OPENSUSE-SU-2021:0941-1 Security update for tor

This update for tor fixes the following issues: tor 0.4.5.9 Don't allow relays to spoof RELAYEND or RELAYRESOLVED cell CVE-2021-34548, boo1187322 Detect more failure conditions from the OpenSSL RNG code boo1187323 Resist a hashtable-based CPU denial-of-service attack against relays CVE-2021-34549...

Apple Will Offer Onion Routing for iCloud/Safari Users

At this years Apple Worldwide Developer Conference, Apple announced something called "iCloud Private Relay." Thats basically its private version of onion routing, which is what Tor does. Privacy Relay is built into both the forthcoming iOS and MacOS versions, but it will only work if youre an...

PT-2021-4123 · Tor +4 · Tor +4

Name of the Vulnerable Software and Affected Versions: Tor versions prior to 0.4.6.5 Description: The issue is related to the v3 onion service descriptor parsing, which allows out-of-bounds memory access and can cause a client crash via a crafted onion service descriptor. This can be exploited by...

GHSA-RHWP-9VM9-547Q Command Injection in onion-oled-js

This affects all versions up to and including version 0.0.2 of package onion-oled-js. If attacker-controlled user input is given to the scroll function, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization...

Command Injection in onion-oled-js

This affects all versions up to and including version 0.0.2 of package onion-oled-js. If attacker-controlled user input is given to the scroll function, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization...

OS Command Injection

onion-oled-js is vulnerable to OS command injection. An attacker is able to inject and execute arbitrary OS command via the scroll function due to the usage of exec with untrusted user input...

CVE-2021-23377 Arbitrary Command Injection

This affects all versions of package onion-oled-js. If attacker-controlled user input is given to the scroll function, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization...

CVE-2021-23377

This affects all versions of package onion-oled-js. If attacker-controlled user input is given to the scroll function, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization...

npm onion-oled-js 命令注入漏洞

npm onion-oled-js is an application from the American company npm. A JS library is provided that exposes a collection of functions that wrap the oled-exp executable that controls the onion omega OLED display. A security vulnerability exists in onion-oled-js that can be exploited by an attacker to...

CVE-2021-21323

Brave is an open source web browser with a focus on privacy and security. In Brave versions 1.17.73-1.20.103, the CNAME adblocking feature added in Brave 1.17.73 accidentally initiated DNS requests that bypassed the Brave Tor proxy. Users with adblocking enabled would leak DNS requests from Tor...

Arbitrary Command Injection

Overview onion-oled-js is a JS library that exposes a collection of functions that wrap the oled-exp executable that controls the onion omega OLED display. Affected versions of this package are vulnerable to Arbitrary Command Injection. If attacker-controlled user input is given to the scroll...

Privacy Bug in Brave Browser Exposes Dark-Web Browsing History of Its Users

Brave has fixed a privacy issue in its browser that sent queries for .onion domains to public internet DNS resolvers rather than routing them through Tor nodes, thus exposing users' visits to dark web websites. The bug was addressed in a hotfix release V1.20.108 made available yesterday. Brave...

Privacy Bug in Brave Browser Exposes Dark-Web Browsing History of Its Users

Brave has fixed a privacy issue in its browser that sent queries for .onion domains to public internet DNS resolvers rather than routing them through Tor nodes, thus exposing users' visits to dark web websites. The bug was addressed in a hotfix release V1.20.108 made available yesterday. Brave...

Brave Software: Onion-Location header allows to open arbitrary URLs including chrome:

The "Open in Tor" feature in Brave Nightly for OSX allowed arbitrary URLs to be opened through the Onion-Location response header, including privileged URLs such as chrome://restart/. This could be exploited to bypass SOP restrictions and gain access to privileged URLs...

OnionSearch - A Script That Scrapes Urls On Different .Onion Search Engines

OnionSearch is a Python3 script that scrapes urls on different ".onion" search engines. Prerequisite Python 3  Currently supported Search engines ahmia darksearchio onionland notevil darksearchenginer phobos onionsearchserver torgle onionsearchengine tordex tor66 tormax haystack multivac evosear...

CVE-2020-27985

Security Onion v2 prior to 2.3.10 has an incorrect sudo configuration, which allows the administrative user to obtain root access without using the sudo password by editing and executing /home//SecurityOnion/setup/so-setup...

CVE-2020-27985

Security Onion v2 prior to 2.3.10 has an incorrect sudo configuration, which allows the administrative user to obtain root access without using the sudo password by editing and executing /home//SecurityOnion/setup/so-setup...

Design/Logic Flaw

Security Onion v2 prior to 2.3.10 has an incorrect sudo configuration, which allows the administrative user to obtain root access without using the sudo password by editing and executing /home//SecurityOnion/setup/so-setup...

CVE-2020-27985

Security Onion v2 prior to 2.3.10 has an incorrect sudo configuration, which allows the administrative user to obtain root access without using the sudo password by editing and executing /home//SecurityOnion/setup/so-setup...

CVE-2020-27985

Security Onion v2 prior to 2.3.10 contains a misconfigured sudo setup that allows the administrative user to obtain root access without a password by editing and executing /home//SecurityOnion/setup/so-setup. The issue is a local privilege escalation affecting deployments based on the affected 2....