Tag: path traversal

  • Hacker News: Researchers have identified a total of 6 vulnerabilities in rsync

    Source URL: https://www.openwall.com/lists/oss-security/2025/01/14/3 Source: Hacker News Title: Researchers have identified a total of 6 vulnerabilities in rsync Feedly Summary: Comments AI Summary and Description: Yes Summary: The text discusses multiple vulnerabilities identified in the rsync software, including a critical heap buffer overflow that allows arbitrary code execution with minimal access rights. This communication is especially…

  • Hacker News: WorstFit: Unveiling Hidden Transformers in Windows ANSI

    Source URL: https://blog.orange.tw/posts/2025-01-worstfit-unveiling-hidden-transformers-in-windows-ansi/ Source: Hacker News Title: WorstFit: Unveiling Hidden Transformers in Windows ANSI Feedly Summary: Comments AI Summary and Description: Yes Summary: The text discusses a novel security vulnerability termed “WorstFit” that exploits Microsoft Windows’ character encoding and conversion mechanisms, particularly its Best-Fit behavior, leading to various forms of attacks including Remote Code Execution…

  • The Register: Mitel 0-day, 5-year-old Oracle RCE bugs under active exploit

    Source URL: https://www.theregister.com/2025/01/08/mitel_0_day_oracle_rce_under_exploit/ Source: The Register Title: Mitel 0-day, 5-year-old Oracle RCE bugs under active exploit Feedly Summary: 3 CVEs added to CISA’s catalog Cybercriminals are actively exploiting two vulnerabilities in Mitel MiCollab, including a zero-day flaw, alongside a critical remote code execution vulnerability in Oracle WebLogic Server that has been exploited for at least…

  • Alerts: CISA Adds Three Known Exploited Vulnerabilities to Catalog

    Source URL: https://www.cisa.gov/news-events/alerts/2025/01/07/cisa-adds-three-known-exploited-vulnerabilities-catalog Source: Alerts Title: CISA Adds Three Known Exploited Vulnerabilities to Catalog Feedly Summary: CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2024-41713 Mitel MiCollab Path Traversal Vulnerability CVE-2024-55550 Mitel MiCollab Path Traversal Vulnerability CVE-2020-2883 Oracle WebLogic Server Unspecified Vulnerability Users and administrators are also encouraged to…

  • MCP Server Cloud – The Model Context Protocol Server Directory: CLI MCP Server – MCP Server Integration

    Source URL: https://mcpserver.cloud/server/plurigrid-cli-mcp-server Source: MCP Server Cloud – The Model Context Protocol Server Directory Title: CLI MCP Server – MCP Server Integration Feedly Summary: AI Summary and Description: Yes **Summary:** The provided text elaborates on a secure Model Context Protocol (MCP) server designed for executing controlled command-line operations, emphasizing comprehensive security features that are vital…

  • The Register: Critical security hole in Apache Struts under exploit

    Source URL: https://www.theregister.com/2024/12/17/critical_rce_apache_struts/ Source: The Register Title: Critical security hole in Apache Struts under exploit Feedly Summary: You applied the patch that could stop possible RCE attacks last week, right? A critical security hole in Apache Struts 2, patched last week, is now being exploited using publicly available proof-of-concept (PoC) code.… AI Summary and Description:…

  • The Register: PoC exploit chains Mitel MiCollab 0-day, auth-bypass bug to access sensitive files

    Source URL: https://www.theregister.com/2024/12/06/mitel_micollab_0day/ Source: The Register Title: PoC exploit chains Mitel MiCollab 0-day, auth-bypass bug to access sensitive files Feedly Summary: Still unpatched 100+ days later, watchTowr says A zero-day arbitrary file read vulnerability in Mitel MiCollab can be chained with a now-patched critical bug in the same platform to give attackers access to sensitive…

  • Hacker News: D-Link says it won’t patch 60k older modems

    Source URL: https://www.techradar.com/pro/security/d-link-says-it-wont-patch-60-000-older-modems-as-theyre-not-worth-saving Source: Hacker News Title: D-Link says it won’t patch 60k older modems Feedly Summary: Comments AI Summary and Description: Yes Summary: Security researchers have identified critical vulnerabilities in D-Link modems that have reached end-of-life status, which the company will not patch. This situation highlights the importance of maintaining infrastructure security and the…

  • Alerts: CISA Adds Five Known Exploited Vulnerabilities to Catalog

    Source URL: https://www.cisa.gov/news-events/alerts/2024/11/12/cisa-adds-five-known-exploited-vulnerabilities-catalog Source: Alerts Title: CISA Adds Five Known Exploited Vulnerabilities to Catalog Feedly Summary: CISA has added five new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2021-26086 Atlassian Jira Server and Data Center Path Traversal Vulnerability CVE-2014-2120 Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) Vulnerability CVE-2021-41277 Metabase GeoJSON API Local…