Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior. This issue was fixed in version 2.10….
郵便局取得保有データ活用促進へ協議の場創設
総務省は郵便局が取得・保有するデータの活用推進を図るとして、データの提供を求める団体と日本郵政・日本…
NFTホルダーと共同で制作、新しいアニメづくりを模索するプロジェクト「ANIM」 | DIAMOND SIGNAL
旧態依然としたアニメ制作のかたちを変えるべく、アニメ業界出身でポケモンや新世紀エヴァンゲリオン、PSYCHO-PASS（サイコパス）などに携わったクリエーターが“Web3時代のアニメスタジオ”を標榜するプロジェクトを立ち上げた。それが「ANIM」だ。…
[nvflare] NVFLARE unsafe deserialization due to Pickle
Impact
NVFLARE contains a vulnerability where deserialization of Untrusted Data due to Pickle usage may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and Impact to both Confidentiality and Integrity.
All ver…
[mdx-mermaid] Improper Control of Generation of Code (‘Code Injection’) in mdx-mermaid
Impact
Arbitary javascript injection
Modify any mermaid code blocks with the following code and the code inside will execute when the component is loaded by MDXjs
` + (function () {
// Put Javascript code here
return ”
}()) + `
The block below sh…
[nitrado.js] Polynomial regular expression used on uncontrolled data in nitrado.js
Impact
Possible ReDoS with lib input of {{ and with many repetitions of {{|
Patches
Patched in all versions above 0.2.5
Workarounds
No known work arounds.
References
OWASP: Regular expression Denial of Service – ReDoS
Wikipedia: ReDoS.
Wikipedia: Time…
日付・文字入力がかなりラクになる、iPhoneの便利テクニック
iPhoneのテキスト入力では、途中にかな／英／数といった文字種の切り替え操作が増えるほど入力効率は…
[prestashop/productcomments] PrestaShop Product Comments Cross-site Scripting vulnerability
Impact
An attacker could steal an admin’s cookie
Patches
The issue is fixed in 5.0.2
References
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
References
https://github.com/PrestaShop/productcomments/security/advi…
[matrix-synapse] Denial of service due to incorrect application of event authorization rules
Impact
The Matrix specification specifies a list of event authorization rules which must be checked when determining if an event should be accepted into a room.
In versions of Synapse up to and including v1.61, some of these rules are not correctly app…
統一教会問題で区切りと思いきや、「五輪疑惑」森喜朗元首相に累は及ぶのか
岸田首相（自民党総裁）は8月31日、新型コロナ感染によるリモート執務から復帰し、記者会見で茂木幹事長に対し、党として旧統一教会との関係を調査するように指示をしたことを明らかにし、関係を絶つと宣言した。 今後、旧統一教会側