Improper Authorization

gitlab is vulnerable to Improper Authorization. The vulnerability allows a user retrying a job in a downstream pipeline to take ownership of the retried jobs in the upstream pipeline even if the user doesn't have access to that project...

[SECURITY] Fedora 37 Update: golang-github-cenkalti-backoff-4.2.0-2.fc37

This is a Go port of the exponential backoff algorithm from Google's HTTP Client Library for Java. Exponential backoff is an algorithm that uses feedback to multiplicatively decrease the rate of some process, in order to gradually find an acceptable rate. The retries exponentially increase and st...

Citrix Provisioning Services - Slow Target Boot With Sentinel One Client

Provisioned Target Devices boot slow or initially boot ok in small batches but after a certain number of Devices are running Target performance continues to nose dive. Target devices get stuck at a black screen or "found vDisk" early in the PXE boot process. Target Devices show an uptick in the...

CVE-2018-20060

urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect i.e., a redirect that differs in host, port, or scheme. This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext...

CVE-2021-32755 Certificate pinning is not enforced on the web socket connection

Wire is a collaboration platform. wire-ios-transport handles authentication of requests, network failures, and retries for the iOS implementation of Wire. In the 3.82 version of the iOS application, a new web socket implementation was introduced for users running iOS 13 or higher. This new...

SSB - A Faster And Simpler Way To Bruteforce SSH Server

S ecure S hell B ruteforcer — A faster & simpler way to bruteforce SSH server. Installation from Binary Download a pre-built binary from releases page, unpack and run! Or: ▶ sudo curl -sSfL 'https://git.io/kitabisa-ssb' | sh -s -- -b /usr/local/bin from Source Need go1.14+ compiler installed and...

Unbreakable Enterprise kernel security update

4.14.35-2025.404.1.1 - target: fix XCOPY NAA identifier lookup David Disseldorp Orabug: 32248040 CVE-2020-28374 4.14.35-2025.404.1 - xenbus/xenbusbackend: Disallow pending watch messages SeongJae Park Orabug: 32253412 CVE-2020-29568 - xen/xenbus: Count pending messages for each watch SeongJae Par...

Citrix Provisioning Services Boot Degradation With Cylance Protect

1. Target Device TD boot times increase when Cylance Protect 2.1 is installed within the vDisk. The boot delay is after the OS has been delivered to the Target Device and is now resident in RAM. This is after our Target has transitioned from Single IO to Multi IO mode in a BIOS based TD...

CVE-2020-35590

LimitLoginAttempts.php in the limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows a bypass of per IP address rate limits because the X-Forwarded-For header can be forged. When the plugin is configured to accept an arbitrary header for the client source IP address, a malicious...

Kong Gateway Admin API Remote Code Execution

frozenstringliteral: true This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Kong Gateway Admin API Remote Code Execution', 'Description' = ' This module uses the Kong admin API to create a route...

Release Information for Veeam Availability for Nutanix AHV 1.0 Update 3

Challenge Release Notes for Veeam Availability for Nutanix AHV 1.0 Update 3. This update supersedes Veeam Availability for Nutanix AHV 1.0 Update 2. Solution Veeam Availability for Nutanix AHV 1.0 Update 3 includes improvements and fixes for series of issues. The most critical ones are listed...

SUSE-SU-2019:1862-1 Security update for ardana and crowbar

This update for ardana and crowbar fixes the following issues: - Restrict rootwrap directories for cinder bsc1132542 - Change Cinder default log level from DEBUG to INFO SCRD-7132 - Remove configuration from migration bsc1126391 - Configurable innodb flush options SCRD-7496 - Secure designate's...

Excessive Retries Occur when a Provisioning Server Target Device is Deployed on a XenServer Platform

When the Citrix Provisioning Server target device is deployed on a XenServer platform, the device may experience some of the following symptoms: Excessive retries while performing a physical to virtual target build Slow ICA performance when using XenDesktop Freezing or locking with XenDesktop whi...

Description of the security update for Office 2016: June 13, 2017 (KB3178667)

None None...

Unbreakable Enterprise kernel security update

2.6.39-400.294.1 - nvme: Limit command retries Ashok Vairavan Orabug: 25342947 - tcp: fix use after free in tcpxmitretransmitqueue Eric Dumazet Orabug: 25374376 CVE-2016-6828 - ALSA: pcm : Call killfasync in stream lock Takashi Iwai Orabug: 25231728 CVE-2016-9794 - net: avoid signed overflows for...

Extremely Fast Flexible Web Fuzzer: Filebuster

Extremely Fast Flexible Web Fuzzer Filebuster was built based on one of the fastest HTTP classes in the world of PERL – Furl::HTTP. Also the thread modelling is a bit optimized to run as fast as possible. Features It packs a ton of features like: The already mentioned Regex patterns Supports...

Target Device has Poor Performance and/or High Retries When Booting to a vDisk in Private Mode

When installing software in private mode it takes a very long time. Booting devices in Standard Mode works as expected Any maintenance version is very slow Best practices are put in place with Large send offloaddisabled on the target and PVS server anddisabled spanning tree on the switch vDisk is...

PVS Machines Becoming Unresponsive After a Period of Time with Excessive vDisk Retries

PVS machines become unregistered. They are in a unresponsive state and do not respond to ICA, RDP, or Console connections. Discovered that the PVS target devices were exhibiting massive retries in the Vdisk usage pane:...

openssh: authentication limits bypass

The OpenSSH server normally wouldn't allow successive authentications that exceed the MaxAuthTries setting in sshdconfig, however when using kbd-interactive challenge-response authentication the allowed login retries can be extended limited only by the LoginGraceTime setting, that can be more tha...

VK.com: Issue in the implementation of captcha and race condition

Reuse of captcha. The researcher was able to find a misconfiguration in the captcha mechanism which allowed him to reuse any captcha and bypass the uniquness of the same . Furthermore the race condition bypassed the no. of retries...