Jetty 10.0.x < 10.0.2 Multiple Vulnerabilities

According to its self-reported version number, the instance of Jetty hosted on the remote web server is prior to 9.4.39, 10.0.x prior to 10.0.2 or 11.0.x prior to 11.0.2. It is, therefore, affected by multiple vulnerabilities: - An issue where CPU usage can reach 100% with a large invalid TLS...

Certify - Active Directory Certificate Abuse

Certify is a C tool to enumerate and abuse misconfigurations in Active Directory Certificate Services AD CS. @harmj0y and @tifkin are the primary authors of Certify and the the associated AD CS research blog and whitepaper. Usage C:\ToolsCertify.exe / | | | / | | | | | | | | | / \ '| | | | | | | ...

jetty: request containing multiple Accept headers with a large number of "quality" parameters may lead to DoS

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 inclusive, 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” i.e. q parameters, the server may enter a denial of service DoS state due to high CPU usage processing those quality...

POC-EXP

It is an offensive tool for vulnerability exploitation. The repository contains a collection of exploits and proof-of-concept PoC code for various vulnerabilities. No specific CVE or GHSA IDs are mentioned, but the repository is likely focused on demonstrating exploitation techniques rather than...

VSPC 5 fails to collect Monthly License Usage Report from VBR v11a

Article Applicability The issue described in this article is specific to Veeam Service Provider Console v5 without Patch 4 installed. Challenge Monthly License Usage Report cannot be collected from Veeam Backup & Replication servers running version 11a. Cause The license usage data generated by...

Exploit for CVE-2021-22006

CVE-2021-22005 - VMWare vCenter Server File Upload to RCE...

CVE-2021-3807

A regular expression denial of service ReDoS vulnerability was found in nodejs-ansi-regex. This could possibly cause an application using ansi-regex to use an excessive amount of CPU time when matching crafted ANSI escape codes...

CVE-2021-3583

A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in multi-line YAML strings and the facts being handled do not routinely include special template characters...

Sentry 8.2.0 - Remote Code Execution (Authenticated) Exploit

Exploit Title: Sentry 8.2.0 - Remote Code Execution RCE Authenticated Exploit Author: Mohin Paramasivam Shad0wQu35t Vulnerability Discovered By : Clement Berthaux SYNACKTIV Software Link: https://sentry.io/welcome/ Advisory: https://doc.lagout.org/Others/synacktivadvisorysentrypickle.pdf Tested o...

libdb bug fix and enhancement update

The libdb packages provide the Berkeley Database, an embedded database supporting both traditional and client/server applications. Bug Fixes and Enhancements: FJ8.4 Bug: REGThe rpm command hangs and the CPU usage reaches 100% BZ2001972...

ALBA-2021:3594 libdb bug fix and enhancement update

The libdb packages provide the Berkeley Database, an embedded database supporting both traditional and client/server applications. Bug Fixes and Enhancements: FJ8.4 Bug: REGThe rpm command hangs and the CPU usage reaches 100% BZ2001972...

rng-tools bug fix and enhancement update

The rng-tools packages contain random number generator user-space utilities, such as the rngd daemon. Bug Fixes and Enhancements: rngd uses 100% CPU while in a yield loop BZ1966437...

VMware vCenter Server 资源管理错误漏洞

Vmware VMware vCenter Server is a suite of server and virtualization management software from Vmware, Inc. The software provides a centralized platform for managing VMware vSphere environments, automating the implementation and delivery of virtual infrastructures. vmware vCenter Server suffers fr...

CVE-2021-25741

A security issue was discovered in Kubernetes where a user may be able to create a container with subpath volume mounts to access files & directories outside of the volume, including on the host filesystem...

PS2EXE - Module To Compile Powershell Scripts To Executables

Overworking of the great script of Ingo Karstein with GUI support. The GUI output and input is activated with one switch, real windows executables are generated. With Powershell 5.x support and graphical front end. Module version. You find the script based version here...

The vulnerability of the implementation of the Resource Public Key Infrastructure (RPKI) function in the Cisco IOS XR operating system allows a perpetrator to cause a failure in the Border Gateway Protocol (BGP) process.

The vulnerability of the Resource Public Key Infrastructure RPKI function in the Cisco IOS XR operating system is related to the insufficient use of the assert function. Exploiting this vulnerability could allow a malicious actor to cause failures in the Border Gateway Protocol BGP process...

The vulnerability in the `parser_parse_statements` function of the `js-parser-statm.c` component of the JavaScript engine for the Internet of Things, JerryScript, and the IoT.js platform, related to the insufficient use of the `assert()` function, allows a attacker to trigger a service failure.

The vulnerability of the parserparsestatements function in the js-parser-statm.c component of the JavaScript engine for the Internet of Things, JerryScript, and the IoT.js platform is related to incorrect comparisons. Exploiting this vulnerability could allow a remote attacker to cause a service...

The vulnerability in the `parser_parse_source` function of the `js-parser.c` component of the JavaScript framework for the Internet of Things, JerryScript, and the IoT.js platform, related to the insufficient use of the `assert()` function, allows a attacker to cause a service failure.

The vulnerability of the parserparsesource function in the js-parser.c component of the JavaScript engine for the Internet of Things, JerryScript, and the IoT.js platform, is related to the insufficient use of the assert function. Exploiting this vulnerability could allow a malicious actor to cau...

The vulnerability of the lys_node_free() function in the syntax analyzer and modeling tool of the YANG Libyang language, related to the insufficient use of the assert() function, allows attackers to trigger a service failure.

The vulnerability of the lysnodefree function in the syntax analyzer and modeling tool of the YANG Libyang language is related to the insufficient use of the assert function. Exploiting this vulnerability could allow a malicious actor to cause service failures...

The vulnerability of the `parser_parse_object_initializer` function in the `js-parser-expr.c` component of the JavaScript framework for Internet of Things, JerryScript, and the IoT.js platform, arises due to the insufficient use of the `assert()` function. This allows attackers to trigger a service failure.

The vulnerability of the parserparseobjectinitializer function in the js-parser-expr.c component of the JavaScript framework for Internet of Things technology, JerryScript, and the IoT.js platform is related to the insufficient use of the assert function. Exploiting this vulnerability could allow...