兵庫県姫路市の清元秀泰市長が、3月16日に開かれた姫路独協大学の卒業式で、「自分を三流大学出身と思っ…
[com.caucho:resin] Path Traversal in Caucho Resin
There is a Directory traversal vulnerability in Caucho Resin, as distributed in Resin 4.0.52 – 4.0.56, which allows remote attackers to read files in arbitrary directories via a ; in a pathname within an HTTP request.
References
https://nvd.nist.gov/v…
[intelliants/subrion] Remote code execution in Subrion
Subrion is an open source php content management system. A Remiote Code Execution (RCE) vulnerability exiss in Subrion CMS 4.2.1 via modified code in a background field; when the information is modified, the data in it will be executed through eval().
…
[urijs] URL Confusion When Scheme Not Supplied in medialize/uri.js
When parsing a URL without a scheme and with excessive slashes, like ///www.example.com, URI.js will parse the hostname as null and the path as /www.example.com.
Such behaviour is different from that exhibited by browsers, which will parse ///www.examp…
「航空サブスクサービス」は通常の旅と異なるカスタマージャーニーを創出することが明らかに。HafH × JAL実証実験レポート
株式会社KabuK Styleと日本航空株式会社および株式会社ジャルパックは、2021年8月～11月に「航空サブスクサービス」の実証実験を実施し、そのレポートを公開した。 「航空サブスクサービス」の実証実験は、デジタル化 […]
The post 「航空サブスクサービス」は通常の旅と異なるカスタマージャーニーを創出することが明らかに。HafH × JAL実証実験レポート appeared first on Marketing Native（マーケティング ネイティブ）.
[vyper] Incorrect Comparison in Vyper
Impact
bytestrings can have dirty bytes in them, resulting in the word-for-word comparison to give incorrect results, e.g.
b1: Bytes[32] = b”abcdef”
b1 = slice(b1, 0, 1)
b2: Bytes[32] = b”abcdef”
t: bool = b1 == b2 # incorrectly evaluates to True
eve…
[twisted] Inconsistent Interpretation of HTTP Requests in twisted.web
The Twisted Web HTTP 1.1 server, located in the twisted.web.http module, parsed several HTTP request constructs more leniently than permitted by RFC 7230:
The Content-Length header value could have a + or – prefix.
Illegal characters were permitted in…
[Moment.js] Path Traversal: ‘dir/../../filename’ in moment.locale
Impact
This vulnerability impacts npm (server) users of moment.js, especially if user provided locale string, eg fr is directly used to switch moment locale.
Patches
This problem is patched in 2.29.2, and the patch can be applied to all affected versio…
[github.com/ipfs/go-ipfs] Opened exploitable ports in default docker-compose.yaml in go-ipfs
Impact
Allows admin API access to the IPFS node.
Who ?
This affects people running the docker-compose.yaml service in an environment where the docker host is directly attached to a public or untrusted IP. In the vulnerable version, the private API en…
ツイッター筆頭株主へ、イーロン・マスク流「言論の自由」奪還戦
テスラやスペースXの創業者、イーロン・マスク氏が、米ツイッター社株の9.2％を取得し、筆頭株主に躍り出たとみられることが4日、明らかになった。米証券取引委員会（SEC）に提出した大量保有報告書に記載されていた。 3月に「