Apache Superset vulnerable to Cross-site Scripting

Dashboard rendering does not sufficiently sanitize the content of markdown components leading to possible XSS attack vectors that can be performed by authenticated users with create dashboard permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0...

Beware: Tainted VPNs Being Used to Spread EyeSpy Surveillanceware

Tainted VPN installers are being used to deliver a piece of surveillanceware dubbed EyeSpy as part of a malware campaign that started in May 2022. It uses "components of SecondEye – a legitimate monitoring application – to spy on users of 20Speed VPN, an Iranian-based VPN service, via trojanized...

CVE-2022-42277

NVIDIA DGX Station contains a vulnerability in SBIOS in the SmiFlash, where a local user with elevated privileges can read, write and erase flash, which may lead to code execution, escalation of privileges, denial of service, and information disclosure. The scope of impact can extend to other...

CVE-2022-42277

NVIDIA DGX Station contains a vulnerability in SBIOS in the SmiFlash, where a local user with elevated privileges can read, write and erase flash, which may lead to code execution, escalation of privileges, denial of service, and information disclosure. The scope of impact can extend to other...

CVE-2022-42276

NVIDIA DGX A100 contains a vulnerability in SBIOS in the SmiFlash, where a local user with elevated privileges can read, write and erase flash, which may lead to code execution, escalation of privileges, denial of service, and information disclosure. The scope of impact can extend to other...

Malicious code in cu-dashboard-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 05a7db61863c75c4e403ac8634e0889a3980b57447fb6c65a10f21724a064fe1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-219 Malicious code in cu-dashboard-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 05a7db61863c75c4e403ac8634e0889a3980b57447fb6c65a10f21724a064fe1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in shared-gatsby-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fa6f8aa17394b241ea554a9745b4c06f2e6a9c3e00a5c14094b7bf4ec1b8de12 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-472 Malicious code in generic-ui-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a7f87fcdafcf972ad5460dfd5d8fca046c5d3c1545f8725f7dc18174de69c362 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-773 Malicious code in shared-gatsby-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fa6f8aa17394b241ea554a9745b4c06f2e6a9c3e00a5c14094b7bf4ec1b8de12 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Microsoft Windows Print Spooler Components 安全漏洞

Microsoft Windows Print Spooler Components is a printing background processor component from Microsoft Corporation USA. A security vulnerability exists in Microsoft Windows Print Spooler Components. An attacker could exploit the vulnerability to elevate privileges...

Microsoft Windows Print Spooler Components 安全漏洞

Microsoft Windows Print Spooler Components is a printing background processor component from Microsoft Corporation USA. A security vulnerability exists in Microsoft Windows Print Spooler Components. An attacker could exploit the vulnerability to elevate privileges...

AMD Server Vulnerabilities – January 2023

Bulletin ID: AMD-SB-1032 Potential Impact: Varies by CVE, see descriptions below Severity: Varies by CVE, see descriptions below Summary During security reviews in collaboration with Google, Microsoft, and Oracle, potential vulnerabilities in the AMD Secure Processor ASP, AMD System Management Un...

CVE-2022-45935

Usage of temporary files with insecure permissions by the Apache James server allows an attacker with local access to access private user data in transit. Vulnerable components includes the SMTP stack and IMAP APPEND command. This issue affects Apache James server version 3.7.2 and prior versions...

Security Bulletin: A vulnerability exists in the IBM® SDK Java™ Technology Edition affecting IBM Tivoli Network Manager (CVE-2021-35561).

Summary A vulnerability exists in IBM® SDK Java™ Technology Edition, Version 8, which is used by IBM Tivoli Network Manager IP Edition v4.2, which was disclosed in the Oracle October 2021 Critical Patch Update, but deferred until the release associated with the August 2022 Update. Vulnerability...

Security Bulletin: IBM DataPower Gateway affected by vulnerability in Java (CVE-2022-21626)

Summary IBM has addressed the CVE, which potentially affects JDBC, IMS Callout and JMS components Vulnerability Details CVEID:CVE-2022-21626 DESCRIPTION: An unspecified vulnerability in Java SE related to the Security component could allow an unauthenticated attacker to cause a denial of service...

Vulnerabilities fixed in Google Android and Samsung Mobile

Google has fixed vulnerabilities in Android. Also fixed vulnerabilities in closed-source parts of Android that are developed by third parties, such as Qualcomm, Unisoc, Imagination Technologies and Mediatek. The vulnerabilities allow a malicious party potentially able to launch attacks that lead ...

Input validation

NVIDIA Trusted OS contains a vulnerability in an SMC call handler, where failure to validate untrusted input may allow a highly privileged local attacker to cause information disclosure and compromise integrity. The scope of the impact can extend to other components...

PT-2022-27671 · Unknown · Planet Estream

Name of the Vulnerable Software and Affected Versions: Planet eStream versions prior to 6.72.10.07 Description: The issue involves multiple Stored Cross-Site Scripting XSS vulnerabilities in various components, including Disclaimer, Search Function, Comments, Batch editing tool, Content Creation,...

Tenable Nessus Network Monitor 5.11.0 - 6.1.1 Multiple Vulnerabilities (TNS-2022-28)

Tenable Nessus Network Monitor is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...