WARCannon - High Speed/Low Cost CommonCrawl RegExp In Node.js

WARCannon was built to simplify and cheapify the process of 'grepping the internet'. With WARCannon, you can: Build and test regex patterns against real Common Crawl data Easily load Common Crawl datasets for parallel processing Scale compute capabilities to asynchronously crunch through WARCs at...

Red-Kube - Red Team K8S Adversary Emulation Based On Kubectl

Red Kube is a collection of kubectl commands written to evaluate the security posture of Kubernetes clusters from the attacker's perspective. The commands are either passive for data collection and information disclosure or active for performing real actions that affect the cluster. The commands...

USN-4787-1: jq vulnerability

It was discovered that jq did not perform sufficient bounds checking, resulting in unbounded resource consumption. An attacker could use this vulnerability to cause a denial of service...

CVE-2016-4074 affecting package jq 1.5-6

CVE-2016-4074 affecting package jq 1.5-6. A patched version of the package is available...

CVE-2015-8863 affecting package jq 1.5-6

CVE-2015-8863 affecting package jq 1.5-6. A patched version of the package is available...

One Weird Trick for Reviewing Zeek Logs on the Command Line!

Are you a network security monitoring dinosaur like me? Do you prefer to inspect your Zeek logs using the command line instead of a Web-based SIEM? If yes, try this one weird trick! I store my Zeek logs in JSON format. Sometimes I like to view the output using jq. If I need to search directories ...

Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a denial of service (crash) via a long JSON-encoded number which triggers a heap-based buffer overflow.

...

Spyse.Py - Python API Wrapper And Command-Line Client For The Tools Hosted On Spyse.Com

Python API wrapper and command-line client for the tools hosted on spyse.com. "Spyse is a developer of complete DAAS Data-As-A-Service solutions for Internet security professionals, corporate and remote system administrators, SSL / TLS encryption certificate providers, data centers and business...

com.dtstack:dt-insight-hive-shade (>=4.1.2-RELEASE <=4.1.3), io.eels:eel-hive_2.11 (=1.0.2) +4 more potentially affected by CVE-2017-12625 via org.apache.hive:hive-exec (=2.1.0)

org.apache.hive:hive-exec MAVEN version =2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - com.dtstack:dt-insight-hive-shade =4.1.2-RELEASE, =2.6.1, =2.6.1, =2.7.1 Source cves: CVE-2017-12625 Source...

Fortify SSC 17.10 / 17.20 / 18.10 User Detail Insecure Direct Object Reference

Details ================ Software: Fortify SSC Software Security Center Version: 17.10, 17.20 & 18.10 Homepage: https://www.microfocus.com Advisory report: https://github.com/alt3kx/CVE-2018-7691 CVE: CVE-2018-7691 CVSS: 6.5 Medium; AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CWE-639 Description...

Security fix for the ALT Linux 8 package jq version 1.5-alt3.M80P.1

1.5-alt3.M80P.1 built June 5, 2018 Anton Farygin in task 207483 May 31, 2018 Anton Farygin - security update fixes: CVE-2016-4074...

contact.sh - An OSINT tool to find contacts in order to report security vulnerabilities

An OSINT tool to find contacts in order to report security vulnerabilities. Installation Linux Make sure you have installed the whois and jq packages. $ git clone https://github.com/EdOverflow/contact.sh.git $ cd contact.sh/ $ chmod u+x contact.sh $ ./contact.sh -d google.com -c google OSX $ brew...

Updated jq packages fix security vulnerabilities

A heap-based buffer overflow flaw was found in jq's tokenadd function. By tricking a victim into processing a specially crafted JSON file, an attacker could use this flaw to crash jq or, potentially, execute arbitrary code on the victim's system CVE-2015-8863. Stack exhaustion could affect...

SUSE-SU-2017:2950-1 Security update for jq

This update for jq fixes the following issues: Security issues fixed: - CVE-2016-4074: The jvdumpterm function in jq allowed remote attackers to cause a denial of service stack consumption and application crash via a crafted JSON file. bsc1014176 Non-security issues fixed: - Update tests...

openSUSE Security Update : jq (openSUSE-2017-1190)

This update for jq fixes the following minor security issue : - CVE-2016-4074: stack exhaustion could affect availability when parsing untrusted imput bsc1014176 The following tracked packaging changes are included : - Update tests dependencies to increase test coverage bsc1017157 This update was...

OPENSUSE-SU-2017:2834-1 Security update for jq

This update for jq fixes the following minor security issue: CVE-2016-4074: stack exhaustion could affect availability when parsing untrusted imput bsc1014176 The following tracked packaging changes are included: Update tests dependencies to increase test coverage bsc1017157 This update was...

OPENSUSE-SU-2017:2833-1 Security update for jq

This update for jq fixes the following minor security issue: CVE-2016-4074: stack exhaustion could affect availability when parsing untrusted imput bsc1014176 The following tracked packaging changes are included: Update tests dependencies to increase test coverage bsc1017157 This update was...

Security fix for the ALT Linux 8 package jq version 1.5-alt1.M80P.1

1.5-alt1.M80P.1 built May 11, 2017 Anton Farygin in task 182774 May 10, 2017 Anton Farygin - new version with security fixes CVE-2015-8863...

jq: Buffer overflow

Background jq is a lightweight and flexible command-line JSON processor. Description An off-by-one error was discovered in the tokenadd function in jvparse.c which triggers a heap-based buffer overflow. Impact A remote attacker could trick a victim into processing a specially crafted JSON file,...

GLSA-201612-20 : jq: Buffer overflow

The remote host is affected by the vulnerability described in GLSA-201612-20 jq: Buffer overflow An off-by-one error was discovered in the tokenadd function in jvparse.c which triggers a heap-based buffer overflow. Impact : A remote attacker could trick a victim into processing a specially crafte...