CVE-2022-23624: Improper Input Validation

Frourio-express is a minimal full stack framework, for TypeScript. Frourio-express users who uses frourio-express version prior to v0.26.0 and integration with class-validator through validators/ folder are subject to a input validation vulnerability. Validators do not work properly for request...

express-check-introspection-key (1.0.0), leapfin-exercise (>=1.0.0, <=1.1.1) +1 more potentially affected by CVE-2022-25872 via fast-string-search (1.4.4)

fast-string-search NPM version 1.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on fast-string-search and may be impacted: - express-check-introspection-key 1.0.0 - leapfin-exercise =1.0.0, =0.0.1, =0.0.2-beta.0 Source cves: CVE-2022-25872 Source...

express-check-introspection-key (1.0.0), leapfin-exercise (>=1.0.0, <=1.1.1) +1 more potentially affected by CVE-2022-22138 via fast-string-search (1.4.4)

fast-string-search NPM version 1.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on fast-string-search and may be impacted: - express-check-introspection-key 1.0.0 - leapfin-exercise =1.0.0, =0.0.1, =0.0.2-beta.0 Source cves: CVE-2022-22138 Source...

Oracle Database Server (Jan 2022 CPU)

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2022 CPU advisory. - Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 19c and 21c...

Vulnerabilities fixed in Oracle Database Server

Oracle has fixed vulnerabilities in the following Oracle Database Server products: Database - Enterprise Edition Database Configuration Assistant Spatial and Graph Application Express APEX Engineered Systems Utilities The vulnerabilities allow a malicious person to carry out attacks execute attac...

CVE-2021-30298

Possible out of bound access due to improper validation of item size and DIAG memory pools data while switching between USB and PCIE interface in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wire...

CVE-2021-3929

A DMA reentrancy issue was found in the NVM Express Controller NVME emulation in QEMU. This CVE is similar to CVE-2021-3750 and, just like it, when the reentrancy write triggers the reset function nvmectrlreset, data structs will be freed leading to a use-after-free issue. A malicious guest could...

UBUNTU-CVE-2021-3929

A DMA reentrancy issue was found in the NVM Express Controller NVME emulation in QEMU. This CVE is similar to CVE-2021-3750 and, just like it, when the reentrancy write triggers the reset function nvmectrlreset, data structs will be freed leading to a use-after-free issue. A malicious guest could...

PT-2021-22508 · Qemu +6 · Qemu +6

Name of the Vulnerable Software and Affected Versions: QEMU affected versions not specified Description: A DMA reentrancy issue was found in the NVM Express Controller NVME emulation. This issue can lead to a use-after-free problem when a malicious guest triggers the reset function nvme ctrl rese...

CVE-2021-3929

A DMA reentrancy issue was found in the NVM Express Controller NVME emulation in QEMU. This CVE is similar to CVE-2021-3750 and, just like it, when the reentrancy write triggers the reset function nvmectrlreset, data structs will be freed leading to a use-after-free issue. A malicious guest could...

‘DarkWatchman’ RAT Shows Evolution in Fileless Malware

A novel remote access trojan RAT being distributed via a Russian-language spear-phishing campaign is using unique manipulation of Windows Registry to evade most security detections, demonstrating a significant evolution in fileless malware techniques. Dubbed DarkWatchman, the RAT – discovered by...

QEMU 资源管理错误漏洞

QEMU is a suite of analog processor software from the French individual developer Fabrice Bellard. The software is fast and cross-platform. A security vulnerability exists in the NVM Express Controller NVME emulation in QEMU that stems from a data structure being released when a reentrant write...

The vulnerability of the GRE function (EoGRE) in the Cisco IOS XE operating system, which allows a hacker to trigger a service failure.

The vulnerability of the GRE function EoGRE in the Cisco IOS XE operating system is related to errors in processing distorted EoGRE packets. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

MongoDB mongo-express Remote Code Execution Vulnerability

mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the toBSON method...

CVE-2021-43802

Etherpad is a real-time collaborative editor. In versions prior to 1.8.16, an attacker can craft an .etherpad file that, when imported, might allow the attacker to gain admin privileges for the Etherpad instance. This, in turn, can be used to install a malicious Etherpad plugin that can execute...

CVE-2021-43802 Admin privilege escalation and arbitrary code execution via malicious *.etherpad imports

Etherpad is a real-time collaborative editor. In versions prior to 1.8.16, an attacker can craft an .etherpad file that, when imported, might allow the attacker to gain admin privileges for the Etherpad instance. This, in turn, can be used to install a malicious Etherpad plugin that can execute...

CVE-2021-43802

Etherpad is a real-time collaborative editor. In versions prior to 1.8.16, an attacker can craft an ".etherpad" file that, when imported, might allow the attacker to gain admin privileges for the Etherpad instance. This, in turn, can be used to install a malicious Etherpad plugin that can execute...

CVE-2021-43802

CVE-2021-43802 affects Etherpad Lite versions before 1.8.16. An attacker can import a crafted .etherpad file to gain admin privileges, enabling installation of a malicious plugin that can execute arbitrary code. Privilege gain relies on triggering or waiting for old express-session state to be de...

GHSA-V39H-QM32-8GWQ Improperly Controlled Modification of Dynamically-Determined Object Attributes in express-mock-middleware

express-mock-middleware through 0.0.6 is vulnerable to Prototype Pollution. Exported functions by the package can be tricked into adding or modifying properties of the Object.prototype. Exploitation of this vulnerability requires creation of a new directory where an attack code can be placed whic...

Session fixation in express-openid-connect

Overview Versions 2.3.0 up to and including 2.5.1 do not regenerate the session id and session cookie when user logs in. This behavior opens up the application to various session fixation vulnerabilities. Am I affected? You are affected by this vulnerability if you are using express-openid-connec...