Malicious code in @alice-bob/com.alice.adonis (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 90cad1ecdb82a3b682d758bf5ac96c012458d22c4632d480caff86f1790a207a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Incorrect accounting of free weight in _decrementWeightUntilFree

Lines of code Vulnerability details Impact In decrementWeightUntilFree, the free weight is calculated by balanceOfuser - getUserWeightuser plus weight freed from non-deprecated gauges. The non-deprecated criteria is unnecessary and lead to incorrect accounting of free weight. Proof of Concept...

alice-gerfault.com Improper Access Control vulnerability OBB-2213995

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Mozilla Thunderbird 安全漏洞

Mozilla Thunderbird is a set of the United States Mozilla Foundation from the Mozilla Application Suite independent of the e-mail client software. A security bypass vulnerability exists in versions of MThunderbird prior to 78.9.1, which can be exploited by an attacker to send unencrypted e-mail t...

Can a browser extension be cursed?

Privacy Can a browser extension be cursed? Share December 4th, 2020 Mallory tries to create a browser extension that will let him spy on Alice. TL;DR: skip to the conclusions to see what Alice learned. The Privacy Problem Mallory was quite tired of his failed attempts to melt Alice’s heart. She...

What is the TLS padlock saying?

Security What is the TLS padlock saying? Share November 20th, 2020 Alice and Bob use TLS to keep their long distance relationship hot and private. TL;DR: skip to the conclusions to see what Alice learned. The Privacy Problem Alice and Bob had to turn their relationship into a long distance one...

To VPN or not to VPN?

Security To VPN or not to VPN? Share October 29th, 2020 Alice and Bob use VPN to fight Mallory, an inquisitive sysadmin. TL;DR: skip to the conclusions to see what Alice learned. The Privacy Problem Alice and Bob recently met Mallory, who works at the cable company providing internet access to th...

alice-project.biz Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1147044 Security Researcher MrRain1996 Helped patch 1003 vulnerabilities Received 5 Coordinated Disclosure badges Received 9 recommendations , a holder of 5 badges for responsible and coordinated disclosure, found a security vulnerability affecting alice-project.biz websit...

alicecostello.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-953830 Security Researcher Gh05tPT Helped patch 6892 vulnerabilities Received 10 Coordinated Disclosure badges Received 48 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting alicecostello.com website...

alice-immo.com XSS vulnerability

Open Bug Bounty ID: OBB-659552 Description| Value ---|--- Affected Website:| alice-immo.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Code injection

In Philips Alice 6 System version R8.0.2 or prior, the lack of proper data encryption passes up the guarantees of confidentiality, integrity, and accountability that properly implemented encryption conveys...

CVE-2018-7498

In Philips Alice 6 System version R8.0.2 or prior, the lack of proper data encryption passes up the guarantees of confidentiality, integrity, and accountability that properly implemented encryption conveys...

CVE-2018-5451

In Philips Alice 6 System version R8.0.2 or prior, when an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct. This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers...

Code injection

In Philips Alice 6 System version R8.0.2 or prior, when an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct. This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers...

CVE-2018-7498

In Philips Alice 6 System version R8.0.2 or prior, the lack of proper data encryption passes up the guarantees of confidentiality, integrity, and accountability that properly implemented encryption conveys...

CVE-2018-5451

In Philips Alice 6 System version R8.0.2 or prior, when an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct. This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers...

CVE-2018-7498

In Philips Alice 6 System version R8.0.2 or prior, the lack of proper data encryption passes up the guarantees of confidentiality, integrity, and accountability that properly implemented encryption conveys...

CVE-2018-7498

Philips Alice 6 System (R8.0.3 or prior) is affected by CVE-2018-7498 due to missing encryption of sensitive data (CWE-311), impacting confidentiality/integrity not properly protected. Update to R8.0.4 to remediate; apply network security controls and follow ICS-CERT guidance for defense-in-depth.

CVE-2018-5451

CVE-2018-5451 is tied to Philips Alice 6 System. The connected update (ICSMA-18-086-01) confirms an improper authentication vulnerability (CWE-287) where, when an actor claims an identity, the system does not adequately verify it, potentially exposing resources or functionality to unintended acto...

CVE-2018-5451

In Philips Alice 6 System version R8.0.2 or prior, when an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct. This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers...