keycloak: Untrusted Certificate Validation

A flaw was found in Keycloak. This flaw depends on a non-default configuration "Revalidate Client Certificate" to be enabled and the reverse proxy is not validating the certificate before Keycloak. Using this method an attacker may choose the certificate which will be validated by the server. If...

Exploit for Path Traversal in Microsoft

CVE-2022-4510-Binwalk This script allows you to generate expl...

golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters

A flaw was found in the golang package, where requests forwarded by reverse proxy include the raw query parameters from the inbound request, including unparseable parameters rejected by net/http. This issue could permit query parameter smuggling when a Go proxy forwards a parameter with an...

Fedora: Security Advisory for trafficserver (FEDORA-2023-92686b3e8b)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS. A malicious client can cause an error against the destination's size limit, which would incorrectly be attributed to the destination rather than the client. This could allow an attacker to send large amounts of da...

CVE-2023-33141

Yet Another Reverse Proxy YARP Denial of Service Vulnerability...

CVE-2023-33141

Yet Another Reverse Proxy YARP Denial of Service Vulnerability...

CVE-2023-33141

Yet Another Reverse Proxy YARP Denial of Service Vulnerability...

CVE-2023-33141

Summary: CVE-2023-33141 is a Denial of Service vulnerability in Yet Another Reverse Proxy (YARP). The OSV entry confirms a DoS impact exists in YARP and provides remediation: upgrade to Yarp.ReverseProxy 2.0.1 (and Telemetry.Consumption 2.0.1) to mitigate. The CVE entry lists CVSSv3.1 base score ...

Debian: Security Advisory (DSA-5435-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

spring-boot: Spring Boot Welcome Page DoS Vulnerability

A flaw was found in Spring Boot, occurring prominently in Spring MVC with a reverse proxy cache. This issue requires Spring MVC to have auto-configuration enabled and the application to use Spring Boot's welcome page support, either static or templated, resulting in the application being deployed...

Exploit for Improper Input Validation in Barracuda Email_Security_Gateway_300_Firmware

CVE-2023-2868: Barracuda ESG Command Injection For full...

The vulnerability of the Yet Another Reverse Proxy (YARP) from Microsoft, which stems from insufficient input validation, allows attackers to induce a service failure.

The vulnerability of the Yet Another Reverse Proxy YARP Microsoft component is related to insufficient input validation. Exploiting this vulnerability could allow a malicious actor to cause service failures...

Fedora: Security Advisory for iaito (FEDORA-2023-5d5aa8b27a)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 38 Update: radare2-5.8.6-1.fc38

The radare2 is a reverse-engineering framework that is multi-architecture, multi-platform, and highly scriptable. Radare2 provides a hexadecimal editor, wrapped I/O, file system support, debugger support, diffing between two functions or binaries, and code analysis at opcode, basic block, and...

[SECURITY] Fedora 38 Update: iaito-5.8.6-1.fc38

iaito is a Qt and C++ GUI for radare2. It is the continuation of Cutter before the fork to keep radare2 as backend. Its goal is making an advanced, customizable and FOSS reverse-engineering platform while keeping the user experience at mind. The iaito is created by reverse engineers for reverse...

[SECURITY] Fedora 37 Update: radare2-5.8.6-1.fc37

The radare2 is a reverse-engineering framework that is multi-architecture, multi-platform, and highly scriptable. Radare2 provides a hexadecimal editor, wrapped I/O, file system support, debugger support, diffing between two functions or binaries, and code analysis at opcode, basic block, and...

[SECURITY] Fedora 37 Update: iaito-5.8.6-1.fc37

iaito is a Qt and C++ GUI for radare2. It is the continuation of Cutter before the fork to keep radare2 as backend. Its goal is making an advanced, customizable and FOSS reverse-engineering platform while keeping the user experience at mind. The iaito is created by reverse engineers for reverse...

TFTP Fetch, Reverse TCP Stager

Fetch and execute a x86 payload from a TFTP server. Connect back to the attacker Module Options msf use payload/cmd/linux/tftp/x86/meterpreter/reversetcpuuid msf payloadreversetcpuuid show actions ...actions... msf payloadreversetcpuuid set ACTION msf payloadreversetcpuuid show options ...show an...

TFTP Fetch, Linux Command Shell, Reverse TCP Stager

Fetch and execute a x86 payload from a TFTP server. Spawn a command shell staged. Connect back to the attacker Module Options msf use payload/cmd/linux/tftp/x86/shell/reversenonxtcp msf payloadreversenonxtcp show actions ...actions... msf payloadreversenonxtcp set ACTION msf payloadreversenonxtcp...