Malicious code in pocjenkircetest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ebbf04e7a39de82685b8e0cb1fc6ad03deb085f0db3630624a3b736b99d0a7f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ai-indeed (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 15ae7d511b6926fb2b31abe9284b914484571b399fbd92e14e1f8762d8c033aa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in zuanshi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b63254b223cbeaba40946dd0cc604245529ff5b147026f6c49ec973877507c33 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Design/Logic Flaw

In the KeepKey firmware before 7.3.2,Flaws in the supervisor interface can be exploited to bypass important security restrictions on firmware operations. Using these flaws, malicious firmware code can elevate privileges, permanently make the device inoperable or overwrite the trusted bootloader...

Cross-site Scripting (XSS) - Stored

Description Stored XSS via upload attachment with format .xml in File Library. Detail When opening the attachment, some format files will be rendered and loaded on the browser. So it allows executing arbitrary javascript code that was injected into attachment before. Proof of Concept PoC.xml...

CVE-2022-22162

CVE-2022-22162 affects Juniper Networks Junos OS. The issue is a Information Disclosure/Privilege Elevation vulnerability in the CLI where a locally authenticated, low-privilege user can elevate privileges to the highest J-Web user, potentially leading to full device compromise. Affected {Juniper...

Cross-site Scripting (XSS) - Stored in convos-chat/convos

Description Stored XSS via upload File with format .svg when chatting in private conversation. Detail When opening the attachment, some format files will be rendered and loaded on the browser. So it allows executing arbitrary javascript code that was injected into attachment before. Proof of...

Session fixation

Apostrophe CMS versions prior to 3.3.1 did not invalidate existing login sessions when disabling a user account or changing the password, creating a situation in which a device compromised by a third party could not be locked out by those means. As a mitigation for older releases the user account...

Multiple Flaws Affecting Realtek Wi-Fi SDKs Impact Nearly a Million IoT Devices

Taiwanese chip designer Realtek is warning of four security vulnerabilities in three software development kits SDKs accompanying its WiFi modules, which are used in almost 200 IoT devices made by at least 65 vendors. The flaws, which affect Realtek SDK v2.x, Realtek "Jungle" SDK...

CVE-2021-22739

Information Exposure vulnerability exists in homeLYnk Wiser For KNX and spaceLYnk V2.60 and prior which could cause a device to be compromised when it is first configured...

Information disclosure

Information Exposure vulnerability exists in homeLYnk Wiser For KNX and spaceLYnk V2.60 and prior which could cause a device to be compromised when it is first configured...

CVE-2021-22739

Information Exposure vulnerability exists in homeLYnk Wiser For KNX and spaceLYnk V2.60 and prior which could cause a device to be compromised when it is first configured...

CVE-2021-22739

The vulnerability (CVE-2021-22739) affects Schneider Electric homeLYnk and spaceLYnk, versions up to 2.60, with an Information Exposure flaw that could compromise a device during initial configuration. The Red Hat and CNVD entries corroborate an information-disclosure issue for these products. Th...

The vulnerability of the EasyBuilder engineering software lies in the fact that protected information is stored in an unencrypted form, allowing a perpetrator to gain access to the device.

The vulnerability of the EasyBuilder engineering software lies in the storage of sensitive information in an unencrypted form. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to the device...

Amnesia:33 — Critical TCP/IP Flaws Affect Millions of IoT Devices

Cybersecurity researchers disclosed a dozen new flaws in multiple widely-used embedded TCP/IP stacks impacting millions of devices ranging from networking equipment and medical devices to industrial control systems that could be exploited by an attacker to take control of a vulnerable system...

Remote Code Execution Vulnerability in Lilin NVR104 NTP Component

NVR104 is a stand-alone NVR recorder from LILING that supports up to 4 IP network cameras. A remote code execution vulnerability exists in the Lilin NVR104. An attacker can exploit the vulnerability to gain control of the NVR device...

CVE-2020-3365

A vulnerability in the directory permissions of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to perform a directory traversal attack on a limited set of restricted directories. The vulnerability is due to a flaw in the logic that governs directo...

CVE-2020-9526

CS2 Network P2P through 3.x, as used in millions of Internet of Things devices, suffers from an information exposure flaw that exposes user session data to supernodes in the network, as demonstrated by passively eavesdropping on user video/audio streams, capturing credentials, and compromising...

CVE-2020-9526

CS2 Network P2P through 3.x, as used in millions of Internet of Things devices, suffers from an information exposure flaw that exposes user session data to supernodes in the network, as demonstrated by passively eavesdropping on user video/audio streams, capturing credentials, and compromising...

Design/Logic Flaw

CS2 Network P2P through 3.x, as used in millions of Internet of Things devices, suffers from an information exposure flaw that exposes user session data to supernodes in the network, as demonstrated by passively eavesdropping on user video/audio streams, capturing credentials, and compromising...