F-Secure Endpoint Protection 安全漏洞

F-Secure Endpoint Protection is an endpoint protection solution from Finnish company F-Secure. A security vulnerability exists in F-Secure Endpoint Protection that stems from multiple denial-of-service DoS vulnerabilities found in F-Secure products. aerdl.dll unpacker handler crashes as a result ...

CVE-2022-41958 Deserialization Vulnerability by yaml config input in super-xray

super-xray is a web vulnerability scanning tool. Versions prior to 0.7 assumed trusted input for the program config which is stored in a yaml file. An attacker with local access to the file could exploit this and compromise the program. This issue has been addressed in commit 4d0d5966 and will be...

Octopii - An AI-powered Personal Identifiable Information (PII) Scanner

Octopii is an open-source AI-powered Personal Identifiable Information PII scanner that can look for image assets such as Government IDs, passports, photos and signatures in a directory. Working Octopii uses Tesseract's Optical Character Recognition OCR and Keras' Convolutional Neural Networks CN...

CVE-2022-41950 Privilege Escalation Vulnerability by wrong chmod param

super-xray is the GUI alternative for vulnerability scanning tool xray. In 0.2-beta, a privilege escalation vulnerability was discovered. This caused inaccurate default xray permissions. Note: this vulnerability only affects Linux and Mac OS systems. Users should upgrade to super-xray 0.3-beta...

CVE-2022-41950 Privilege Escalation Vulnerability by wrong chmod param

super-xray is the GUI alternative for vulnerability scanning tool xray. In 0.2-beta, a privilege escalation vulnerability was discovered. This caused inaccurate default xray permissions. Note: this vulnerability only affects Linux and Mac OS systems. Users should upgrade to super-xray 0.3-beta...

WordPress Post By Email Enabled

WordPress has a core feature and plugins allowing content managers to publish posts on their blogs by sending their articles to a configured email address. The scanner detected that the target WordPress instance has either the core feature or a specific plugin configured. No source data...

Another Event-Related Spyware App

Last month, we were warned not to install Qatars World Cup app because it was spyware. This month, its Egypts COP27 Summit app: The app is being promoted as a tool to help attendees navigate the event. But it risks giving the Egyptian government permission to read users emails and messages. Even...

Using Wi-FI to See through Walls

This technique measures device response time to determine distance: The scientists tested the exploit by modifying an off-the-shelf drone to create a flying scanning device, the Wi-Peep. The robotic aircraft sends several messages to each device as it flies around, establishing the positions of...

Urlscan.io API Inadvertently Leaked Sensitive Data and URLs

By Deeba Ahmed Urlscan.io is a website scanning and analyzing engine that accepts URL submissions and creates a trove of data such as IPs, domains, DOM information, screenshots, and cookies. This is a post from HackRead.com Read the original post: Urlscan.io API Inadvertently Leaked Sensitive Dat...

Why Is Snapshot Scanning Not Enough?

As new scanning technologies are released, their supposed superiority is touted over the others. The problem is, however, that there is no best scanning technology, all of them have strengths and limitations. If recent claims from several vendors are believed, a “best” scanning method called...

Fingerprinting Web Applications and APIs using Qualys Web Application Scanning

Decoding the impact of Fingerprinting Organizations develop an effective, actionable go-to-market plan to launch a profitable product into the target market. A go-to-market strategy predicts market demand by analyzing market research, competitor data, and previous examples. Without a solid...

U.S. Department of State: Bypassing Whitelist to perform SSRF for internal host scanning

A misconfiguration in the server-side request forgery SSRF protection of geonode.state.gov allowed for bypassing the whitelist and performing internal host scanning. The backend parsed the whitelist host as a credential host, allowing requests to be sent to hosts identified before the ""...

Who’s Scanning the IPv6 Space? And, Frankly, Why Do We Even Care?

Securing IPv6 is no longer optional, it's a necessity. In this first of its kind empirical study on the vulnerability scanning landscape of IPv6, you'll learn the challenges and differences between IPv6 and IPv4 to be better prepared for the future...

Who’s Scanning the IPv6 Space? And, Frankly, Why Do We Even Care?

Securing IPv6 is no longer optional, it's a necessity. In this first of its kind empirical study on the vulnerability scanning landscape of IPv6, you'll learn the challenges and differences between IPv6 and IPv4 to be better prepared for the future...

Security Advisory 2022-10-17-1 - Multiple issues in mac80211 and cfg80211 (CVE-2022-41674, CVE-2022-42719, CVE-2022-42720, CVE-2022-42721 and CVE-2022-42722)

DESCRIPTION Multiple vulnerabilities were found in the Linux Kernel mac80211 and cfg80211 framework. OpenWrt takes the mac80211 and cfg80211 framework from the wireless backports project which copies it from a more recent Linux kernel version. These vulnerabilities are in the multi BSSID MBSSID...

CVE-2022-28887

Multiple Denial-of-Service DoS vulnerability was discovered in F-Secure & WithSecure products whereby the aerdl.dll unpacker handler function crashes. This can lead to a possible scanning engine crash...

Denial of service

Multiple Denial-of-Service DoS vulnerability was discovered in F-Secure & WithSecure products whereby the aerdl.dll unpacker handler function crashes. This can lead to a possible scanning engine crash...

Creating Awareness of External JavaScript Libraries in Web Applications

Qualys Web Application Scanning WAS routinely reviews and solicits customer feedback regarding vulnerabilities. This may be to enhance the detection or the detections reporting. Previously, all JavaScript libraries detected on an application are reported under the Information Gathering QID 150176...

CVE-2022-28887

CVE-2022-28887 describes a Denial-of-Service condition in F-Secure & WithSecure products. The vulnerability stems from the aerdl.dll unpacker handler function , which can crash the scanning engine, leading to a potential service disruption. Public details consistently reference a DoS impact but d...

CVE-2022-28887 Multiple Denial of Service Vulnerability

Multiple Denial-of-Service DoS vulnerability was discovered in F-Secure & WithSecure products whereby the aerdl.dll unpacker handler function crashes. This can lead to a possible scanning engine crash...