Kali Linux 2021.4 released with Samba compatibility, Apple M1 support, 9 new tools

By Waqas The release of the new Kali Linux 2021.4 has been grabbing headlines for the array of new capabilities and tools embedded with it. This is a post from HackRead.com Read the original post: Kali Linux 2021.4 released with Samba compatibility, Apple M1 support, 9 new tools...

F5 Networks BIG-IP : Apache Tomcat vulnerability (K32469285)

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K32469285 advisory. Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP...

Fixed in Apache Tomcat 10.1.0-M6

Important: Denial of Service CVE-2021-42340 The fix for bug 63362 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the WebSocket connection was closed. This created a memory leak that, over time, could...

Eclipse Californium 数据伪造问题漏洞

Eclipse Californium is a Java-based codebase from the Eclipse Foundation that provides Coap backend support for the Internet of Things. A data forgery vulnerability exists in Eclipse Californium, which arises when the product on the client side does not validate certificates from the server side...

Apache Tomcat 9.0.0.M1 < 9.0.48

The version of Tomcat installed on the remote host is prior to 9.0.48. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat9.0.48security-9 advisory. - Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP...

Apache Tomcat 9.0.0.M1 < 9.0.48 Request Smuggling

The version of Apache Tomcat installed on the remote host is 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.47 or 8.5.0 to 8.5.67. It is, therefore, affected by a request smuggling because Apache Tomcat did not correctly parse the HTTP transfer-encoding request header in some circumstances when used with a...

Apache Tomcat 10.0.0-M1 < 10.0.6 Authentication Weakness

The version of Apache Tomcat installed on the remote host is 10.0.0-M1 to 10.0.5, 9.0.0.M1 to 9.0.45, 8.5.0 to 8.5.65 or 7.0.0 to 7.0.108. It is, therefore, affected by an authentication weakness due to queries made by the JNDI Realm which did not always correctly escape parameters. Note that the...

Apache Tomcat 9.0.0.M1 < 9.0.46 Authentication Weakness

The version of Apache Tomcat installed on the remote host is 10.0.0-M1 to 10.0.5, 9.0.0.M1 to 9.0.45, 8.5.0 to 8.5.65 or 7.0.0 to 7.0.108. It is, therefore, affected by an authentication weakness due to queries made by the JNDI Realm which did not always correctly escape parameters. Note that the...

Apache Tomcat 9.0.0.M1 - Open Redirect

Exploit Title: Apache Tomcat 9.0.0.M1 - Open Redirect Date: 10/04/2018 Exploit Author: Central InfoSec Version: Apache Tomcat 9.0.0.M1 to 9.0.0.11, 8.5.0 to 8.5.33, and 7.0.23 to 7.0.90 CVE : CVE-2018-11784 Proof of Concept: Identify a subfolder within your application http://example.com/test/...

Apache Tomcat 9.0.0.M1 Cross Site Scripting

Exploit Title: Apache Tomcat 9.0.0.M1 - Cross-Site Scripting XSS Date: 05/21/2019 Exploit Author: Central InfoSec Version: Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39, and 7.0.0 to 7.0.93 CVE : CVE-2019-0221 Requirements: SSI support must be enabled within Apache Tomcat. SSI support is no...

Apple Silicon Support on Insight Agent

We are pleased to announce the general availability of native support of Apple Silicon chips for the Rapid7 Insight Agent! The Insight Agent has been fully validated and tested to run on the new Apple Silicon systems natively, and does not require Rosetta 2 to install or operate. This ensures...

Security Vulnerability in Apple’s Silicon “M1” Chip

The website for the M1racles security vulnerability is an excellent demonstration that not all vulnerabilities are exploitable. Be sure to read the FAQ through to the end. EDITED TO ADD: Wired article...

Apple’s M1 Chip Has a Fascinating Flaw

The covert channel bug is harmless, but it demonstrates that even new CPUs have mistakes in them...

Malware That Spreads Via Xcode Projects Now Targeting Apple's M1-based Macs

A Mac malware campaign targeting Xcode developers has been retooled to add support for Apple's new M1 chips and expand its features to steal confidential information from cryptocurrency apps. XCSSET came into the spotlight in August 2020 after it was found to spread via modified Xcode IDE project...

XCSSET Quickly Adapts to macOS 11 and M1-based Macs

This latest update details our new research on XCSSET, including the ways in which it has adapted itself to work on both ARM64 and x86x64 Macs...

Exploiting Spectre Over the Internet

Google has demonstrated exploiting the Spectre CPU attack remotely over the web: Today, were sharing proof-of-concept PoC code that confirms the practicality of Spectre exploits against JavaScript engines. We use Google Chrome to demonstrate our attack, but these issues are not specific to Chrome...

Good old malware for the new Apple Silicon platform

Introduction A short while ago, Apple released Mac computers with the new chip called Apple M1. The unexpected release was a milestone in the Apple hardware industry. However, as technology evolves, we also observe a growing interest in the newly released platform from malware adversaries. This...

Fixed in Apache Tomcat 10.0.4

Note: The issue below was fixed in Apache Tomcat 10.0.3 but the release vote for the 10.0.3 release candidate did not pass. Therefore, although users must download 10.0.4 to obtain a version that includes a fix for these issues, version 10.0.3 is not included in the list of affected versions...

Apache Tomcat 9.0.0.M1 < 9.0.43 Multiple Vulnerabilities

The version of Apache Tomcat installed on the remote host is 10.0.0-M1 to 10.0.1, 9.0.0.M1 to 9.0.42, 8.5.0 to 8.5.62 or 7.0.0 to 7.0.107. It is, therefore, affected by a remote code execution due to an incomplete fix for CVE-2020-9484 and an information diclosure due to request mix-up with h2c...

Apache Tomcat 10.0.0-M1 < 10.0.2 Multiple Vulnerabilities

The version of Apache Tomcat installed on the remote host is 10.0.0-M1 to 10.0.1, 9.0.0.M1 to 9.0.42, 8.5.0 to 8.5.62 or 7.0.0 to 7.0.107. It is, therefore, affected by a remote code execution due to an incomplete fix for CVE-2020-9484 and an information diclosure due to request mix-up with h2c...