[SECURITY] Fedora 37 Update: libconfuse-3.3-7.fc37

libConfuse is a configuration file parser library, licensed under the terms of the ISC license, and written in C. It supports sections and (lists of) values (strings, integers, floats, booleans or oth ...

Continue Reading

CVSS3 - HIGH

Scanvus – my open source Vulnerability Scanner for Linux hosts and Docker images

Hello everyone! This video was recorded for the VMconf 22 Vulnerability Management conference, [vmconf.pw](). I will be talking about my [open source project Scanvus](). This project is already a year ...

Continue Reading
Harbor fails to validate the user permissions when updating a robot account

### Impact Harbor fails to validate the user permissions when updating a robot account that belongs to a project that the authenticated user doesn’t have access to. API call: PUT /robots/{robot_id} B ...

Continue Reading
Metasploit Weekly Wrap-Up

## BYOS: Bring your own stager ![Metasploit Weekly Wrap-Up](https://blog.rapid7.com/content/images/2022/09/metasploit-ascii-1-2.png) We try hard to make sure we have a great choice of fully-functional ...

Continue Reading

CVSS3 - HIGH

CVSS2 - HIGH

Harbor fails to validate the user permissions when updating a robot account

### Impact Harbor fails to validate the user permissions when updating a robot account that belongs to a project that the authenticated user doesn’t have access to. API call: PUT /robots/{robot_id} B ...

Continue Reading
XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment form

### Impact It's possible to store JavaScript in an attachment name, which will be executed by anyone trying to move the corresponding attachment. For example, an attachment with name `>.jpg` will e ...

Continue Reading

CVSS3 - MEDIUM

OPA Compiler: Bypass of WithUnsafeBuiltins using “with” keyword to mock functions

### Impact The Rego compiler provides a (deprecated) `WithUnsafeBuiltins` function, which allows users to provide a set of built-in functions that should be deemed unsafe — and as such rejected — by ...

Continue Reading

CVSS3 - CRITICAL

JOSE vulnerable to resource exhaustion via specifically crafted JWE

The PBKDF2-based JWE key management algorithms expect a JOSE Header Parameter named `p2c` ([PBES2 Count](https://www.rfc-editor.org/rfc/rfc7518.html#section-4.8.1.2)), which determines how many PBKDF2 ...

Continue Reading

CVSS3 - MEDIUM

Back to Main

Subscribe for the latest news: