GitLab 11.0 < 14.9.5 / 14.10.0 < 14.10.4 / 15.0.0 < 15.0.1 (CVE-2022-1680)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An account takeover issue has been discovered in GitLab EE affecting all versions starting from 11.10 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0...

NAVER Whale browser 安全漏洞

Naver Whale Browser is a web browser from Naver, a South Korean company that supports user-defined interfaces. A security vulnerability exists in NAVER Whale browser versions prior to 1.10.6.2, which stems from a problem with the application browser locking feature. The vulnerability can be...

PT-2022-13973 · WordPress · Html2Wp

Name of the Vulnerable Software and Affected Versions: HTML2WP WordPress plugin versions prior to 1.1 Description: The issue concerns a lack of authorization and CSRF checks when importing files, along with a failure to validate these files. As a result, unauthenticated attackers can upload...

PT-2022-5982 · Atlassian +1 · Jira Service Management Server +2

Name of the Vulnerable Software and Affected Versions: Atlassian Jira Service Management Server and Data Center versions prior to 4.13.20 Atlassian Jira Service Management Server and Data Center versions 4.14.0 through 4.20.8 Atlassian Jira Service Management Server and Data Center versions 4.21....

Fedora: Security Advisory for ntfs-3g-system-compression (FEDORA-2022-1176b501f0)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

BigBlueButton 跨站脚本漏洞

BigBlueButton is BigBlueButton community of a set of open source Web conferencing system . A cross-site scripting vulnerability exists in BigBlueButton v2.4.7 and earlier versions, which stems from a lack of checksum filtering of user-supplied and output data in the chat feature. An attacker can...

CVE-2022-34170

In Jenkins 2.320 through 2.355 both inclusive and LTS 2.332.1 through LTS 2.332.3 both inclusive the help icon does not escape the feature name that is part of its tooltip, effectively undoing the fix for SECURITY-1955, resulting in a cross-site scripting XSS vulnerability exploitable by attacker...

GitLab: RCE via the DecompressedArchiveSizeValidator and Project BulkImports (behind feature flag)

Summary The DecompressedArchiveSizeValidator is used to check the size of a archive before extracting it: https://gitlab.com/gitlab-org/gitlab/-/blob/v15.1.0-ee/lib/gitlab/importexport/decompressedarchivesizevalidator.rbL82 ruby def command "gzip -dc @archivepath | wc -c" end def validate pgrp =...

Jenkins 跨站脚本漏洞

Jenkins is an application of the Jenkins open source. An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins suffers from a cross-site scripting vulnerability that stems from the fact that the help icon does not...

PT-2022-3090 · Motorola · Motorola Moscad Toolbox

Name of the Vulnerable Software and Affected Versions: Motorola MOSCAD Toolbox software through 2022-05-02 Description: The issue concerns the use of a cleartext password in the Motorola MOSCAD Toolbox software. This password is stored in the wmdlcdrv.ini driver configuration file and is used for...

Argo CD's external URLs for Deployments can include JavaScript

Impact All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to a cross-site scripting XSS bug allowing a malicious user to inject a javascript: link in the UI. When clicked by a victim user, the script will execute with the victim's permissions up to and including admin. The scri...

Security update for neomutt (moderate)

openSUSE Security Update: Security update for neomutt Announcement ID: openSUSE-SU-2022:10020-1 Rating: moderate References: 1184787 1185705 Cross-References: CVE-2021-32055 CVE-2022-1328 CVSS scores: CVE-2021-32055 NVD : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H CVE-2021-32055 SUSE: 5.3...

Security feature bypass

Impact A plugin public script can be used to read content of system files. Patches Upgrade to version 1.0.2. Workarounds b/deploy/index.php file can be deleted if deploy feature is not used...

Malicious code in audi-feature-services (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4378ace95d0131430a8ec44844043a44b083551ac436b7ddf03f1444b66b01b9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1169 Malicious code in audi-feature-services (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4378ace95d0131430a8ec44844043a44b083551ac436b7ddf03f1444b66b01b9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dv360_feature_adoption (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 84c4649924703e670255c00d1faae942b08b065170965b3ffe912e9361461874 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-91 Malicious code in @audi-cct/teaser-feature-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c4bf5b9b172fa13a666e247c29ea5993af008cf7b6371aa719add1ac288724f8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-381 Malicious code in @kindred-feature/deposit-limits (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware acf347d02beec3a3d13a86271815398239c952e9304c9a1caa86b9c53fac99e6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in feature-gating (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ecd1f203c30f69f6538359567ef1068a58a68bfd4864cc767ea3398a75445955 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2995 Malicious code in feature-gating (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ecd1f203c30f69f6538359567ef1068a58a68bfd4864cc767ea3398a75445955 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...