MAL-2022-2230 Malicious code in create-ot-express-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 269d815f0f72dcbee5d8320d8fdc6dfb67256e41db6c462544a0fb234cfbf97c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in create-ot-express-app

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in create-ot-express-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 269d815f0f72dcbee5d8320d8fdc6dfb67256e41db6c462544a0fb234cfbf97c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2022-5112 · Assimp +2 · Assimp +2

Name of the Vulnerable Software and Affected Versions: Open Asset Import Library Assimp versions prior to the version containing the fix for the segmentation violation in Assimp::XFileImporter::CreateMeshes Description: The issue is related to a segmentation violation in the...

Garage Management System 1.0 Shell Upload Exploit

Exploit Title: Garage Management System Remote Code Execution via File Upload Exploit Author: saitamang Vendor Homepage: https://www.sourcecodester.com Software Link: https://www.sourcecodester.com/sites/default/files/download/mayurik/garage.zip Version: 1.0 Tested on: Centos 7 + MySQL import...

CVE-2022-35899

There is an unquoted service path in ASUSTeK Aura Ready Game SDK service GameSDK.exe 1.0.0.4. This might allow a local user to escalate privileges by creating a %PROGRAMFILESX86%\ASUS\GameSDK.exe file...

CVE-2022-21565

Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 19c and 21c. Easily exploitable vulnerability allows low privileged attacker having Create Procedure privilege with network access via Oracle Net to compromise Java VM. Successful...

Apache Hive Authorization Issues Vulnerability

Apache Hive is a set of data warehouse software based on Hadoop Distributed Systems Infrastructure from the Apache Apache Foundation in the United States. The software provides a data integration approach and a high-level query language to support large-scale data analysis on Hadoop. An...

CVE-2022-21565: Undefined Security Weakness

Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 19c and 21c. Easily exploitable vulnerability allows low privileged attacker having Create Procedure privilege with network access via Oracle Net to compromise Java VM. Successful...

PT-2022-3773

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 12.1.0.2, 19c, and 21c Description The issue is related to insufficient protection of internal data in the Java VM component. It allows a low-privileged attacker with Create Procedure privilege and network acces...

Authorization Bypass

Apache Hive is vulnerable to authorization bypass. The vulnerability exists in the CREATE/DROP operations due to improper restrictions of users privileges which allows an attacker to create and drop UDFs...

CVE-2022-26481

An issue was discovered in Poly Studio before 3.7.0. Command Injection can occur via the CN field of a Create Certificate Signing Request CSR action...

Command injection

An issue was discovered in Poly Studio before 3.7.0. Command Injection can occur via the CN field of a Create Certificate Signing Request CSR action...

CVE-2022-26481

An issue was discovered in Poly Studio before 3.7.0. Command Injection can occur via the CN field of a Create Certificate Signing Request CSR action...

CVE-2022-26481

Poly Studio X30, X50, X70, and G7500 are affected by an authenticated command-injection vulnerability (CVE-2022-26481) in the CSR action CN field. Vulnerable versions include 3.4.0-292042, 3.5.0-344025, and 3.6.0; remediation is to upgrade to 3.7.0 or higher. The issue, described consistently acr...

GHSA-V3P8-J597-3XG8 Apache Hive before 3.1.3 `CREATE` and `DROP` function operations do not check for necessary authorization.

Apache Hive before 3.1.3 CREATE and DROP function operations do not check for necessary authorization of involved entities in the query. It was found that an unauthorized user can manipulate an existing UDF without having the privileges to do so. This allowed unauthorized or underprivileged users...

CVE-2022-26481: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered in Poly Studio before 3.7.0. Command Injection can occur via the CN field of a Create Certificate Signing Request CSR action...

CVE-2021-34538

Apache Hive before 3.1.3 "CREATE" and "DROP" function operations does not check for necessary authorization of involved entities in the query. It was found that an unauthorized user can manipulate an existing UDF without having the privileges to do so. This allowed unauthorized or underprivileged...

CVE-2021-34538

Apache Hive before 3.1.3 "CREATE" and "DROP" function operations does not check for necessary authorization of involved entities in the query. It was found that an unauthorized user can manipulate an existing UDF without having the privileges to do so. This allowed unauthorized or underprivileged...

Authorization

Apache Hive before 3.1.3 "CREATE" and "DROP" function operations does not check for necessary authorization of involved entities in the query. It was found that an unauthorized user can manipulate an existing UDF without having the privileges to do so. This allowed unauthorized or underprivileged...