MAL-2022-1717 Malicious code in buffer_replacer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ed7491fc6be30a2763f24ee0be15558529abebc9e31938df9ba36e5c9a4dfb59 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-23683: Improper Neutralization of Special Elements used in an OS Command

Authenticated command injection vulnerabilities exist in the AOS-CX Network Analytics Engine via NAE scripts. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system, leading to a complete...

MAL-2022-1027 Malicious code in anypoint-component-site (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7b60b65ec382d6f34f244239832ce506ad18482926adcaeb18716008141f115b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6901 Malicious code in ve-loaer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f591aa173fa95037c0279b301e3fe1d86b8db7b3165221944fb20fd10021e7ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5768 Malicious code in restli-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d04a6e9f6ff9f21ef9bd2bd2b06e04147ad6aaaed595fce58c6f3649f39693d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in josquin-ribbon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8e2f434f883d2a52b3a112a2c7727582a0ab8957b48c8226ab83c2b5940b69bd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5191 Malicious code in pagespeed-inslides (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ad7951a944d18efc9e4f2b2b9c2ec8eb79aa3728602ed1ef0049936b446fc8d5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-785 Malicious code in @xvideos/tests (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 39916423d097ff70776a72d4ec09cae71c30f9e91b3d3eeb5c29b59198b581a3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2117 Malicious code in comment-gagner-de-l-argent-sur-cashapp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c80ca905f9355f12bcb64f4c9be237e8be4b5dab5f923bfc3d052819cb3f1f40 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in opensea-erc1155 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 57ed9708d2415ab3223ea55143304ce5afb9087aba7a655afdc96d9ad56c5102 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-22536

SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the...

CVE-2021-33672: Improper Encoding or Escaping of Output

Due to missing encoding in SAP Contact Center's Communication Desktop component- version 700, an attacker could send malicious script in chat message. When the message is accepted by the chat recipient, the script gets executed in their scope. Due to the usage of ActiveX in the application, the...

ROS-2-904

2.904 Remote code execution in nginxCVE-2021-23017 1. Vulnerability Description: The vulnerability allows a remote attacker to execute arbitrary code on the target system. The vulnerability exists due to a single error in the ngxresolvercopyfunction when processing DNS responses. A remote attacke...

F5 BIG-IP Advanced WAF and ASM TMUI is vulnerable to unspecified vulnerabilities

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. An unspecified vulnerability exists in the F5 BIG-IP Advanced WAF and ASM TMUI, which, when cracked, allows an authenticated...

CVE-2021-24215: Improper Access Control

An Improper Access Control vulnerability was discovered in the Controlled Admin Access WordPress plugin before 1.5.2. Uncontrolled access to the website customization functionality and global CMS settings, like /wp-admin/customization.php and /wp-admin/options.php, can lead to a complete compromi...

CVE-2021-22994

CVE-2021-22994 is an XSS flaw in BIG-IP iControl REST that enables a reflected XSS leading to complete system compromise when the victim is an admin. Affected: BIG-IP versions and branches as per F5 advisories (K66851119 and related entries): 16.x vulnerable 16.0.0–16.0.1; fix in 16.1.0.1/16.1.0+...

PT-2021-15321

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 11.6.x before 11.6.5.3 F5 BIG-IP versions 12.1.x before 12.1.5.3 F5 BIG-IP versions 13.1.x before 13.1.3.6 F5 BIG-IP versions 14.1.x before 14.1.4 F5 BIG-IP versions 15.1.x before 15.1.2.1 F5 BIG-IP versions 16.0.x before...

Controlled Admin Access < 1.5.2 - Improper Access Control & Privilege Escalation

An Improper Access Control vulnerability was discovered in the plugin. Uncontrolled access to the website customization functionality and global CMS settings, like /wp-admin/customization.php and /wp-admin/options.php, can lead to a complete compromise of the target resource. Even with the maximu...

CVE-2021-21481: Incorrect Authorization

The MigrationService, which is part of SAP NetWeaver versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform an authorization check. This might allow an unauthorized attacker to access configuration objects, including such that grant administrative privileges. This could result in...

CVE-2021-22978: Improper Neutralization of Input During Web Page Generation

On BIG-IP version 16.0.x before 16.0.1, 15.1.x before 15.1.1, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all 12.1.x and 11.6.x versions, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of BIG-IP if the victim user is...