Mozilla: Directory indexes for bundled resources reflected URL parameters

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of when visiting directory listings for chrome:// URLs as source text, some parameters were reflected...

Mozilla: Directory indexes for bundled resources reflected URL parameters

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of when visiting directory listings for chrome:// URLs as source text, some parameters were reflected...

Mozilla: Directory indexes for bundled resources reflected URL parameters

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of when visiting directory listings for chrome:// URLs as source text, some parameters were reflected...

RHEL 7 : thunderbird (RHSA-2022:5773)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:5773 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 91.12.0. Security Fixes: Mozilla:...

[SECURITY] Fedora 36 Update: golang-github-tdewolff-minify-2.11.10-4.fc36

Minify is a minifier package written in Go. It provides HTML5, CSS3, JS, JSON, SVG and XML minifiers and an interface to implement any other minifier. Minification is the process of removing bytes from a file such as whitespace without changing its output and therefore shrinking its size and...

CVE-2022-35220

Teamplus Pro community discussion function has an ‘allocation of resource without limits or throttling’ vulnerability. A remote attacker with general user privilege posting a thread with large content can cause the receiving client device to allocate too much memory, leading to abnormal terminati...

The vulnerability of the microprogrammed Wi-Fi router software of ASUS DSL-N14U, related to uncontrolled resource consumption, allows a hacker to trigger a service failure.

The vulnerability of the microprogrammed Wi-Fi router software of ASUS DSL-N14U is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to trigger a service failure by performing TCP SYN scanning using nmap...

New Ducktail Infostealer Malware Targeting Facebook Business and Ad Accounts

Facebook business and advertising accounts are at the receiving end of an ongoing campaign dubbed Ducktail designed to seize control as part of a financially driven cybercriminal operation. "The threat actor targets individuals and employees that may have access to a Facebook Business account wit...

CVE-2021-43959

Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to access the content of internal network resources via a Server-Side Request Forgery SSRF vulnerability in the CSV importing feature of JSM Insight. When running in an environment...

CVE-2021-43959

Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to access the content of internal network resources via a Server-Side Request Forgery SSRF vulnerability in the CSV importing feature of JSM Insight. When running in an environment...

Atlassian Jira 代码问题漏洞

Atlassian Jira is a defect tracking management system from Atlassian Australia. The system is used to track and manage all types of issues and defects in the workplace. A security vulnerability exists in Atlassian Jira Service Management Server and Data Center versions prior to 4.13.20, 4.14.0 to...

CVE-2021-43959

Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to access the content of internal network resources via a Server-Side Request Forgery SSRF vulnerability in the CSV importing feature of JSM Insight. When running in an environment...

Integrating JIRA to the Qualys Cloud Platform

This is the second in a blog series on integrations to the Qualys Cloud Platform. This post looks at what are the requirements to build a successful integration and workarounds when some of the pieces are missing functionality. We then specifically consider the question of integrated Qualys with...

FlatCore CMS Server-Side Request Forgery (CVE-2021-41403)

A server-side request forgery vulnerability exists in FlatCore CMS. Successful exploitation of this vulnerability could allow an attacker to access internal resources...

CVE-2022-34368

Dell EMC NetWorker 19.2.1.x 19.3.x, 19.4.x, 19.5.x, 19.6.x and 19.7.0.0 contain an Improper Handling of Insufficient Permissions or Privileges vulnerability. Authenticated non admin user could exploit this vulnerability and gain access to restricted resources...

The vulnerability affects the implementation of WASM technology in browsers like Firefox, Firefox ESR, and the email client Thunderbird. This allows attackers to trigger a service failure.

The vulnerability of the WASM technology implementation in Firefox browsers, Firefox ESR, and the Thunderbird email client is related to unlimited resource allocation. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

PT-2022-6353 · Dell Emc · Dell Emc Networker

Name of the Vulnerable Software and Affected Versions: Dell EMC NetWorker versions 19.2.1.x through 19.7.0.0 Description: The issue is related to an Improper Handling of Insufficient Permissions or Privileges, which could allow an authenticated non-admin user to gain access to restricted resource...

IBM Sterling Partner Engagement Manager XML External Entity Injection Vulnerability

IBM Sterling Partner Engagement Manager is an automation management tool from IBM, Inc. An XML external entity injection vulnerability exists in IBM Sterling Partner Engagement Manager, which stems from a network system or product that does not set the correct filtering to allow references to...

Xxe

IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 220651...

Design/Logic Flaw

IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 could allow a remote authenticated attacker to conduct an LDAP injection. By using a specially crafted request, an attacker could exploit this vulnerability and could result in in granting permission to unauthorized resources...