New Relic: Reflected Cross site Scripting (XSS) on https://one.newrelic.com

The attacker can execute javascript on the victims account just after the authentication process. Steps To Reproduce: 1 Open the url:...

New Relic: Verification Link not expiring leading to Account Takeover.

@bbunnny reported that verification links that are sent out on account creation can be used to access a victim's account until those links have expired. As access to those links requires that an attacker have access to the victim's email, this issue is out of scope for our program...

Build a Complete Cloud Visibility Strategy

Trend Micro Cloud One + New Relic come together to offer complete cloud visibility...

The vulnerability of the com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource component in the Jackson-databind library of the FasterXML project allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource component in the Jackson-databind library of the FasterXML project is related to the restoration of unreliable data in memory. Exploiting this vulnerability can allow an attacker to compromise the...

New Relic: GitHub Integration doesn't sanitize repository URLs which might be attacker-controlled

New Relic's integration of Github repos had an implicit assumption that URL's for repos would not need to be sanitized. The researcher demonstrated that an attacker can return a manually configure the htmlurl value on an attacker controlled server emulating the Github API. A victim would need to...

New Relic: Steal any user in your orgs private GitHub token by pointing the GH integration at an attacker controlled GHE instance

@archangel reported that a flaw in New Relic's Github configuration could have allowed a malicious actor to steal the private GitHub token of any user in the organization by pointing the GH integration at an attacker-controlled GHE instance...

New Relic: HTML Injection In Email In one.newrelic.com

Hi, There's a HTML injection vulnerability present inside emails sent from Newrelic when the name on the organization inviting user contains HTML. The html is stored in the backend database and when emails are sent invitation, the HTML is sent along with the rest of the email. Steps to reproduce:...

Diego F. Aranha relic input validation error vulnerability

Diego F.Aranha relic is a Diego F.Aranha open source application. A modern cryptographic meta-toolkit focusing on efficiency and flexibility. A security vulnerability exists in versions prior to RELIC 2020-08-01, which stems from an invalid RSA PKCS.No detailed vulnerability details are provided ...

CVE-2020-36315

In RELIC before 2020-08-01, RSA PKCS1 v1.5 signature forgery can occur because certain checks of the padding and of the first two bytes are inadequate. NOTE: this requires that a low public exponent such as 3 is being used. The product, by default, does not generate RSA keys with such a low numbe...

CVE-2020-36316

In RELIC before 2021-04-03, there is a buffer overflow in PKCS1 v1.5 signature verification because garbage bytes can be present...

CVE-2020-36316

In RELIC before 2021-04-03, there is a buffer overflow in PKCS1 v1.5 signature verification because garbage bytes can be present...

CVE-2020-36315

In RELIC before 2020-08-01, RSA PKCS1 v1.5 signature forgery can occur because certain checks of the padding and of the first two bytes are inadequate. NOTE: this requires that a low public exponent such as 3 is being used. The product, by default, does not generate RSA keys with such a low numbe...

Buffer overflow

In RELIC before 2021-04-03, there is a buffer overflow in PKCS1 v1.5 signature verification because garbage bytes can be present...

Design/Logic Flaw

In RELIC before 2020-08-01, RSA PKCS1 v1.5 signature forgery can occur because certain checks of the padding and of the first two bytes are inadequate. NOTE: this requires that a low public exponent such as 3 is being used. The product, by default, does not generate RSA keys with such a low numbe...

CVE-2020-36315

In RELIC before 2020-08-01, RSA PKCS1 v1.5 signature forgery can occur because certain checks of the padding and of the first two bytes are inadequate. NOTE: this requires that a low public exponent such as 3 is being used. The product, by default, does not generate RSA keys with such a low numbe...

CVE-2020-36315

Summary: CVE-2020-36315 affects RELIC before 2020-08-01, allowing RSA PKCS#1 v1.5 signature forgery due to inadequate padding checks (and issues with the first two bytes). The vulnerability’s exploitation requires a low public exponent (e.g., 3), and the product defaults to not using such small e...

CVE-2020-36316

CVE-2020-36316 concerns the RELIC cryptographic library. A buffer overflow occurs in PKCS#1 v1.5 signature verification when garbage bytes are present, affecting RELIC prior to 2021-04-03. The connected documents consistently describe this as a RELIC library issue with a pre-2021-04-03 cutoff and...

Diego F.Aranha relic 安全漏洞

Diego F.Aranha relic is a Diego F.Aranha open source application. A modern cryptographic meta-toolkit focusing on efficiency and flexibility. A security vulnerability exists in versions prior to RELIC 2021-04-03, which can be exploited by an attacker PKCS suffers from a buffer overflow...

Diego F.Aranha relic 加密问题漏洞

Diego F.Aranha relic is a Diego F.Aranha open source application. A modern cryptographic meta-toolkit focusing on efficiency and flexibility. A security vulnerability exists in versions prior to RELIC 2020-08-01, which stems from an invalid RSA PKCS.No detailed vulnerability details are provided ...

New Relic: User without "View/Modify/Delete" permissions on "Destinations" can view/modify & delete Destinations

@archangel reported that an elevation-of-privilege in the Destinations functions could have allowed a user to view Destinations without having the rights to do so due to an IDOR Incorrect Direct Object Reference...