Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal if an unintended user is able to gain access to the diagnostic route, which may lead to information disclosure. Note: This only applies when MessageBus::Diagnostics is enabled it is not enabled by default. Details A...

Hardcoded static IV and AAD with a reused key in AES GCM encryption in mod_auth_openidc

...

jetty: Symlink directory exposes webapp directory contents

If the $jetty.base directory or the $jetty.base/webapps directory is a symlink the contents of the $jetty.base/webapps directory may be deployed as a static web application, exposing the content of the directory for download. The highest threat from this vulnerability is to data confidentiality...

Jektor - A Windows User-Mode Shellcode Execution Tool That Demonstrates Various Techniques That Malware Uses

This utility focuses on shellcode injection techniques to demonstrate methods that malware may use to execute shellcode on a victim system Dynamically resolves API functions to evade IAT inclusion Includes usage of undocumented NT Windows API functions Supports local shellcode execution via...

Pi-Hole AdminLTE Remote Code Execution Vulnerability

Pi-hole Web v4.3.2 aka AdminLTE allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease...

Security Bulletin: This Power System firmware update is being released to address DHCP issue number CVE-2018-5732

Summary POWER9/POWER8: In response to a recently reported DHCP client security vulnerability, a new Power System firmware update is being released to address Common Vulnerabilities and Exposures issue number CVE-2018-5732. Vulnerability Details CVEID: CVE-2018-5732 DESCRIPTION: ISC DHCP is...

IDA2Obj - Static Binary Instrumentation

IDA2Obj is a tool to implement SBI StaticBinary Instrumentation. The working flow is simple: Dump object files COFF directly from one executable binary. Link the object files into a new binary, almost the same as the old one. During the dumping process, you can insert any data/code at any locatio...

CVE-2021-33267

D-Link DIR-809 devices with firmware through DIR-809AxFW1.12WWB0320190410 were discovered to contain a stack buffer overflow vulnerability in the function FUN80034d60 in /formStaticDHCP. This vulnerability is triggered via a crafted POST request...

WordPress plugin cross-site request forgery vulnerability (CNVD-2021-102803)

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . WordPress plugin Stetic 1.0.6 and its previous versions...

D-Link DIR-809 缓冲区错误漏洞

D-Link DIR-809 is a dual-band router from D-Link, China. buffer overflow vulnerability exists in the fun80034d60 function in the D-Link DIR-809 formStaticDHCP, which can be exploited by attackers to submit special requests that can crash applications or execute arbitrary code...

CVE-2021-42115

Missing HTTPOnly flag in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version = 7.1.27 allows an unauthenticated remote attacker to escalate privileges from unauthenticated to authenticated user via stealing and injecting the session- independent and static cookie...

Business-Dna Solution GmbH TopEase 安全漏洞

Business-Dna Solution GmbH TopEase is a "Transformational Risk" solution from Business-Dna Solution GmbH, Switzerland. It is used to manage complex projects and initiatives comprehensively, simply, quickly and securely. A security vulnerability exists in Business-Dna Solution GmbH TopEase, which...

Whispers - Identify Hardcoded Secrets In Static Structured Text

"My little birds are everywhere, even in the North, they whisper to me the strangest stories." - Lord Varys Whispers is a static code analysis tool designed for parsing various common data formats in search of hardcoded credentials and dangerous functions. Whispers can run in the CLI or you can...

jetty: Symlink directory exposes webapp directory contents

If the $jetty.base directory or the $jetty.base/webapps directory is a symlink the contents of the $jetty.base/webapps directory may be deployed as a static web application, exposing the content of the directory for download. The highest threat from this vulnerability is to data confidentiality...

Stacs - Static Token And Credential Scanner

Static Token And Credential Scanner What is it? STACS is a YARA powered static credential scanner which suports binary file formats, analysis of nested archives, composable rulesets and ignore lists, and SARIF reporting. What does STACS support? Currently, STACS supports recursive unpacking of...

CVE-2021-3939

Ubuntu-specific modifications to accountsservice in patch file debian/patches/0010-set-language.patch caused the fallbacklocale variable, pointing to static storage, to be freed, in the userchangelanguageauthorizedcb function. This is reachable via the SetLanguage dbus function. This is fixed in...

NetworkManager security, bug fix, and enhancement update

1.32.10-4.0.1 - add connectivity check via Oracle servers Orabug: 32051972 - Disable the build of NetworkManager-config-connectivity- subpackage for 8.3 1:1.32.10-4 - revert unapproved patches part of 'cloud-setup' change rh 1977984 1:1.32.10-3 - preserve the IPv6 multicast route added by kernel ...

rust-toolset:ol8 security, bug fix, and enhancement update

rust-toolset 1.54.0-1 - Update to Rust and Cargo 1.54.0. 1.53.0-1 - Update to Rust and Cargo 1.53.0. rust 1.54.0-2 - Make std-static-wasm arch-specific to avoid s390x. 1.54.0-1 - Update to 1.54.0. 1.53.0-2 - Use llvm-ranlib to fix wasm archives. 1.53.0-1 - Update to 1.53.0. 1.52.1-2 - Set...

The vulnerability of the redirect parameter in the fastify-static plugin allows a hacker to redirect users of Mozilla Firefox to arbitrary websites.

The vulnerability of the redirect parameter in the fastify-static plugin relates to the ability to redirect users to untrusted URLs. Exploiting this vulnerability allows a malicious actor to redirect users of Mozilla Firefox to arbitrary websites...

CVE-2021-40119

A vulnerability in the key-based SSH authentication mechanism of Cisco Policy Suite could allow an unauthenticated, remote attacker to log in to an affected system as the root user. This vulnerability is due to the re-use of static SSH keys across installations. An attacker could exploit this...