bcash-instadump (>=0.3.3, <=0.4.0), bcoin-stratum (0.0.1) +2 more potentially affected by CVE-2018-17145 via bcoin (>=1.0.0-beta, <=1.0.0-beta.14)

bcoin NPM version =1.0.0-beta, =0.3.3, =1.0.0, =2.1.1 - ihan 0.4.0 Source cves: CVE-2018-17145 Source advisory: OSV:GHSA-HX3R-JV9Q-85JW...

Keybase: Persistent XSS on keybase.io via "payload" field in `/user/sigchain_signature.toffee` template

Issue Keybase allows you to see other users' sigchains by navigating to /sigchain. The "Payload" field containing JSON related to the chainlink on the right side of the page is not correctly escaped during templating, leading to a persistent XSS as users have a high degree of control over the...

AWS OpenVPN Deployment Tool: AutoVPN

AWS OpenVPN Deployment Tool Dependencies: boto and paramiko python packages and aws .credentials file on system 1. Clone repo to system. 2. Execute autovpn with -C -k and -r options to deploy to AWS ./autovpn -C -r us-east-1 -k macbook 3. OpenVPN config files are downloaded to current working...

Ceragon FibeAir IP-10 SSH Private Key Exposure Vulnerability

Ceragon FibeAir IP-10 suffers from an SSH private key exposure vulnerability. Ceragon FibeAir IP-10 SSH Private Key Exposure CVE-2015-0936 Product Description Ceragon produces a series of ruggedized, microwave backhaul devices used to provide connectivity to mobile, IP-based devices; usually, the...

CVE-2001-1380

OpenSSH before 2.9.9, while using keypairs and multiple keys of different types in the /.ssh/authorizedkeys2 file, may not properly handle the "from" option associated with a key, which could allow remote attackers to login from unauthorized IP addresses...

OpenSSH: sftp &amp; bypassing keypair auth restrictions

OpenSSH: sftp-server & bypassing keypair auth restrictions Summary: If you 1 are using keypairs and /.ssh/authorizedkeys2 to enable remote execution of commands via OpenSSH's sshd and 2 have sshd configured to provide sftp service via the sftp-server subsystem, then clients who have access with...