Authentication flaw

Vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unauthenticated remote attacker to bypass authentication. Successful exploitation of these vulnerabilities could allow an attacker to gain administrative privileges leading to a...

CVE-2022-37914

Vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unauthenticated remote attacker to bypass authentication. Successful exploitation of these vulnerabilities could allow an attacker to gain administrative privileges leading to a...

Malicious code in luapkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f1056631ef80f2163474304f3663a356bf91439fddc4227ea8e95cfbbdefce50 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1717 Malicious code in buffer_replacer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ed7491fc6be30a2763f24ee0be15558529abebc9e31938df9ba36e5c9a4dfb59 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1027 Malicious code in anypoint-component-site (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7b60b65ec382d6f34f244239832ce506ad18482926adcaeb18716008141f115b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6901 Malicious code in ve-loaer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f591aa173fa95037c0279b301e3fe1d86b8db7b3165221944fb20fd10021e7ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5768 Malicious code in restli-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d04a6e9f6ff9f21ef9bd2bd2b06e04147ad6aaaed595fce58c6f3649f39693d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in josquin-ribbon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8e2f434f883d2a52b3a112a2c7727582a0ab8957b48c8226ab83c2b5940b69bd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5191 Malicious code in pagespeed-inslides (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ad7951a944d18efc9e4f2b2b9c2ec8eb79aa3728602ed1ef0049936b446fc8d5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-785 Malicious code in @xvideos/tests (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 39916423d097ff70776a72d4ec09cae71c30f9e91b3d3eeb5c29b59198b581a3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2117 Malicious code in comment-gagner-de-l-argent-sur-cashapp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c80ca905f9355f12bcb64f4c9be237e8be4b5dab5f923bfc3d052819cb3f1f40 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in opensea-erc1155 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 57ed9708d2415ab3223ea55143304ce5afb9087aba7a655afdc96d9ad56c5102 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-22536

SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the...

ROS-2-904

2.904 Remote code execution in nginxCVE-2021-23017 1. Vulnerability Description: The vulnerability allows a remote attacker to execute arbitrary code on the target system. The vulnerability exists due to a single error in the ngxresolvercopyfunction when processing DNS responses. A remote attacke...

F5 BIG-IP Advanced WAF and ASM TMUI is vulnerable to unspecified vulnerabilities

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. An unspecified vulnerability exists in the F5 BIG-IP Advanced WAF and ASM TMUI, which, when cracked, allows an authenticated...

CVE-2021-22994

CVE-2021-22994 is an XSS flaw in BIG-IP iControl REST that enables a reflected XSS leading to complete system compromise when the victim is an admin. Affected: BIG-IP versions and branches as per F5 advisories (K66851119 and related entries): 16.x vulnerable 16.0.0–16.0.1; fix in 16.1.0.1/16.1.0+...

Controlled Admin Access < 1.5.2 - Improper Access Control & Privilege Escalation

An Improper Access Control vulnerability was discovered in the plugin. Uncontrolled access to the website customization functionality and global CMS settings, like /wp-admin/customization.php and /wp-admin/options.php, can lead to a complete compromise of the target resource. Even with the maximu...

CVE-2020-24639

There is a vulnerability caused by unsafe Java deserialization that allows for arbitrary command execution in a containerized environment within Airwave Glass before 1.3.3. Successful exploitation can lead to complete compromise of the underlying host operating system...

CVE-2020-24034

Sagemcom F@ST 5280 routers using firmware version 1.150.61 have insecure deserialization that allows any authenticated user to perform a privilege escalation to any other user. By making a request with valid sessid, nonce, and ha1 values inside of the serialized session cookie, an attacker may...

CVE-2019-12147

The Sangoma Session Border Controller SBC 2.3.23-119 GA web interface is vulnerable to Argument Injection via special characters in the username field. Upon successful exploitation, a remote unauthenticated user can create a local system user with sudo privileges, and use that user to login to th...