UBUNTU-CVE-2021-22095

In Spring AMQP versions 2.2.0 - 2.2.19 and 2.3.0 - 2.3.11, the Spring AMQP Message object, in its toString method, will create a new String object from the message body, regardless of its size. This can cause an OOM Error with a large message...

CVE-2021-22095

In Spring AMQP versions 2.2.0 - 2.2.19 and 2.3.0 - 2.3.11, the Spring AMQP Message object, in its toString method, will create a new String object from the message body, regardless of its size. This can cause an OOM Error with a large message...

Prototype Pollution in fabiocaccamo/utils.js

Summary I discovered a prototype pollution vulnerability via utils.js method analysis. javascript set: functionobj, path, value var keys = path.split'.'; var key; var cursor = obj; for var i = 0, j = keys.length; i j; i++ key = keysi; if !TypeUtil.isObjectcursorkey cursorkey = ; if i j - 1 cursor...

Tobesoft Nexacro 输入验证错误漏洞

Tobesoft Nexacro is a unified framework-based OSMU single-source multi-purpose application development solution from Tobesoft, South Korea. Nexacro 17 suffers from a security vulnerability that stems from an arbitrary file creation due to incorrect input validation found in the copy method of the...

Ruby on Rails: Escape Sequence Injection vulnerability in Rack

An escape sequence injection vulnerability was discovered in the Rack framework's commonlogger. This vulnerability allowed an attacker to inject escape sequences into logs, potentially leading to the execution of dangerous control characters on a victim's terminal emulator...

Spring-AMQP Remote Denial of Service - Out of Memory Error with a Large Message Body

The Spring AMQP Message object, in its toString method, will create a new String object from the message body, regardless of its size. This can cause an OOM Error with a large message body...

4-ZERO-3 - 403/401 Bypass Methods + Bash Automation

Introduction 4-ZERO-3 Tool to bypass 403/401. This script contain all the possible techniques to do the same. NOTE : If you see multiple 200 Ok/bypasses as output, you must check the Content-Length. If the content-length is same for multiple 200 Ok/bypasses means false positive. Reason can be...

Rocket.Chat: getUsersOfRoom discloses users in private channels

Summary Improper input data validation in the getUsersOfRoom Meteor server method allows authenticated users to enumerate existing rooms and subscribed users. Description Input data in the getUsersOfRoom Meteor server method is not type validated, so that MongoDB query operator objects are accept...

XVIDEOS: CSRF on delete friend requests - Not protected with CSRF Token

Summary: Hello XVideos Security Team, The is a possibility of CSRF on the POST method when deleting friend requests that are sent by the users. Any user can send the malicious contents to perform the post method in order to delete a friend request for a specific member. Steps To Reproduce: 1. Log...

Exploit for CVE-2021-42321

This repository is a proof-of-concept PoC exploit for CVE-2021-42321, a vulnerability in Microsoft Exchange Server. The PoC is written in Python and uses the requests library to send a SOAP request to the Exchange server. The exploit targets the Exchange server's GetFolder method, which can be us...

resteasy: Error message exposes endpoint class information

A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to the matching JAX-RS resource method's parameter value. The...

Command injection

This affects all versions of package docker-cli-js. If the command parameter of the Docker.command method can at least be partially controlled by a user, they will be in a position to execute any arbitrary OS commands on the host system...

Rocket.Chat: Message ID Enumeration with Action Link Handler

Summary The actionLinkHandler method was found to allow Message ID Enumeration with Regex MongoDB queries. Releases Affected: The Meteor method actionLinkHandler calls an actionLinks wrapper getMessage to find affected messages: javascript Meteor.methods actionLinkHandlername, messageId if...

November 22, 2021—KB5007262 (OS Build 22000.348) Preview

None None...

Ivanti Avalanche EnterpriseServer Service Unrestricted File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the saveConfig method. The...

rubygem-actionpack: Possible Information Disclosure / Unintended Method Execution in Action Pack

A flaw was found in rubygem-actionpack. Information disclosure or unintended method execution is possible when using the redirectto or polymorphicurl helper with untrusted user input. The highest threat from this vulnerability is to data confidentiality...

redeem may return less than minOut

Handle gzeon Vulnerability details Impact redeem may return less than minOut if wrong token is supplied with poolID=3 because there is no check against minOut in L230-L232. Proof of Concept 1. User mistakenly call redeemUSDC, 100, 3, 0, 100 2. The contract take 100 bBTC from the user, redeem it...

resteasy: Error message exposes endpoint class information

A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to the matching JAX-RS resource method's parameter value. The...

RHEL 7 / 8 : OpenShift Container Platform 4.9.6 packages and (RHSA-2021:4118)

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4118 advisory. - haproxy: does not ensure that the scheme and path portions of a URI have the expected characters CVE-2021-39240 - haproxy: an HTTP...

EulerOS 2.0 SP9 : haproxy (EulerOS-SA-2021-2712)

According to the versions of the haproxy package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in HAProxy 2.0 before 2.0.24, 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. An HTTP method name may contai...