National Keep CyberMath Cross-Site Request Forgery Vulnerability

National Keep CyberMath is a cybersecurity risk analysis tool for organizations from National Keep. A cross-site request forgery vulnerability exists in National Keep CyberMath versions v1.4 through v1.5 that stems from vulnerability to cross-site request forgery CSRF attacks...

National Keep CyberMath Cross-Site Scripting Vulnerability

National Keep CyberMath is a cybersecurity risk analysis tool for organizations from National Keep. A cross-site scripting vulnerability exists in National Keep CyberMath versions v1.4 through v1.5 that stems from improper input neutralization during web page generation, resulting in a reflected...

Metasploit Weekly Wrap-Up 01/12/24

New module content 1 Windows Gather Mikrotik Winbox "Keep Password" Credentials Extractor Author: Pasquale 'sid' Fiorillo Type: Post Pull request: 18604 contributed by siddolo Path: windows/gather/credentials/winboxsettings Description: This pull request introduces a new post module to extract th...

Windows Gather Mikrotik Winbox "Keep Password" Credentials Extractor

This module extracts Mikrotik Winbox credentials saved in the "settings.cfg.viw" file when the "Keep Password" option is selected in Winbox. Module Options msf use post/windows/gather/credentials/winboxsettings msf postwinboxsettings show actions ...actions... msf postwinboxsettings set ACTION ms...

PT-2023-30187 · Huawei · Harmonyos

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue concerns a vulnerability in the remote PIN module that causes incorrect information storage locations, potentially affecting confidentiality...

CVE-2023-41310

Keep-alive vulnerability in the sticky broadcast mechanism. Successful exploitation of this vulnerability may cause malicious apps to run continuously in the background...

Design/Logic Flaw

Keep-alive vulnerability in the sticky broadcast mechanism. Successful exploitation of this vulnerability may cause malicious apps to run continuously in the background...

HTTP Request/Response Smuggling

gevent is vulnerable to HTTP Request/Response Smuggling. The vulnerability is caused by a missing validation check on trailers in processing of chunked requests in the WSGI application on keep-alive connections. This can lead to an attacker carefully crafting invalid trailers in chunked requests...

CVE-2023-41310

CVE-2023-41310 relates to Huawei HarmonyOS and describes a keep-alive vulnerability in the sticky broadcast mechanism. The underlying issue could allow malicious apps to run continuously in the background. Available connected documents confirm the affected product family (HarmonyOS) and the gener...

PT-2023-27897 · Huawei · Emui +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue concerns a keep-alive vulnerability in the sticky broadcast mechanism. This vulnerability can be exploited to cause malicious apps to run...

NLnet Labs’ Routinator vulnerable to path traversal

NLnet Labs’ Routinator 0.9.0 up to and including 0.12.1 contains a possible path traversal vulnerability in the optional, off-by-default keep-rrdp-responses feature that allows users to store the content of responses received for RRDP requests. The location of these stored responses is constructe...

CVE-2023-39916

NLnet Labs’ Routinator 0.9.0 up to and including 0.12.1 as well as 0.14.0 up to and including 0.14.2 contains a possible path traversal vulnerability in the optional, off-by-default keep-rrdp-responses feature that allows users to store the content of responses received for RRDP requests. The...

CVE-2023-39916

NLnet Labs’ Routinator 0.9.0 up to and including 0.12.1 as well as 0.14.0 up to and including 0.14.2 contains a possible path traversal vulnerability in the optional, off-by-default keep-rrdp-responses feature that allows users to store the content of responses received for RRDP requests. The...

Path traversal

NLnet Labs’ Routinator 0.9.0 up to and including 0.12.1 contains a possible path traversal vulnerability in the optional, off-by-default keep-rrdp-responses feature that allows users to store the content of responses received for RRDP requests. The location of these stored responses is constructe...

PT-2023-27151

Name of the Vulnerable Software and Affected Versions Routinator versions 0.9.0 through 0.12.1 Description The issue concerns a possible path traversal vulnerability in the optional, off-by-default keep-rrdp-responses feature of Routinator. This feature allows users to store the content of...

Huawei HarmonyOS Resource Management Error Vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A security vulnerability exists in Huawei HarmonyOS, which stems from a keep-alive vulnerability in the sticky broadcast mechanism. Successful exploitation o...

Malicious code in fc-keep-alive (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 367d61b371f78d311258a9310bdaf603198ee29c664779d5fc9777c75b51e4ab Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

yio-cli (=1.0.0) potentially affected by CVE-2023-26128 via keep-module-latest (=1.0.1)

keep-module-latest NPM version =1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on keep-module-latest and may be impacted: - yio-cli =1.0.0 Source cves: CVE-2023-26128 Source advisory: OSV:GHSA-WXRX-PC44-RCGC...

GHSA-WXRX-PC44-RCGC keep-module-latest vulnerable to Command Injection due to missing input sanitization

All versions of the package keep-module-latest are vulnerable to Command Injection due to missing input sanitization or other checks and sandboxes being employed to the installModule function. Note: To execute the code snippet and potentially exploit the vulnerability, the attacker needs to have...

CVE-2023-26128

CVE-2023-26128 affects the Node.js package keep-module-latest. All versions are vulnerable to Command Injection due to missing input sanitization when calling the installModule function. The vulnerability requires the attacker to run Node.js code in the target environment (local access), enabling...