Advisory ROSA-SA-2021-1856

Software: irssi 0.8.15 OS: Cobalt 7.9 CVE-ID: CVE-2017-15227 CVE-Crit: HIGH CVE-DESC: Irssi before 1.0.5 may erroneously fail to remove destroyed channels from the request list when waiting for channel synchronization, resulting in post-release usage conditions on subsequent status updates...

Advisory ROSA-SA-2021-1808

Software: binutils 2.27 OS: Cobalt 7.9 CVE-ID: CVE-2017-12448 CVE-Crit: HIGH CVE-DESC: The bfdcacheclose function in bfd / cache.c in the Binary File Descriptor BFD library also known as libbfd distributed in GNU Binutils 2.29 and earlier allows remote attackers to invoke heap usage upon release...

jetty: request containing multiple Accept headers with a large number of "quality" parameters may lead to DoS

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 inclusive, 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” i.e. q parameters, the server may enter a denial of service DoS state due to high CPU usage processing those quality...

The vulnerability of the ReadMATImage function in the coders/mat.c component of the console image editing tool ImageMagick, related to the insufficient use of the assert() function, allows a hacker to cause a service failure.

The vulnerability of the ReadMATImage function in the coders/mat.c component of the console image editing tool ImageMagick is related to the lack of a NULL check. Exploiting this vulnerability allows an attacker to cause a service failure...

The vulnerability of the MogrifyImageList function in the MagickWand/mogrify.c component of the console-based ImageMagick graphics editor allows a hacker to trigger a service failure by exploiting a deficiency in the use of the assert() function.

The vulnerability of the MogrifyImageList function in the MagickWand/mogrify.c component of the console-based ImageMagick graphics editor is related to the insufficient use of the assert function. Exploiting this vulnerability allows a malicious actor to trigger a service failure using a speciall...

jetty: request containing multiple Accept headers with a large number of "quality" parameters may lead to DoS

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 inclusive, 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” i.e. q parameters, the server may enter a denial of service DoS state due to high CPU usage processing those quality...

S3-Account-Search - S3 Account Search

This tool lets you find the account id an S3 bucket belongs too. For this to work you need to have at least one of these permissions: Permission to download a known file from the bucket s3:getObject. Permission to list the contents of the bucket s3:ListBucket. Additionally, you will need a role...

W3 Total Cache < 2.1.5 - Reflected XSS in Extensions Page (JS Context)

The plugin was affected by a reflected Cross-Site Scripting XSS issue within the "extension" parameter in the Extensions dashboard, when the 'Anonymously track usage to improve product quality' setting is enabled, as the parameter is output in a JavaScript context without proper escaping. This...

W3 Total Cache < 2.1.5 - Reflected XSS in Extensions Page (JS Context)

The plugin was affected by a reflected Cross-Site Scripting XSS issue within the "extension" parameter in the Extensions dashboard, when the 'Anonymously track usage to improve product quality' setting is enabled, as the parameter is output in a JavaScript context without proper escaping. This...

MediaWiki GlobalNewFiles 资源管理错误漏洞

GlobalNewFiles is an extension of the MediaWiki Foundation that provides a special page to view all files of a wiki farm globally. GlobalNewFiles suffers from a Resource Management Error vulnerability that stems from the fact that all existing versions of GlobalNewFiles are affected by an...

Dovecot 1.2.0 - 2.3.14 DoS Vulnerability

Dovecot is prone to a denial of service DoS vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; yo...

BlobHunter - Find Exposed Data In Azure With This Public Blob Scanner

An opensource tool for scanning Azure blob storage accounts for publicly opened blobs. BlobHunter is a part of "Hunting Azure Blobs Exposes Millions of Sensitive Files" research: https://www.cyberark.com/resources/threat-research-blog/hunting-azure-blobs-exposes-millions-of-sensitive-files Overvi...

RomBuster - A Router Exploitation Tool That Allows To Disclosure Network Router Admin Password

RomBuster is a router exploitation tool that allows to disclosure network router admin password. Features Exploits vulnerabilities in most popular routers such as D-Link, Zyxel, TP-Link and Huawei. Optimized to exploit multiple routers at one time from list with threading enabled. Simple CLI and...

jfinal logic flaw vulnerability

JFinal is a Java-based language WEB ORM open source framework. A processing logic error vulnerability exists in jfinal, which originates in jfinal version 4.9.08 and below in applications that use redis, and can be exploited by an attacker to potentially cause remote code execution...

CVE-2021-31649

In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerable to remote code execute...

Security Bulletin: Multiple vulnerabilities in Eclipse Jetty affect IBM Installation Manager and IBM Packaging Utility

Summary There are multiple vulnerabilities in Eclipse Jetty used by IBM Installation Manager and IBM Packaging Utility. The IBM Installation Manager and IBM Packaging Utility have addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2021-28163 DESCRIPTION: In Eclipse Jetty 9.4.32 to...

Shreder - A Powerful Multi-Threaded SSH Protocol Password Bruteforce Tool

Shreder is a powerful multi-threaded SSH protocol password brute-force tool. Features Very fast password guessing, just one password in 0.1 second. Optimized for big password lists, Shreder tries 1000 passwords in 1 minute and 40 seconds. Simple CLI and API usage. Installation pip3 install...

Denial of Service (DoS)

Overview bindata is a BinData is a declarative way to read and write binary file formats. This means the programmer specifies what the format of the binary data is, and BinData works out how to read and write data in this format. It is an easier and more readable alternative to ruby's pack and...

JFinal 代码问题漏洞

JFinal is a Java-based language WEB ORM open source framework. A processing logic error vulnerability exists in jfinal, which originates in jfinal version 4.9.08 and below in applications that use redis, and can be exploited by an attacker to potentially cause remote code execution...

GHSA-C38G-469G-CMGX Improper Neutralization of Special Elements in Output in helm.sh/helm/v3

Since Helm 2 was released, a well-documented aspect of Helm is that the Helm chart's version number MUST follow the SemVer2 specification. In the past, Helm would not permit charts with malformed versions. At some point, a patch was merged that changed this - On a version parse error, the version...