Gitlab -- multiple vulnerabilities

Gitlab reports: Potential Denial Of Service Via Update Release Links API Insecure Storage of Session Key In Redis Improper Access Expiration Date Validation Cross-Site Scripting in Multiple Pages Unauthorized Users Can View Custom Project Template Cross-Site Scripting in SVG Image Preview...

Security Bulletin: Version 5.0.5 of Redis included in IBM Netcool Operations Insight 1.6.1.x has a security vulnerability (CVE-2020-14147)

Summary Security Bulletin: Version 5.0.5 of Redis included in IBM Netcool Operations Insight 1.6.1.x has a security vulnerability Vulnerability Details CVEID: CVE-2020-14147 DESCRIPTION: Redis is vulnerable to a denial of service, caused by an integer overflow in the getnum function in luastruct....

Security Bulletin: IBM Event Streams is affected by a Redis vulnerability (CVE-2020-14147)

Summary IBM Event Streams is affected by a Redis vulnerability utlised by the UI component Vulnerability Details CVEID: CVE-2020-14147 DESCRIPTION: Redis is vulnerable to a denial of service, caused by an integer overflow in the getnum function in luastruct.c in Redis. By sending a specially...

Gopherus

This is a Python script for a tool called Gopherus, which is used to exploit Server-Side Request Forgery SSRF vulnerabilities in various services. The tool can generate payloads for different services, including MySQL, PostgreSQL, FastCGI, Memcached, Redis, Zabbix, and SMTP. The script uses a...

Fedora 32 : php-symfony4 (2020-16eb328853)

Version 4.4.13 2020-09-02 - security CVE-2020-15094 Remove headers with internal meaning from HttpClient responses mpdude - bug 38024 Console Fix undefined index for inconsistent command name definition chalasr - bug 38023 DI fix inlining of non-shared services nicolas-grekas - bug 38020...

Reflected Cross-Site Scripting in redis-commander

Affected versions of redis-commander contain a cross-site scripting vulnerability in the highlighterId paramter of the clipboard.swf component on hosts serving Redis Commander. Mitigating factors: Flash must be installed / enabled for this to work. The below proof of concept was verified to work...

GHSA-8C8C-4VFJ-RRPC Reflected Cross-Site Scripting in redis-commander

Affected versions of redis-commander contain a cross-site scripting vulnerability in the highlighterId paramter of the clipboard.swf component on hosts serving Redis Commander. Mitigating factors: Flash must be installed / enabled for this to work. The below proof of concept was verified to work...

Photon OS 2.0: Redis PHSA-2020-2.0-0278

An update of the redis package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-2.0-0278. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid140122...

GLSA-202008-17 : Redis: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202008-17 Redis: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Redis. Please review the CVE identifiers referenced below for details. Impact : Please review the referenced CVE identifiers for details...

Redis: Multiple vulnerabilities

Background Redis is an open source BSD licensed, in-memory data structure store, used as a database, cache and message broker. Description Multiple vulnerabilities have been discovered in Redis. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CV...

Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2020-2.0-0278

An update of 'redis' packages of Photon OS has been released...

pocsuite3-1

This is a PoC Proof of Concept framework for vulnerability testing and penetration testing, developed by the Knownsec 404 Team. The framework is called pocsuite3. The framework has a powerful proof-of-concept engine and many features for penetration testers and security researchers. It supports...

An integer overflow in the getnum function in lua_struct.c in Redis before 6.0.3 allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service (memory corruption and application crash) or possibly bypass intended sandbox restrictions via a large number which triggers a stack-based buffer overflow. NOTE: this issue exists because of a CVE-2015-8080 regression.

...

Gopherus

This is a Python script that generates payloads for exploiting Server-Side Request Forgery SSRF vulnerabilities in various services, including MySQL, PostgreSQL, FastCGI, Memcached, Redis, Zabbix, and SMTP. The script uses a variety of techniques to generate payloads, including Python, Ruby, and...

Security Bulletin: Possible denial of service attack affecting Watson Knowledge Catalog for IBM Cloud Pak for Data

Summary A vulnerability in the Redis service packaged as part of Watson Knowledge Catalog for IBM Cloud Pak for Data could lead to denial of service attacks. The issue is now addressed. Vulnerability Details CVEID: CVE-2020-14147 DESCRIPTION: Redis is vulnerable to a denial of service, caused by ...

MGASA-2020-0312 Updated redis packages fix security vulnerability

An integer overflow in the getnum function in luastruct.c CVE-2020-14147...

Updated redis packages fix security vulnerability

An integer overflow in the getnum function in luastruct.c CVE-2020-14147...

GHSA-976R-QFJJ-C24W Command injection via Celery broker in Apache Airflow

An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker Redis, RabbitMQ directly, it is possible to inject commands, resulting in the celery worker running arbitrary commands...

Command injection via Celery broker in Apache Airflow

An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker Redis, RabbitMQ directly, it is possible to inject commands, resulting in the celery worker running arbitrary commands...

openSUSE Security Update : redis (openSUSE-2020-1035)

This update for redis fixes the following issues : - CVE-2020-14147: Context dependent attackers with permission to run Lua code in a Redis session could have caused a denial of service memory corruption and application crash or possibly bypass sandbox restrictions boo1173018 C Tenable Network...