Design/Logic Flaw

This vulnerability allows an authenticated attacker to upload malicious files by bypassing the restrictions of the upload functionality, compromising the entire device...

CVE-2023-4817

CVE-2023-4817 relates to an unrestricted file upload vulnerability in the ICP DAS ET-7060 data collector. The issue allows an authenticated attacker to bypass upload restrictions and place malicious files on the device, potentially compromising the entire unit. The vulnerability is described cons...

PT-2023-30714 · Icpdas · Et-7060 +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: This issue allows an authenticated attacker to upload malicious files by bypassing the restrictions of the upload functionality, compromising the entire...

Cisco IOS Buffer Error Vulnerability

Cisco IOS is a suite of operating systems developed by Cisco for its network devices. A security vulnerability exists in the Cisco IOS software and Cisco IOS XE, which stems from a vulnerability in the Cisco Group Encrypted Transport VPN GET VPN feature that could allow an authenticated, remote...

Malicious code in gradient-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7856f4d5db8c9074c3633d2d5a61782c18536a58a84cb8ad56ae029525880875 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fca-get (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 19e0a51fdb1bf06bf1cf80981823698ed77398aeef31127fbab3fcfb0a3f2e01 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in chat-api-asuna (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 85f583cda7182f56d351d1ce81779546a87791f7686b5acf9ae3d1e80250e9a4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-4291

Frauscher Sensortechnik GmbH FDS101 for FAdC/FAdCi v1.4.24 and all previous versions are vulnerable to a remote code execution RCE vulnerability via manipulated parameters of the web interface without authentication. This could lead to a full compromise of the FDS101 device...

Duplicate Advisory: EVE Doesn't Measure Config Partition From 2 Fronts

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-phcg-h58r-gmcq. This link is maintained to preserve external references. Original Description PCR14 is not in the list of PCRs that seal/unseal the “vault” key, but due to the change that was implemented in comm...

CVE-2023-43630 Config Partition Not Measured From 2 Fronts

PCR14 is not in the list of PCRs that seal/unseal the “vault” key, but due to the change that was implemented in commit “7638364bc0acf8b5c481b5ce5fea11ad44ad7fd4”, fixing this issue alone would not solve the problem of the config partition not being measured correctly. Also, the “vault” key is...

Malicious code in symphony-monorepo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1360bb9cfdd8afaf47d9444561048cc1f780fc6dd830a6d709320dc260bf7476 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in team-atf-3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3dbd02e3dfb7a6582ce683aed8cb3cf5be7a1a449fe0ac5ce208d87034938dbc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in smeeh-administration (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9498162a94b3baa19086d8a3b158e7b37ed534cca2d6bc1a6e04f2749d18f28d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability of microprogrammed software in web panels for controlling and monitoring processes in industrial systems, PHOENIX CONTACTs WP 6xxx, allows a perpetrator to gain full access to the device.

The vulnerability of microprogrammed software in web panels for controlling and monitoring processes in industrial systems like PHOENIX CONTACT WP 6xxx exists due to the lack of measures to neutralize special elements. Exploiting this vulnerability can allow a malicious actor, operating remotely,...

Malicious code in react-navigation-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2ac24ada2566f97d5be199f6ef9006e9556055d6747f993a8b1ae0dfb8b66a9f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in react-navigation-area-view (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc67ff72904c84b476e3f102ad2d7c61225b500ed7e1dc8852166e2c1b88c694 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

U.S. Dept Of Defense: [██████] Reflected XSS via Keycloak on ██████

A cross-site scripting XSS vulnerability was discovered in Keycloak 8.0 and earlier versions. This vulnerability allowed an attacker to execute arbitrary script and potentially steal authentication credentials. The vulnerability was due to a lack of input validation, which allowed an attacker to...

Malicious code in gcore-cdn-stats (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 12e65a6a05a2aec76e30706343ceed5456d0707acebe0e598c17a5215e710c9d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in essc-crypto (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a7f5725deb0ef671b11a7413a83f0cfe3a7957ae7ec5a6c7f317ab7fc8b84806 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in my-fallen-fallen-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f31e79019d42645171a0a0457db1d85815664700b6a48f72e42d4ca92025f5da Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...