1180 matches found
MAL-2023-307 Malicious code in env-cross (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5dfac7391de71e5fbbea3c5880d76d0fada380dc4026cd39541ac9684098b56e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in env-cross (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5dfac7391de71e5fbbea3c5880d76d0fada380dc4026cd39541ac9684098b56e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Elastic Kibana < 8.7.1 Arbitrary Code Execution
The Elastic Kibana software on the remote host is missing a security update. It is, therefore, affected by multiple arbitrary code execution vulnerabilities: - An attacker with All privileges to the Uptime/Synthetics feature could send a request that will attempt to execute JavaScript code. This...
LLVM project 缓冲区错误漏洞
LLVM project is a collection of modular, reusable compiler and toolchain technologies open-sourced by LLVM. A security vulnerability exists in LLVM project version a0138390, which stems from a segmentation error in the component mlir::spirv::TargetEnv::TargetEnvmlir::spirv::TargetEnvAttr...
Node.js: insecure loading of ICU data through ICU_DATA environment variable
An untrusted search path vulnerability exists in Node.js. 19.6.1, 18.14.1, 16.19.1, and 14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges...
SUSE CVE-2006-4124
The libXm library in LessTif 0.95.0 and earlier allows local users to gain privileges via the DEBUGFILE environment variable, which is used to create world-writable files when libXm is run from a setuid program...
SUSE CVE-2014-0106
Sudo 1.6.9 before 1.8.5, when envreset is disabled, does not properly check environment variables for the envdelete restriction, which allows local users with sudo permissions to bypass intended command restrictions via a crafted environment variable...
Malicious code in yandex-cfg-env (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 84d83751dd94336617da93fa09ccd8505ecd47f4cbc9ef2dc4d9ea70068c82dc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-983 Malicious code in yandex-cfg-env (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 84d83751dd94336617da93fa09ccd8505ecd47f4cbc9ef2dc4d9ea70068c82dc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious Package
Overview yandex-cfg-env is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package wa...
CVE-2022-45537
EyouCMS = 1.6.0 was discovered a reflected-XSS in the article publish component in cookie "ENVLISTURL"...
CVE-2022-46179 LiuOS vulnerable to Authorization Bypass through User-Controlled Key
LiuOS is a small Python project meant to imitate the functions of a regular operating system. Version 0.1.0 and prior of LiuOS allow an attacker to set the GITHUBACTIONS environment variable to anything other than null or true and skip authentication checks. This issue is patched in the latest...
The vulnerability of the do_setup_env function in the sshd service of the OpenSSH encryption service allows a hacker to escalate their privileges.
The vulnerability of the dosetupenv function in the sshd service of the OpenSSH encryption service is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...
GHSA-W3X5-427H-WFQ6 Spring Boot Admins integrated notifier support allows arbitrary code execution
Impact All users who run Spring Boot Admin Server, having enabled Notifiers e.g. Teams-Notifier and write access to environment variables via UI are possibly affected. Patches In the most recent releases of Spring Boot Admin 2.6.10 and 2.7.8 the issue is fixed by implementing SimpleExecutionConte...
Malicious code in bostcs-perset-env (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7637e5041da1a022478a80dbe5aa9272db6e68ba2bff280a26ff77cb71acdcea Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-1655 Malicious code in bostcs-perset-env (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7637e5041da1a022478a80dbe5aa9272db6e68ba2bff280a26ff77cb71acdcea Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
OS Command Injection
Heroku-env is vulnerable to OS command injection. The vulnerability is due to the function get that executes a shell command with unsanitized user input. An attacker can inject shell code using the app parameter, using the control operator & or && followed by an arbitrary command...
GHSA-JP45-65JW-94MJ heroku-env susceptible to command injection
A command injection vulnerability affects all versions of package heroku-env. The injection point is located in lib/get.js which is required by index.js...
