Design/Logic Flaw

An authenticated attacker could create an audit file that bypasses PowerShell cmdlet checks and executes commands with administrator privileges...

Command injection

An authenticated attacker could read arbitrary files from the underlying operating system of the scanner using a custom crafted compliance audit file without providing any valid SSH credentials...

CVE-2022-32974

An authenticated attacker could read arbitrary files from the underlying operating system of the scanner using a custom crafted compliance audit file without providing any valid SSH credentials...

CVE-2022-32974

CVE-2022-32974 is confirmed in connected documents as affecting Tenable Nessus/ Nessus Agent prior to specific versions. An authenticated attacker could read arbitrary files from the underlying OS via a crafted compliance audit file, without SSH credentials. Exploitation details and affected vers...

CVE-2022-32973

An authenticated attacker could create an audit file that bypasses PowerShell cmdlet checks and executes commands with administrator privileges...

SAP NetWeaver AS Java Insufficient Logging

When user with insufficient privileges tries to access any application in SAP NetWeaver Administrator Administrator applications, version - 7.50, no security audit log is created. Therefore, security audit log Integrity is impacted. Note that Nessus has not tested for this issue but has instead...

PT-2022-21616 · Microsoft +1 · Powershell +1

Name of the Vulnerable Software and Affected Versions: PowerShell affected versions not specified Description: An authenticated attacker could create an audit file that bypasses PowerShell cmdlet checks and executes commands with administrator privileges. Recommendations: At the moment, there is ...

Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server

Impact All unpatched versions of Argo CD starting with v1.3.0 is vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive YAML files from Argo CD's repo-server. A malicious Argo CD user with write access for a repository which is or may be use...

Malicious code in test-audit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 748df8f06d1c1132320f9757b1361786793823e3dc2881ff8e6d6f8f33ac4606 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1171 Malicious code in audit-pricing (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 63494ded7d57fd765870370ad094bbbf96de1b2ea04e60358ef700792419245a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in audit-pricing (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 63494ded7d57fd765870370ad094bbbf96de1b2ea04e60358ef700792419245a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1864 Malicious code in cf-scraper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1d6e6033f1f1ea9b7653a997818b6c7703bbe7bfca9f0b2ecce0dea100f773c7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in bfx-ws2-api-audit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a4aa321103468bc42d52655217679df5a46958d2714780f7f4443659ed50d457 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in private-identity-audit-wasm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4b1bd9d874421f920c2d168c65c29f9f4cfd20aebdd77c6fdbfd8e4e0935a778 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5463 Malicious code in private-identity-audit-wasm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4b1bd9d874421f920c2d168c65c29f9f4cfd20aebdd77c6fdbfd8e4e0935a778 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1170 Malicious code in audit-logging (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 76f664ae26ee0d9606ef9d7901b65dc80da1f73baee088eeda8ab6025dabf096 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in audit-logging (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 76f664ae26ee0d9606ef9d7901b65dc80da1f73baee088eeda8ab6025dabf096 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Insecure path traversal in Git Trigger Source can lead to arbitrary file read

Impact A path traversal issue was found in the g GitArtifactReader.Read API. Read calls into g GitArtifactReader.readFromRepository that opens and reads the file that contains the trigger resource definition: go func g GitArtifactReader readFromRepositoryr git.Repository, dir string No checks are...

GHSA-5Q86-62XR-3R57 Uses of deprecated API can be used to cause DoS in user-facing endpoints

Impact Several HandleRoute endpoints make use of the deprecated ioutil.ReadAll. ioutil.ReadAll reads all the data into memory. As such, an attacker who sends a large request to the Argo Events server will be able to crash it and cause denial of service. Eventsources susceptible to an out-of-memor...

Uses of deprecated API can be used to cause DoS in user-facing endpoints

Impact Several HandleRoute endpoints make use of the deprecated ioutil.ReadAll. ioutil.ReadAll reads all the data into memory. As such, an attacker who sends a large request to the Argo Events server will be able to crash it and cause denial of service. Eventsources susceptible to an out-of-memor...