GHSA-QH54-9VC5-M9FG MD5 hash support in github.com/foxcpp/maddy

Impact This vulnerability affects maddy 0.5.1, 0.5.0 users using auth.shadow module and an extremely outdated system that still allows MD5 hashes in /etc/shadows. Patches Patch is available as part of the 0.5.2 release. Workarounds Ensure MD5 hashes are not present in /etc/shadow...

Mozilla Firefox ESR < 78.15

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 78.15. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-44 advisory. - Mozilla developers and community members Andreas Pehrson and Christian Holler reported memory safety bug...

The 2021 OWASP Top 10 Have Evolved: Here's What You Should Know

Late last week, the Open Web Application Security Project OWASP released its top 10 list of critical web application security risks. The last OWASP Top 10 came out in 2017, and in the intervening 4 years, we've seen a fundamental shift in application security that includes greater emphasis on...

A9: Using Components with Known Vulnerabilities ❗️ — Top 10 OWASP 2017

A9: Using Components with Known Vulnerabilities ❗️ — Top 10 OWASP 2017 Introduction A9: Using Components with Known Vulnerabilities What are Components With Known Vulnerabilities? Top 10 OWASP describes the term components as a very broad term. It can either be a full piece of software that our...

UPchieve: Outdated Copyright Message @ Welcome email

POC : Description : Outdated Copyright is present @ Welcome to UPchieve! email which is of years "2020" Impacted Security Property : Integrity ASVS Categories : Architecture , Design and Threat Modeling POC email and video : Gmail - Welcome to UPchieve!.pdf and recording-1632912432386.webm...

PVS 1912:Unable to merge vdisk "vDisk versions are not up to date on all Servers that access this vDisk. Update all "

Unable to merge the old versions of vdisk. Error message when we attempt merge: "vDisk versions are not up to date on all Servers that access this vDisk. Update all Servers with the lastest versions of the vDisk files"...

Apache < 2.4.49 Multiple Vulnerabilities

The version of Apache httpd installed on the remote host is prior to 2.4.49. It is, therefore, affected by multiple vulnerabilities as referenced in the 2.4.49 changelog. - apescapequotes may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to...

Cring Ransomware Gang Exploits 11-Year-Old ColdFusion Bug

Unidentified threat actors breached a server running an unpatched, 11-year-old version of Adobe's ColdFusion 9 software in minutes to remotely take over control and deploy file-encrypting Cring ransomware on the target's network 79 hours after the hack. The server, which belonged to an unnamed...

Moxa Command Injection / Cross Site Scripting Vulnerabilities

======================================================================= title: Multiple vulnerabilities product: see "Vulnerable / tested versions" vulnerable version: see "Vulnerable / tested versions" fixed version: see "Solution" CVE number: CVE-2021-39278, CVE-2021-39279 impact: High homepage...

Moxa Command Injection / Cross Site Scripting / Vulnerable Software

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: see "Vulnerable / tested versions" vulnerable version: see "Vulnerable / tested versions" fixed version: see "Solution" CVE number:...

Altus Sistemas de Automacao Products CSRF / Command Injection / Hardcoded Credentials Vulnerability

======================================================================= title: Multiple Critical Vulnerabilities product: Multiple Altus Sistemas de Automacao products: Nexto NX30xx Series Nexto NX5xxx Series Nexto Xpress XP3xx Series Hadron Xtorm HX3040 Series vulnerable version: See "Vulnerable...

PT-2021-6499

Name of the Vulnerable Software and Affected Versions datatables.net versions prior to 1.11.3 Description The issue is related to the incorrect handling of an array in the input data by the DataTables plugin, which can allow a remote attacker to compromise data integrity. If an array is passed to...

openSUSE 15 Security Update : nodejs8 (openSUSE-SU-2021:2618-1)

"The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:2618-1 advisory. - This affects the package y18n before 3.2.2, 4.0.1 and 5.0.5. PoC by po6ix: const y18n = require'y18n' %NASLMINLEVEL 70300 C Tenable...

CVE-2021-29972

A use-after-free vulnerability was found via testing, and traced to an out-of-date Cairo library. Updating the library resolved the issue, and may have remediated other, unknown security vulnerabilities as well. This vulnerability affects Firefox 90...

UBUNTU-CVE-2021-29972

A use-after-free vulnerability was found via testing, and traced to an out-of-date Cairo library. Updating the library resolved the issue, and may have remediated other, unknown security vulnerabilities as well. This vulnerability affects Firefox 90...

Mozilla Firefox 资源管理错误漏洞

Mozilla Firefox is an open source Web browser from the Mozilla Foundation, U.S. Mozilla Firefox is vulnerable to a resource management error that stems from a post-release usage error in the outdated Cairo library. An attacker could exploit the vulnerability to create a specially crafted web page...

[SECURITY] Fedora 34 Update: perl-Mojolicious-8.73-2.fc34

Back in the early days of the web there was this wonderful Perl library called CGI, many people only learned Perl because of it. It was simple enough to get started without knowing much about the language and powerful enough to keep you going, learning by doing was much fun. While most of the...

Top 10 Cloud security tips

About half of the pen tests we’re asked to do involved cloud services at some point. We’ve even tested a cloud platform on an aeroplane – the irony was not lost on us! There is a multitude of ways to improve the security of your cloud platforms and often those ways are ever-changing or obscured...

Huawei EulerOS: Security Advisory for curl (EulerOS-SA-2021-2132)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the fly-qdm GUI input software, related to a code error, allows a intruder to access confidential data.

The vulnerability of the fly-qdm GUI login software lies in the absence of a warning when an outdated password is used during password changes. Exploiting this vulnerability allows a remote attacker to gain access to confidential data...