2854 matches found
DEBIAN-CVE-2021-41039
In versions 1.6 to 2.0.11 of Eclipse Mosquitto, an MQTT v5 client connecting with a large number of user-property properties could cause excessive CPU usage, leading to a loss of performance and possible denial of service...
UBUNTU-CVE-2021-41039
In versions 1.6 to 2.0.11 of Eclipse Mosquitto, an MQTT v5 client connecting with a large number of user-property properties could cause excessive CPU usage, leading to a loss of performance and possible denial of service...
Business-Dna Solution GmbH TopEase Cross-Site Scripting Vulnerability
Business-Dna Solution GmbH TopEase is a "transformational risk" solution from the Swiss company Business-Dna Solution GmbH. A cross-site scripting vulnerability exists in Business-Dna Solution GmbH TopEase, which can be exploited by attackers to inject arbitrary HTML and JavaScript into object...
Business-Dna Solution GmbH TopEase 输入验证错误漏洞
Business-Dna Solution GmbH TopEase is a "transformation risk" solution from the Swiss company Business-Dna Solution GmbH. Business-Dna Solution GmbH TopEase is vulnerable to an input validation error that could be exploited by an attacker to insert an unexpected format that would make the affecte...
CVE-2021-44225
In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user to inspect and manipulate any property. This leads to access-control bypass in some situations in which an unrelated D-Bus system service has a settable writable property...
AZL-6508 CVE-2021-44225 affecting package keepalived for versions less than 2.2.7-1
In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user to inspect and manipulate any property. This leads to access-control bypass in some situations in which an unrelated D-Bus system service has a settable writable property...
GHSA-VPF5-82C8-9V36 Prototype Pollution in algoliasearch-helper
The package algoliasearch-helper before 3.6.2 are vulnerable to Prototype Pollution due to use of the merge function in src/SearchParameters/index.jsSearchParameters.parseNumbers without any protection against prototype properties. Note that this vulnerability is only exploitable if the...
Whispers - Identify Hardcoded Secrets In Static Structured Text
"My little birds are everywhere, even in the North, they whisper to me the strangest stories." - Lord Varys Whispers is a static code analysis tool designed for parsing various common data formats in search of hardcoded credentials and dangerous functions. Whispers can run in the CLI or you can...
Researchers Demonstrate New Way to Detect MitM Phishing Kits in the Wild
No fewer than 1,220 Man-in-the-Middle MitM phishing websites have been discovered as targeting popular online services like Instagram, Google, PayPal, Apple, Twitter, and LinkedIn with the goal of hijacking users' credentials and carrying out further follow-on attacks. The findings come from a ne...
CVE-2021-29843
IBM MQ 9.1 LTS, 9.1 CD, 9.2 LTS, and 9.2CD is vulnerable to a denial of service attack caused by an issue processing message properties. IBM X-Force ID: 205203...
CVE-2021-42370
A password mismanagement situation exists in XoruX LPAR2RRD and STOR2RRD before 7.30 because cleartext information is present in HTML password input fields in the device properties. Viewing the passwords requires configuring a web browser to display HTML password input fields...
Hardcoded credentials
A password mismanagement situation exists in XoruX LPAR2RRD and STOR2RRD before 7.30 because cleartext information is present in HTML password input fields in the device properties. Viewing the passwords requires configuring a web browser to display HTML password input fields...
Unspecified vulnerability in Deoxxa dotty
Deoxxa Dotty is a Javascript-based code base used by Deoxxa individual developers to support access to object properties. deoxxa dotty has a security vulnerability that stems from a design or implementation impropriety in the code development process of a web-based system or product. No details o...
Prototype Pollution
dotty is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes via the put function and modify attributes such as proto, constructor, and prototype...
Prototype Pollution
jsonpointer is vulnerable to prototype pollution vulnerability. An attacker is able to inject arbitrary properties into existing construct prototypes and modification of attributes such as proto, constructor and prototype...
Fedora: Security Advisory for libzapojit (FEDORA-2021-77ce69dba6)
The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Prototype Pollution
x-assign is vulnerable to prototype pollution. An attacker is able to inject malicious properties into existing construct prototypes and modify attributes using the proto object...
q-logger skimmer keeps Magecart attacks going
This blog post was authored by Jérôme Segura Although global e-commerce is continuing to grow rapidly, it seems as though Magecart attacks via digital skimmers have not followed the same trend. This is certainly true if we only look at recent newsworthy attacks; indeed when a victim is a large...
