Malicious code in helix-slack-notification (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9520877ee689f4ae7ba25d861168d154264a54e831d5496ceb94a7e46fa8a365 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in minis-samples (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c077b52bdf5ba9829bbb40e34b43aca9f4191c5c87ac682e35e3d0f758763777 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in atomic-angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a312917055a535347fc34c0b8dd11c2a947d7fa9fbfd5972cdfe7fac5d4f981d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-33175

Power Distribution Units (Powertek firmware) prior to 3.30.30 are affected. The vulnerability arises from an insecure permissions setting on the user.token field, exposed via the /cgi/get_param.cgi HTTP API, allowing disclosure of active administrator session IDs. This can enable session hijackin...

Malicious code in @spinak/iac-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 77099501462f80e29fcba9337b4c51a78859cfed8347211f50acbafee737a3ba Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @manomano-toolbox/pim-management (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd08f90f97f53d7b76dad3a2a10ed8031f6af87a735ea7bfeb12bc0290aefb4c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tangerine-state-viewer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 83cabb2630e510d0c9b63f6c164c5825dd5325a370fd8db846ead2bb3ed782a5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Qualcomm 芯片输入验证错误漏洞

A Qualcomm chip is a chip from Qualcomm Incorporated USA. A way to miniaturize circuits including primarily semiconductor devices, but also passive components, etc. and is manufactured from time to time on the surface of semiconductor wafers. An input validation error vulnerability exists in...

Malicious code in @chegg-me-components/header (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e2243153078c6242a8399b5c02c6012c19cdec162fba625367192ec6b96affcd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @superbet-group/testsandbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b3c841d01eabde154bcbc04ef8e906e2a21f4ca241cae38408ca9748e5087c01 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in gc-gsl-editor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7a4adc0fa0f46c847c26f536f6d3390e092f77b6f9a533eaab32b95b5cf83499 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pocjenkircetest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ebbf04e7a39de82685b8e0cb1fc6ad03deb085f0db3630624a3b736b99d0a7f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ai-indeed (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 15ae7d511b6926fb2b31abe9284b914484571b399fbd92e14e1f8762d8c033aa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in zuanshi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b63254b223cbeaba40946dd0cc604245529ff5b147026f6c49ec973877507c33 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Design/Logic Flaw

In the KeepKey firmware before 7.3.2,Flaws in the supervisor interface can be exploited to bypass important security restrictions on firmware operations. Using these flaws, malicious firmware code can elevate privileges, permanently make the device inoperable or overwrite the trusted bootloader...

Cross-site Scripting (XSS) - Stored

Description Stored XSS via upload attachment with format .xml in File Library. Detail When opening the attachment, some format files will be rendered and loaded on the browser. So it allows executing arbitrary javascript code that was injected into attachment before. Proof of Concept PoC.xml...

CVE-2022-22162

CVE-2022-22162 affects Juniper Networks Junos OS. The issue is a Information Disclosure/Privilege Elevation vulnerability in the CLI where a locally authenticated, low-privilege user can elevate privileges to the highest J-Web user, potentially leading to full device compromise. Affected {Juniper...

Cross-site Scripting (XSS) - Stored in convos-chat/convos

Description Stored XSS via upload File with format .svg when chatting in private conversation. Detail When opening the attachment, some format files will be rendered and loaded on the browser. So it allows executing arbitrary javascript code that was injected into attachment before. Proof of...

Session fixation

Apostrophe CMS versions prior to 3.3.1 did not invalidate existing login sessions when disabling a user account or changing the password, creating a situation in which a device compromised by a third party could not be locked out by those means. As a mitigation for older releases the user account...

Multiple Flaws Affecting Realtek Wi-Fi SDKs Impact Nearly a Million IoT Devices

Taiwanese chip designer Realtek is warning of four security vulnerabilities in three software development kits SDKs accompanying its WiFi modules, which are used in almost 200 IoT devices made by at least 65 vendors. The flaws, which affect Realtek SDK v2.x, Realtek "Jungle" SDK...