CVE-2021-3911

If the ROA that a repository returns contains too many bits for the IP address then OctoRPKI will crash...

CVE-2021-3911

CVE-2021-3911 : In Cloudflare’s CFRPKI/OctoRPKI stack, a ROA response containing too many bits for the IP address can cause OctoRPKI to crash, i.e., an availability issue. The vulnerability is triggered when the ROA payload’s IP bit width exceeds expected limits, leading to a crash rather than a ...

CVE-2021-3911

If the ROA that a repository returns contains too many bits for the IP address then OctoRPKI will crash...

CVE-2021-3911 Misconfigured IP address field in ROA leads to OctoRPKI crash

If the ROA that a repository returns contains too many bits for the IP address then OctoRPKI will crash...

EulerOS 2.0 SP5 : golang (EulerOS-SA-2021-2661)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which in some situations allows...

CentOS 8 : rust-toolset:rhel8 (CESA-2021:4270)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:4270 advisory. - rust: incorrect parsing of extraneous zero characters at the beginning of an IP address string CVE-2021-29922 Note that Nessus has not tested for this issue b...

GHSA-W6WW-FMFX-2X22 Misconfigured IP address field in ROA leads to OctoRPKI crash

If the ROA that a repository returns contains too many bits for the IP address then OctoRPKI will crash. Patches For more information If you have any questions or comments about this advisory email us at [email protected]...

Mozilla: Opportunistic Encryption in HTTP2 could be used to bypass the Same-Origin-Policy on services hosted on other ports

The Mozilla Foundation Security Advisory describes this flaw as: The Opportunistic Encryption feature of HTTP2 RFC 8164 allows a connection to be transparently upgraded to TLS while retaining the visual properties of an HTTP connection, including being same-origin with unencrypted connections on...

rust: incorrect parsing of extraneous zero characters at the beginning of an IP address string

A flaw was found in rust. Extraneous zero characters at the beginning of an IP address string are not properly considered which can allow an attacker to bypass IP-based access controls. The highest threat from this vulnerability is to data confidentiality and integrity...

X (Formerly Twitter): Remote 0click exfiltration of Safari user's IP address

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! Summary: A malicious actor when embeddi...

This Steam phish baits you with free Discord Nitro

Weeks ago, we talked about the one effective lure that could get a Discord user to consider clicking on a scam link they were generously given, either by a random user or a legitimate contact who also happened to have fallen for the same ploy: free Discord Nitro subscriptions. And similar to how...

Huawei Emui and Magic UI IP Address Spoofing Vulnerability

Huawei Emui is a mobile operating system developed on Android. magic Ui is a mobile operating system developed on Android. Huawei Emui and Magic UI have security vulnerabilities that can be exploited by attackers to cause a denial of service...

HackerOne: Attachment references in markdown don't warn before downloading

Summary: By default if any link of report is clicked, There will be a popup to user that you're visiting a third-party website please proceed at your own risk etc. However, when a user views the report all links are non clickable and file URI is appended. I have Found out that I can bypass this...

CVE-2021-22483

There is a issue of IP address spoofing in Huawei Smartphone. Successful exploitation of this vulnerability may cause DoS...

Design/Logic Flaw

There is a issue of IP address spoofing in Huawei Smartphone. Successful exploitation of this vulnerability may cause DoS...

CVE-2021-22483

CVE-2021-22483 describes an IP address spoofing vulnerability in Huawei smartphones that can enable a DoS. The connected records cite network‑based exploitation with a CVSSv3.1 base score of 7.5 (HIGH) and vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, but no specific affected versions, component de...

NewStart CGSL CORE 5.05 / MAIN 5.05 : ntp Vulnerability (NS-SA-2021-0142)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has ntp packages installed that are affected by a vulnerability: - ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoofe...

OESA-2021-1402 golang security update

The go programming language Security Fixes: Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an unsafe injection e.g., XSS that does not conform to the RFC1035 format.CVE-2021-33195 In...

Omise: The endpoint '/test/webhooks' is vulnerable to DNS Rebinding

Summary: DNS rebinding attack is a method of switching the resolution of domain names as wished by the attacker. The aim is to lure the web app to a different IP address/host. In this attack, and particularly in our case, a malicious server will first perform a domain name resolution to the IP...

High school student rickrolls entire school district, and gets praised

A student at a high school in Cook County successfully hacked into the Internet-of-Things IoT devices of one of the largest school districts in Illinois, and gave everyone a surprise. Minh aka @WhiteHoodHacker on Twitter who attends Elk Grove—a name that curiously resembles the home town of...