who supplies the user with a malicious torrent file can execute arbitrary Javascript code in the context of the user's...

EulerOS 2.0 SP8 : docker-engine (EulerOS-SA-2022-2218)

According to the versions of the docker-engine package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby Docker Engine where attempti...

CVE-2022-31207

The Omron SYSMAC Cx product family PLCs CS series, CJ series, and CP series through 2022-05-18 lack cryptographic authentication. They utilize the Omron FINS 9600/TCP protocol for engineering purposes, including downloading projects and control logic to the PLC. This protocol has authentication...

How Automation Affects The Interpretation Profession And Interpreting Services

By Owais Sultan Interpretation, as a language-intensive profession, is a hot topic in the age of language automation. Automation, lower prices,… This is a post from HackRead.com Read the original post: How Automation Affects The Interpretation Profession And Interpreting Services...

GSD-2022-1003361 afs: Adjust ACK interpretation to try and cope with NAT

afs: Adjust ACK interpretation to try and cope with NAT This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.46 by commit...

MediaWiki <= 1.37 Multiple Vulnerabilities - Windows

Mediawiki is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mediawiki:mediawiki"; ifdescripti...

BinAbsInspector - Vulnerability Scanner For Binaries

BinAbsInspector Binary Abstract Inspector is a static analyzer for automated reverse engineering and scanning vulnerabilities in binaries, which is a long-term research project incubated at Keenlab. It is based on abstract interpretation with the support from Ghidra. It works on Ghidra's Pcode...

GHSA-VM2P-F5J4-MJ6G Auth0 angular-jwt misinterprets allowlist as regex

Auth0 angular-jwt before 0.1.10 treats whiteListedDomains entries as regular expressions, which allows remote attackers with knowledge of the jwtInterceptorProvider.whiteListedDomains setting to bypass the domain allowlist filter via a crafted domain. For example, if the setting is initialized...

OESA-2022-1606 golang security update

The Go Programming Language. Security Fixes: cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.CVE-2022-23773...

Authorization Bypass Through User-Controlled Key

Description Bypass https://hackerone.com/reports/496293 via \b backspace character. Proof of Concept const parse = require'./index.js' url = parse'\bhttp://google.com' console.logurl Result: slashes: false, protocol: '', hash: '', query: '', pathname: '\bhttp://google.com', auth: '', host: '',...

MGASA-2022-0006 Updated singularity packages fix security vulnerability

A dependency used to extract docker/OCI image layers can be tricked into modifying host files by creating a malicious layer that has a symlink with the name "." or "/", when running as root. CVE-2021-29136 Dde to incorrect use of a default URL, singularity action commands run/shell/exec specifyin...

MGASA-2021-0531 Updated docker-containerd packages fix security vulnerability

The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations. Documents...

Incorrect Content-type Handling

github.com/opencontainers/distribution-spec is handling content-type incorrectly. Type of the manifest during the push and pull operations was wrongly determined as it uses only Content-Type header, causing a client to interpret the resulting content differently...

UBUNTU-CVE-2021-42716

An issue was discovered in stb stbimage.h 2.27. The PNM loader incorrectly interpreted 16-bit PGM files as 8-bit when converting to RGBA, leading to a buffer overflow when later reinterpreting the result as a 16-bit buffer. An attacker could potentially have crashed a service using stbimage, or...

The vulnerability of the LLHTTP component of the NodeJS object manipulation software allows attackers to enhance their privileges.

The vulnerability of the LLHTTP component in the NodeJS object manipulation software lies in inconsistencies during the interpretation of HTTP request headers. Exploiting this vulnerability can allow an attacker to enhance their privileges remotely...