MAL-2022-6911 Malicious code in vgs-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ea7450a9256eaa2a5b3697fa941aac508944ea795e005119495b21835bbe195a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in buffer-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 68d24447a013a577c7a828dad7c39ee67ab30aefee217cc3cd9ec44d6de78b3c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1713 Malicious code in buffer-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 68d24447a013a577c7a828dad7c39ee67ab30aefee217cc3cd9ec44d6de78b3c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in buffer-auth-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4f75e8e48062b53ad973d8acf955f83684b9339889580c0c48a5324c77471d2f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1714 Malicious code in buffer-auth-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4f75e8e48062b53ad973d8acf955f83684b9339889580c0c48a5324c77471d2f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in core-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6bdfd71008501f118552100797abf6fb298f1db14a272dda22ede246874ef20c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2190 Malicious code in core-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6bdfd71008501f118552100797abf6fb298f1db14a272dda22ede246874ef20c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6954 Malicious code in voicemail-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49069432ab7ae202e87a0c30a1b09b23452139760e09eb5abf07f85392d2fbb4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Authentication Bypass

parse-server is vulnerable to authentication bypass. The vulnerability exists because the certificate in auth adapter is not properly validated. An attacker is able to bypass authentication checks by making a fake certificate accessible via certain Apple domains and providing the URL to that...

files (>=1.0.0, <=2.2.3), portal (>=2.0.0, <=3.0.1) potentially affected by CVE-2022-31053 via biscuit-auth (1.2.0)

biscuit-auth CARGO version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on biscuit-auth and may be impacted: - files =1.0.0, =2.0.0, =3.0.1 Source cves: CVE-2022-31053 Source advisory: OSV:GHSA-75RW-34Q6-72CR...

CVE-2022-20176

In authstore of sjtag-driver.c, there is a possible read of uninitialized memory due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid...

Out-of-bounds

In authstore of sjtag-driver.c, there is a possible read of uninitialized memory due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid...

PT-2022-14405 · Google · Android Kernel

Name of the Vulnerable Software and Affected Versions: Android kernel versions affected versions not specified Description: In the auth store of sjtag-driver.c, there is a possible read of uninitialized memory due to a missing bounds check. This could lead to local information disclosure with...

CVE-2021-44266

GUnet Open eClass aka openeclass before 3.12.2 allows XSS via the modules/auth/formuser.php auth parameter...

CVE-2021-44266

GUnet Open eClass aka openeclass before 3.12.2 allows XSS via the modules/auth/formuser.php auth parameter...

Exploit for Expression Language Injection in Atlassian Confluence_Data_Center

ConfluentPwn Confluence pre-auth ONGL injection remote code ex...

CLSA-2022-1654525948 Fixed CVEs in python2-pip-18.module_el8.4.0+2051+0b56c8de: CVE-2021-3733, CVE-2021-3737, CVE-2022-0391, CVE-2021-4189

CVE-2021-3733: urllib: Regular expression DoS in AbstractBasicAuthHandler rhbz2047376 - CVE-2021-3737: urllib: HTTP client possible infinite loop on a 100 Continue response rhbz2047376 - CVE-2021-4189: ftplib should not use the host from the PASV response rhbz2047376 - CVE-2022-0391: urllib.parse...

GHSA-342C-VCFF-2FF2 Login timing attack in ezsystems/ezplatform-kernel

Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be good enough in some situations. The fix replace...

CVE-2022-30352

phpABook 0.9i is vulnerable to SQL Injection due to insufficient sanitization of user-supplied data in the "authuser" parameter in index.php script...

CVE-2021-27780

CVE-2021-27780 affects HCL Technologies BigFix Mobile/Modern Client Management (versions v1.x, v2.0). The root cause is improper handling of XML interfaces in unauthenticated contexts, enabling Un-Auth XML interaction and unauthenticated device enrollment. Impact described in sources includes una...