WS-2022-0280

All versions of moment-timezone from 0.1.0 contain build tasks vulnerable to command injection. if Alice uses tzdata pipeline to package moment-timezone on her own for example via "grunt data:2014d", where "2014d" stands for the version of the tzdata to be used from IANA's website, and Alice let'...

Security Bulletin: Vulnerability in bzip2 and libbzip2 before affects IBM License Metric Tool and IBM BigFix Inventory (CVE-2010-0405)

Summary Integer overflow in the BZ2decompress function in decompress.c in bzip2 and libbzip2 before 1.0.6 allows context-dependent attackers to cause a denial of service application crash or possibly execute arbitrary code via a crafted compressed file. Vulnerability Details CVEID: CVE-2010-0405...

Security Bulletin: Vulnerability in URL Redirection affects IBM License Metric Tool v9.x and IBM BigFix Inventory v9.x (CVE-2016-8961)

Summary IBM License Metric Tool v9.x and IBM BigFix Inventory v9.x accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect. This simplifies phishing attacks. Vulnerability Details CVEID: CVE-2016-8961 DESCRIPTION: IBM BigFix Inventory v9.x could...

Security Bulletin: Vulnerability due to Server log files exposure affects IBM License Metric Tool v9 and IBM BigFix Inventory v9 (CVE-2016-8963)

Summary IBM License Metric Tool v9 and IBM BigFix Inventory v9 Server log files can potentially reveal sensitive information. Vulnerability Details CVEID: CVE-2016-8963 DESCRIPTION: IBM BigFix Inventory v9 stores potentially sensitive information in log files that could be read by a local user...

App Layering - Stuck Tasks or new tasks hang at "pending" or "stalled"

Tasks won't progress, appear as stalled. New tasks sit at "Pending" From maservice.log: 2021-01-11 09:10:25,575 WARN 20193 UnitOfWorkImplemen: Transaction is implicitly being rolled back at Uni.Appliance.PersistenceLayer.UnitOfWork.UnitOfWorkImplementation.Dispose 0x00025 in :0 at...

Russian State Hackers Continue to Attack Ukrainian Entities with Infostealer Malware

Russian state-sponsored actors are continuing to strike Ukrainian entities with information-stealing malware as part of what's suspected to be an espionage operation. Symantec, a division of Broadcom Software, attributed the malicious campaign to a threat actor tracked Shuckworm, also known as...

Malicious delegated contractor can block funding tasks or mark tasks as complete

Lines of code Vulnerability details Impact A malicious delegated contractor can add a huge number of tasks or one task with a huge cost. This would then pose problems in allocateFunds as tasks could not be funded. Builder could remove delegation for the contractor but couldn't replace the...

Fedora: Security Advisory for osmo (FEDORA-2022-e57547c384)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 35 Update: osmo-0.4.4-2.fc35

Osmo is a handy personal organizer which includes calendar, tasks manager and address book modules. It was designed to be a small, easy to use and good looking PIM tool to help to manage personal information. In current state the organizer is quite convenient in use - for example, user can perfor...

[SECURITY] Fedora 36 Update: osmo-0.4.4-2.fc36

Osmo is a handy personal organizer which includes calendar, tasks manager and address book modules. It was designed to be a small, easy to use and good looking PIM tool to help to manage personal information. In current state the organizer is quite convenient in use - for example, user can perfor...

Hackers Targeting VoIP Servers By Exploiting Digium Phone Software

VoIP phones using Digium's software have been targeted to drop a web shell on their servers as part of an attack campaign designed to exfiltrate data by downloading and executing additional payloads. "The malware installs multilayer obfuscated PHP backdoors to the web server's file system,...

1k-tasks (>=2.3.0, <=3.6.1), @alitajs/remove_version (>=0.0.1, <=0.0.2) +408 more potentially affected by CVE-2022-25858 via terser (>=5.0.0, <=5.14.1)

terser NPM version =5.0.0, =2.3.0, =0.0.1, =0.0.3, =0.5.4, =2.0.0-alpha.0, =2.7.0-alpha.2, =2.7.0-alpha.1, =2.0.0-alpha.0, =2.8.0-canary.5, =10.0.0-beta.0, =0.1001.0-next.4, =1.6.3, =1.8.24 - @anyt/oro-webpack-config-builder 0.0.1 - @applegamer22/scr-web 1.0.0-alpha.24.3.1 and more Source cves:...

SAP BusinessObjects Central Management Console跨站请求伪造漏洞

SAP BusinessObjects Central Management Console is a Web-based tool from SAP that can be used to perform most daily administrative tasks, including user management, content management, and server management. Management Console suffers from a cross-site request forgery vulnerability, which stems fr...

CVE-2022-2197

By using a specific credential string, an attacker with network access to the device’s web interface could circumvent the authentication scheme and perform administrative operations...

Forced Chrome extensions get removed, keep reappearing

In the continued saga of annoying search extensions we have a new end-of-level boss. Victims have been reporting browser extensions that were removed by Malwarebytes, but “magically” came back later. Since the victims also complained about the message saying their browser was "managed", we had a...

GSD-2022-1003635 rcu-tasks: Fix race in schedule and flush work

rcu-tasks: Fix race in schedule and flush work This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.121 by commit...

GSD-2022-1002843 rcu-tasks: Fix race in schedule and flush work

rcu-tasks: Fix race in schedule and flush work This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.3 by commit...

PT-2022-31417

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.17.14 Description A potential issue exists due to a race in schedule and flush work in rcu-tasks. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions...

PT-2022-31898

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.121 Description A potential issue exists due to a race in schedule and flush work in rcu-tasks. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions...

PT-2022-31106

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.18.3 Description A potential issue exists due to a race in schedule and flush work in rcu-tasks. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions...