CVE-2022-33154: Improper Neutralization of Input During Web Page Generation

The schema aka Embedding schema.org vocabulary extension before 1.13.1 and 2.x before 2.5.1 for TYPO3 allows XSS...

Login schema unable to be configured and the SELECT button grayed out

When configuring nFactor authentication, user is unable to select login schema xml in GUI page. The "SELECT" button is greyed out. Like below screenshot...

Fedora: Security Advisory for golang-github-rubenv-sql-migrate (FEDORA-2022-fae3ecee19)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 36 Update: golang-github-rubenv-sql-migrate-0-0.4.20210529gita32ed26.fc36

sql-migrate is a SQL Schema migration tool for Go, based on gorp and goose...

[SECURITY] Fedora 36 Update: golang-github-appc-spec-0.8.11-14.fc36

This package contains schema definitions and tools for the App Container app c specification. These include technical details on how an appc image is downloaded over a network, cryptographically verified, and executed on a host. See SPEC.md for details of the specification itself...

USN-5496-1 cloud-init vulnerability

Mike Stroyan discovered that cloud-init could log password hashes when reporting schema failures. An attacker with access to these logs could potentially use this to gain user credentials...

UBUNTU-CVE-2022-2084

Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed passwords...

CVE-2022-2084

Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed passwords...

python-ldap before 3.4.0 is vulnerable to a denial of service when ldap.schema is used for untrusted schema definitions because of a regular expression denial of service (ReDoS) flaw in the LDAP schema parser. By sending crafted regex input a remote authenticated attacker could exploit this vulnerability to cause a denial of service condition.

...

PT-2022-14845

Name of the Vulnerable Software and Affected Versions cloud-init versions prior to 22.3 Description Sensitive data could be exposed in world-readable logs of cloud-init when schema failures are reported, potentially including hashed passwords. This issue may allow an attacker to gain unauthorized...

nodejs-json-schema: Prototype pollution vulnerability

The json-schema Node.JS library was vulnerable to prototype pollution during the validation of a JSON object. An attacker, able to provide a specially crafted JSON file for validation, could use this flaw to modify the behavior of the node program, to, for example, execute arbitrary code...

OpenAPI Permissive Input Validation

OpenAPI specification is an API description format for REST APIs. An OpenAPI file is written in YAML or JSON and describes all the API properties like the available endpoints with the related operations or the authentication methods. The Schema object allows the definition of input and output dat...

Malicious Package

Overview en-conduit-schema is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package...

Malicious Package

Overview yelp-schema-design is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this packag...

Malicious Package

Overview schema-render is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Note: This malicious package was uncovered by one of...

nodejs-json-schema: Prototype pollution vulnerability

The json-schema Node.JS library was vulnerable to prototype pollution during the validation of a JSON object. An attacker, able to provide a specially crafted JSON file for validation, could use this flaw to modify the behavior of the node program, to, for example, execute arbitrary code...

ASUS Control Center SQL Injection Vulnerability

ASUS Control Center is a new centralized IT management software from ASUS China. The software can monitor and control ASUS servers, workstations. A SQL injection vulnerability exists in ASUS Control Center v1.4.2.5. An attacker can exploit this vulnerability to inject SQL commands into specific A...

Malicious code in analytics-event-schema (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6413608ce165b2a652105482d20f1f57fe22418225f040746354d767e25b8a55 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-985 Malicious code in analytics-event-schema (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6413608ce165b2a652105482d20f1f57fe22418225f040746354d767e25b8a55 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in feedback-schema (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0ce3047c466c30d8bf8684b6bedb5286b46a6addb1502e7f64e70afcac31131c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...