Slyther - AWS Security Tool

Slyther is AWS Security tool to check read/write/delete access for S3 buckets Requirements aws-cli Installation pip3 install -r requirements.txt Usage example python3 slyther.py -b flaws.cloud Release History 0.0.3 Added option to check if aws-cli is installed or not 0.0.2 Added option to check...

The vulnerability of the Exiv2 metadata management library, related to the lack of use of the assert() function, allows a attacker to cause a service failure.

The vulnerability of the Exiv2 metadata management library is related to the insufficient use of the assert function. Exploiting this vulnerability allows a malicious actor to trigger a service failure through a specially created image file...

OPENSUSE-SU-2022:0098-1 Security update for nextcloud

This update for nextcloud fixes the following issues: nextcloud was updated to 21.0.9: - CVE-2021-41239 CWE-200: user enumeration setting not obeyed in User Status API boo1196905 - CVE-2021-41241 CWE-863: groupfolders advanced permissions is not obeyed for subfolders boo1196908 - CVE-2021-41741...

Exploit for Path Traversal in Apache Http_Server

CVE-2021-41773...

Security update for nextcloud (moderate)

openSUSE Security Update: Security update for nextcloud Announcement ID: openSUSE-SU-2022:0098-1 Rating: moderate References: 1196905 1196908 1196952 Cross-References: CVE-2021-41239 CVE-2021-41241 CVE-2021-41741 CVSS scores: CVE-2021-41239 NVD : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N...

CVE-2021-39743

In PackageManager, there is a possible way to update the last usage time of another package due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

CVE-2021-39743

In PackageManager, there is a possible way to update the last usage time of another package due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

Exploit for Path Traversal in Apache Http_Server

CVE-2021-41773 Docker $ sudo docker build -t . $ sudo...

CVE-2022-27816

CVE-2022-27816 affects SWHKD 1.1.5, where unsafe use of the pathname /tmp/swhks.pid can lead to data loss or denial of service. The issue is documented across multiple sources (Red Hat, CNVD, OSV/GHSA, CNVD, CNNVD, CVE listings) with the same core description. The connected documents do not provi...

Ubuntu 16.04 ESM : Libtasn1 vulnerability (USN-5352-1)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-5352-1 advisory. It was discovered that Libtasn1 incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service. Tenable has extracted t...

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Overview git-clone is a Clone a git repository Affected versions of this package are vulnerable to Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' due to insecure usage of the --upload-pack feature of git. Note: A note was added to the README file of the package t...

ESXi 5.5 < Build 5230635 Multiple Vulnerabilities (VMSA-2017-0006) (remote check) (PCI-DSS check)

The version of the remote VMware ESXi 5.5 host is prior to build 5230635. It is, therefore, affected by multiple vulnerabilities: - VMware ESXi 5.5 without patch ESXi550-201703401-SG has a Heap Buffer Overflow in SVGA. This issue may allow a guest to execute code on the host. CVE-2017-4902 - VMwa...

Request_Smuggler - Http Request Smuggling Vulnerability Scanner

Based on the amazing research by James Kettle. The tool can help to find servers that may be vulnerable to request smuggling vulnerability. Usage USAGE: requestsmuggler OPTIONS --url FLAGS: -h, --help Prints help information -V, --version Prints version information OPTIONS: --amount-of-payloads...

CVE-2022-0500

A flaw was found in unrestricted eBPF usage by the BPFBTFLOAD, leading to a possible out-of-bounds memory write in the Linux kernel’s BPF subsystem due to the way a user loads BTF. This flaw allows a local user to crash or escalate their privileges on the system...

UBUNTU-CVE-2022-0500

A flaw was found in unrestricted eBPF usage by the BPFBTFLOAD, leading to a possible out-of-bounds memory write in the Linux kernel’s BPF subsystem due to the way a user loads BTF. This flaw allows a local user to crash or escalate their privileges on the system...

High CPU Usage After Upgrade to Veeam Backup for Microsoft 365 6.0

Challenge After upgrading to Veeam Backup for Microsoft 365 6.0, higher than usual CPU usage may be observed during times when no tasks are occurring within Veeam Backup for Microsoft 365. Solution The issue is fixed in Veeam Backup for Microsoft 365 6.0 Cumulative Patch P20220413 6.0.0.379 -...

OPENSUSE-SU-2022:0089-1 Security update for nextcloud

This update for nextcloud fixes the following issues: nextcloud was updated to 21.0.9: - CVE-2021-41239 CWE-200: user enumeration setting not obeyed in User Status API boo1196905 - CVE-2021-41241 CWE-863: groupfolders advanced permissions is not obeyed for subfolders boo1196908 - CVE-2021-41741...

maven: Block repositories using http by default

A flaw was found in maven. Repositories that are defined in a dependency’s Project Object Model pom, which may be unknown to users, are used by default resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that...

PT-2022-12418 · Unknown · Globalprotect-Openconnect

Name of the Vulnerable Software and Affected Versions: GlobalProtect-openconnect versions prior to 2.0.0 Description: The issue is related to incorrect access control in GPService through DBUS and GUI. This allows arbitrary users to start a VPN connection to arbitrary servers. An attacker can hos...

ROS-20220322-01

Vulnerability in Mozilla Thunderbird email client, related to a memory usage error upon release when processing HTML content. Exploitation of the vulnerability could allow an attacker, acting remotely, to activate the post-release usage by forcing text to be recomposed in a SVG object and executi...