CVE-2022-34916

Apache Flume versions 1.4.0 through 1.10.0 are vulnerable to a remote code execution RCE attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI to allow only the use of the java...

Prototype Pollution

node-import is vulnerable to prototype pollution. The vulnerability exists due to a lack of sanitization in the index file "index.js", allowing an attacker to modify and get control of the param attribute...

CVE-2021-3696

A heap out-of-bounds write may heppen during the handling of Huffman tables in the PNG reader. This may lead to data corruption in the heap space. Confidentiality, Integrity and Availablity impact may be considered Low as it's very complex to an attacker control the encoding and positioning of...

CVE-2021-3696

A heap out-of-bounds write may heppen during the handling of Huffman tables in the PNG reader. This may lead to data corruption in the heap space. Confidentiality, Integrity and Availablity impact may be considered Low as it's very complex to an attacker control the encoding and positioning of...

Prototype Pollution

deep-get-set is vulnerable to prototype pollution. The vulnerability exists due to an incomplete fix of CVE-2020-7715, allowing an attacker to get control of value of “deep” and modify attributes such as proto, constructor and prototype...

Malicious code in vue3-infinite-scroll (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5723a78269b09096a17fe980684f1db2efd8c680ecb273f0b72277a1d005e3df Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in myjohndeereapi-oauth2-nodejs-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e8e396af178eba7a59aaabef53f2a909b237f1fbb21b5735f93c3607d5f87421 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in xbto-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 770fd82916af600433e97fa8d4e2a161b28dabd08484723434b21e45c6543c67 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Atlassian Confluence Server 注入漏洞

Atlassian Confluence Server is the server version of Atlassian Australia's suite of collaboration software with enterprise knowledge management capabilities and support for building enterprise WiKi. A command execution vulnerability exists in Atlassian Confluence Server and Data Center that could...

Mozilla: Untrusted input used in JavaScript object indexing, leading to prototype pollution

The Mozilla Foundation Security Advisory describes this flaw as: An attacker could have sent a message to the parent process where the contents were used to double-index into a JavaScript object, leading to prototype pollution and ultimately attacker-controlled JavaScript executing in the...

Mozilla: Untrusted input used in JavaScript object indexing, leading to prototype pollution

The Mozilla Foundation Security Advisory describes this flaw as: An attacker could have sent a message to the parent process where the contents were used to double-index into a JavaScript object, leading to prototype pollution and ultimately attacker-controlled JavaScript executing in the...

CVE-2022-1677

In OpenShift Container Platform, a user with permissions to create or modify Routes can craft a payload that inserts a malformed entry into one of the cluster router's HAProxy configuration files. This malformed entry can match any arbitrary hostname, or all hostnames in the cluster, and direct...

CVE-2021-26317

CVE-2021-26317: The AMD SMM protocol verification failure allows an attacker to take control of the SMM protocol and modify SPI flash, potentially enabling arbitrary code execution. Public documentation ties this to AMD’s SMM/ASP/SEV family and lists it among AMD client vulnerabilities with a hig...

curl: Certificate authentication re-use on redirect

Summary: Curl will reuse existing certificate for further TLS requests when following redirects. This is similar to CVE 2022-27774 but with narrower impact, as the secret private key is not leaked. Steps To Reproduce: 1. Configure a site targetsite.tld to require client certificates for...

Prototype Pollution

nconf is vulnerable to prototype pollution. The function prototype.set allows an attacker to get control of value of “path” and modify attributes such as proto, constructor and prototype...

CVE-2022-24733 Improper Restriction of Rendered UI Layers or Frames in Sylius

Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, it is possible for a page controlled by an attacker to load the website within an iframe. This will enable a clickjacking attack, in which the attacker's page overlays the target application's interface wi...

CVE-2022-25186

Jenkins HashiCorp Vault Plugin 3.8.0 and earlier implements functionality that allows agent processes to retrieve any Vault secrets for use on the agent, allowing attackers able to control agent processes to obtain Vault secrets for an attacker-specified path and key...

AZL-8586 CVE-2021-45444 affecting package zsh for versions less than 5.9-1

In zsh before 5.8.1, an attacker can achieve code execution if they control a command output inside the prompt, as demonstrated by a %F argument. This occurs because of recursive PROMPTSUBST expansion...

Prototype Pollution

mixme is vulnerable to prototype pollution. The function mutate and merge allows an attacker to get control of value of “path” and modify attributes such as proto, constructor and prototype...

Bosch Video Security 跨站脚本漏洞

Bosch Video Security is a video security system from Bosch, Germany. Used to connect to Bosch Ip cameras and encoders from around the world, experience instant video playback, full access to your recordings, forensic search of cameras with Bosch video analytics support, and smooth control of Ptz...