6807 matches found
Open redirect
macaron before 1.3.7 has an open redirect in the static handler, as demonstrated by the http://127.0.0.1:4000//example.com/ URL...
CVE-2020-12666
macaron before 1.3.7 has an open redirect in the static handler, as demonstrated by the http://127.0.0.1:4000//example.com/ URL...
CVE-2020-12666
CVE-2020-12666 is an open redirect in the macaron web framework (gopkg.in/macaron.v1) — specifically in the static handler. The root cause is improper request sanitization, allowing a crafted URL to redirect to an attacker-chosen URL. Remediation documented across sources: upgrade to macaron 1.3....
PT-2020-13193 · Macaron · Macaron
Name of the Vulnerable Software and Affected Versions: macaron versions prior to 1.3.7 Description: The issue is related to an open redirect in the static handler due to improper request sanitization. This allows a specifically crafted URL to cause the static file handler to redirect to an...
URL Redirection to Untrusted Site (Open Redirect)
macaron before has an open redirect in the static handler...
Fedora 30 : chromium (2020-0e7f1b663b)
Another day, another chromium update. This one fixes : CVE-2020-6458 CVE-2020-6459 CVE-2020-6460 ---- Fix dependency issue introduced when switching from a 'shared' build to a 'static' build. ---- A new major version of Chromium without any security bugs! Just kidding. Here's the CVE list :...
INTERCEPT - Policy As Code Static Analysis Auditing
Stupidly easy to use, small footprint Policy as Code subsecond command-line scanner that leverages the power of the fastest multi-line search tool to scan your codebase. It can be used as a linter, guard rail control or simple data collector and inspector. Consider it a weaponized ripgrep. Works ...
Building for Billions: Addressing Security Concerns for Platforms at Scale
Security operations once consisted of a multitude of manual operations based around alerts, thresholds and severity levels. As systems scale and platforms continue to grow, how do you keep up with the growing requirements to secure these transactions and the networks they are built upon?...
CVE-2020-10996
An issue was discovered in Percona XtraDB Cluster before 5.7.28-31.41.2. A bundled script inadvertently sets a static transitionkey for SST processes in place of the random key expected...
CVE-2020-10996
An issue was discovered in Percona XtraDB Cluster before 5.7.28-31.41.2. A bundled script inadvertently sets a static transitionkey for SST processes in place of the random key expected...
Code injection
An issue was discovered in Percona XtraDB Cluster before 5.7.28-31.41.2. A bundled script inadvertently sets a static transitionkey for SST processes in place of the random key expected...
UBUNTU-CVE-2020-10996
An issue was discovered in Percona XtraDB Cluster before 5.7.28-31.41.2. A bundled script inadvertently sets a static transitionkey for SST processes in place of the random key expected...
CVE-2020-10996
An issue was discovered in Percona XtraDB Cluster before 5.7.28-31.41.2. A bundled script inadvertently sets a static transitionkey for SST processes in place of the random key expected...
fake-static allows converting any reference into a `'static` reference
fake-static allows converting a reference with any lifetime into a reference with 'static lifetime without the unsafe keyword. Internally, this crate does not use unsafe code, it instead exploits a soundness bug in rustc: https://github.com/rust-lang/rust/issues/25860...
RUSTSEC-2020-0013 fake-static allows converting any reference into a `'static` reference
fake-static allows converting a reference with any lifetime into a reference with 'static lifetime without the unsafe keyword. Internally, this crate does not use unsafe code, it instead exploits a soundness bug in rustc: https://github.com/rust-lang/rust/issues/25860...
WebKit AudioArray::allocate Data Race / Out-Of-Bounds Access
WebKit: Data race in AudioArray::allocate can lead to OOB access VULNERABILITY DETAILS Source/WebCore/platform/audio/AudioArray.h: void allocateChecked n ... while !isAllocationGood // Initially we try to allocate the exact size, but if it's not aligned // then we'll have to reallocate and from...
PT-2020-12911 · Zoom · Zoom Client For Meetings
Name of the Vulnerable Software and Affected Versions: Zoom Client for Meetings version 4.6.11 Description: The issue concerns the use of a static Initialization Vector IV for AES-256 CBC encryption in the airhost.exe component. Specifically, the IV used is 3423423432325249. The vendor notes that...
Siemens SIMOTICS, Desigo, APOGEE, and TALON
1. EXECUTIVE SUMMARY CVSS v3 7.1 ATTENTION: Exploitable from an adjacent network/low skill level to exploit Vendor: Siemens Equipment: SIMOTICS, Desigo, APOGEE, and TALON Vulnerability: Business Logic Errors 2. UPDATE INFORMATION This updated advisory is a follow-up to the advisory update titled...
Inhale - A Malware Analysis And Classification Tool
Inhale is a malware analysis and classification tool that is capable of automating and scaling many static analysis operations. This is the beta release version, for testing purposes, feedback, and community development. Background Inhale started as a series of small scripts that I used when...
Remote Code Execution (RCE)
JBoss is vulnerable to remote code execution RCE. The vulnerablitiy exists because it allows the embedding of class files, allowing remote attackers to execute arbitrary code via a crafted static initializer...