Server-side Request Forgery (SSRF)

cairosvg is vulnerable to Server-side Request Forgery SSRF and Denial of Service DOS. The vulnerability is due to allowing the loading of external host resources by default during parsing, allowing an attacker to parse a maliciously crafted file from an external resource, resulting in Server-side...

CVE-2023-0464

A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of...

Anonymous LOGOUT logs explanation

ns.log： Dec 31 16:13:57 172.31.248.107 12/31/2022:08:13:57 GMT PHQCXADC01 0-PPE-0 : default SSLVPN Message 263167 0 : "Created nFactor session for user Anonymous" Dec 31 16:13:57 172.31.248.107 12/31/2022:08:13:57 GMT PHQCXADC01 0-PPE-0 : default SSLVPN Message 263174 0 : "AAAD API:...

OpenSSL 1.0.2 < 1.0.2zh Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 1.0.2zh. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.0.2zh advisory. - Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact...

OpenSSL 3.0.0 < 3.0.9 Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 3.0.9. It is, therefore, affected by multiple vulnerabilities as referenced in the 3.0.9 advisory. - The function X509VERIFYPARAMadd0policy is documented to implicitly enable the certificate policy check when doing certificate...

OpenSSL 1.1.1 < 1.1.1u Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 1.1.1u. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.1.1u advisory. - Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary...

PT-2023-3208

Name of the Vulnerable Software and Affected Versions gosnowflake versions prior to 1.6.19 Description A command injection vulnerability exists in the Snowflake Golang driver via single sign-on SSO browser URL authentication. To exploit this issue, an attacker would need to establish a malicious...

Amazon Linux 2023 : curl, curl-minimal, libcurl (ALAS2023-2023-114)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-114 advisory. A flaw was found in the Curl package, where the HSTS mechanism would be ignored by subsequent transfers when done on the same command line because the state would not be properly carried. This...

Amazon Linux 2023 : microcode_ctl (ALAS2023-2023-055)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-055 advisory. 2024-06-06: CVE-2021-33117 was added to this advisory. Improper access control for some 3rd Generation IntelR XeonR Scalable Processors before BIOS version MR7, may allow a local attacker to...

Human Resources Management System 1.0 SQL Injection Vulnerability

Exploit Title: Human Resources Management System - HRM - Multiple SQLi Exploit Author: Abdulhakim Öner Vendor Homepage: https://www.sourcecodester.com Software Link: https://www.sourcecodester.com/php/15740/human-resource-management-system-project-php-and-mysql-free-source-code.html Software...

PT-2023-2374 · Cairo +2 · Cairo +2

Name of the Vulnerable Software and Affected Versions: CairoSVG versions prior to 2.7.0 Description: CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to external hosts when processing SVG files. A malicious actor could send a...

Siemens TCP Event Service of SCALANCE And RUGGEDCOM Devices Improper Input Validation (CVE-2022-31766)

A vulnerability has been identified in RUGGEDCOM RM1224 LTE4G EU All versions = V1.1.0 = V1.1.0 = V1.1.0 = V1.1.0 = V1.1.0 = V1.1.0 = V1.1.0 = V1.1.0 V2.0, SCALANCE WUM766-1 US All...

[SECURITY] Fedora 36 Update: containernetworking-plugins-1.1.1-16.fc36

The CNI Container Network Interface project consists of a specification and libraries for writing plugins to configure network interfaces in Linux containers, along with a number of supported plugins. CNI concerns itself only with network connectivity of containers and removing allocated resource...

[SECURITY] Fedora 37 Update: containernetworking-plugins-1.1.1-16.fc37

The CNI Container Network Interface project consists of a specification and libraries for writing plugins to configure network interfaces in Linux containers, along with a number of supported plugins. CNI concerns itself only with network connectivity of containers and removing allocated resource...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling such that ssh-add method adds smartcard keys to ssh-agent without the intended per-hop destination constraints. Remediation A fix was pushed into the master branch but not yet...

NETGEAR RAX30 Denial of Service Vulnerability

The NETGEAR RAX30 is a dual-band wireless router from NETGEAR. The NETGEAR RAX30 suffers from a denial of service vulnerability that stems from mishandling a large number of message requests, which can be exploited by an attacker to pass through a file large enough to cause the device to run out ...

Cryptojacking Group TeamTNT Suspected of Using Decoy Miner to Conceal Data Exfiltration

The cryptojacking group known as TeamTNT is suspected to be behind a previously undiscovered strain of malware used to mine Monero cryptocurrency on compromised systems. That's according to Cado Security, which found the sample after Sysdig detailed a sophisticated attack known as SCARLETEEL aime...

New Cryptojacking Operation Targeting Kubernetes Clusters for Dero Mining

Cybersecurity researchers have discovered the first-ever illicit cryptocurrency mining campaign used to mint Dero since the start of February 2023. "The novel Dero cryptojacking operation concentrates on locating Kubernetes clusters with anonymous access enabled on a Kubernetes API and listening ...

The vulnerability of the dr_domain_init_resources() function in the drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c file of the Linux kernel allows a hacker to cause a service failure.

The vulnerability of the drdomaininitresources function in the drivers/net/ethernet/mellanox/mlx5/core/steering/drdomain.c file of the Linux kernel is related to incorrect checking of the erroneous pointer value. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2023-26358

Creative Cloud version 5.9.1 and earlier is affected by an Untrusted Search Path vulnerability that might allow attackers to execute their own programs, access unauthorized data files, or modify configuration in unexpected ways. If the application uses a search path to locate critical resources...