BugAlert.org @BugAlertDotOrg

https://t.co/bDalRXbvAE is a service for alerting security and IT professionals of high-impact and 0day vulnerabilities. Follow for vuln information and general updates. bugalert.org Joined December 2021

Tweets

78
Followers

876
Following

0
Likes

20

BugAlert.org @BugAlertDotOrg

2 years ago

A privilege escalation flaw has been found, and is being actively exploited, in Atlassian Confluence, and has been assigned a bug alert severity of 'very high'. Atlassian recommends removing installations from the Intern... bugalert.org/content/notice… #BugAlertNotice

0 3 5 503 0

BugAlert.org @BugAlertDotOrg

3 years ago

We will be leaving Twitter in the coming days and setting up on the infosec.exchange Mastodon server. An announcement will be made when we're ready to transition. In the meantime, please consider joining our Slack. Spread the word 🙏 #BugAlertNews join.slack.com/t/bug-alert/sh…

0 1 5 0 0

Download Image

BugAlert.org @BugAlertDotOrg

3 years ago

This is a test notice, which you have opted in to. Bug Alert has completed integrating Twilio support for international calls and SMS. Save our phone number to your contacts! bugalert.org/content/notice… #BugAlertNotice

0 0 1 0 0

BugAlert.org @BugAlertDotOrg

3 years ago

tl;dr on the OpenSSL vuln: it seemed bad originally, but then OpenSSL realized it wasn't critical after all. Treat it like any other software flaw and follow your normal patching cycle. Unlikely to be exploited in real-world configurations.

0 12 35 0 1

BugAlert.org @BugAlertDotOrg

3 years ago

On Tuesday Nov 1st between 9-11am EDT, a security fix will be released for a critical OpenSSL 3.0.x vuln. Ubuntu 22.04 & RHEL 9 impacted. Docker ubuntu:latest also impacted. Latest releases of Alpine/Debian/AL2 not impacted, they use 1.1.x lineage. Last critical (2016) was RCE.

1 1 5 0 0

BugAlert.org @BugAlertDotOrg

3 years ago

Still lots of unwarranted panic on this CVE, which some people are referring to as #text4shell. It's clear that this vulnerability has a number of preconditions that are unlikely to be found in the real world. There is no cause for alarm.

BugAlert.org @BugAlertDotOrg

3 years ago

0 1 6 0 1

1 3 11 0 1

BugAlert.org @BugAlertDotOrg

3 years ago

Bug Alert is watching CVE-2022-42889 (RCE in Apache Commons Text v1.5 - v1.9) carefully. So far, not seeing much evidence that this is widely exploitable, but we'll fire off a notice if that changes.

0 1 6 0 1

BugAlert.org @BugAlertDotOrg

3 years ago

FYI if you host a Bitbucket install, unauth RCE: confluence.atlassian.com/bitbucketserve… Not in widespread enough use for a full-on Bug Alert notice, though.

0 2 2 0 0

BugAlert.org @BugAlertDotOrg

3 years ago

Multiple Vulnerabilities have been disclosed in Atlassian Products. A hardcoded credential vulnerability in Questions for Confluence, and Servlet Filter Bypass Vulnerabilities have been found in multiple Atlassian produc... bugalert.org/content/notice… #BugAlertNotice

1 1 5 0 0

BugAlert.org @BugAlertDotOrg

3 years ago

Patches now available for Atlassian Confluence: atlassian.com/software/confl…

0 2 4 0 0

BugAlert.org @BugAlertDotOrg

3 years ago

An authentication bypass vulnerability has been found in Atlassian Jira. This issue can be exploited in the default configuration, and has been assigned a bug alert severity of 'very high'. bugalert.org/content/notice… #BugAlertNotice