MAL-2022-156 Malicious code in @btu-tools/mfe-feature-toggles (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e1c049f661074e61263051b6fa7e69a238c8ec979f8c180855cadc60ac3f59dc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @btu-tools/mfe-feature-toggles (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e1c049f661074e61263051b6fa7e69a238c8ec979f8c180855cadc60ac3f59dc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4297 Malicious code in lib-feature-flags-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e24cd9baab2f8a1b9e12ede025f1bf40f5cea61abaeb14c138b5aab1b0df3374 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in lib-feature-flags-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e24cd9baab2f8a1b9e12ede025f1bf40f5cea61abaeb14c138b5aab1b0df3374 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE-SU-2022:2140-1 Security update for node_exporter

This security update for golang-github-prometheus-nodeexporter provides: Update golang-github-prometheus-nodeexporter from version 1.1.2 to version 1.3.0 bsc1196338, jscSLE-24238, jscSLE-24239 - CVE-2022-21698: Denial of service using InstrumentHandlerCounter - Update vendor tarball with...

NocoDB Cross-Site Scripting Vulnerability

NocoDB is an open source Airtable replacement. Convert any MySql, PostgreSql, Sql Server, Sqlite, and MariaDb into a smart spreadsheet.A cross-site scripting vulnerability exists in versions of NocoDB prior to 0.91.7, which stems from a lack of data validation filtering of user-supplied data and...

InvenTree 资源管理错误漏洞

InvenTree is an open source inventory management system from InvenTree Open Source. Provides powerful low-level inventory control and parts tracking . A denial of service vulnerability exists in InvenTree versions prior to 0.8.0 that stems from the annotations feature not including a character...

CVE-2022-31062 Unauthenticated Local File Inclusion

Impact A plugin public script can be used to read content of system files. Patches Upgrade to version 1.0.2. Workarounds b/deploy/index.php file can be deleted if deploy feature is not used...

CVE-2022-31062 Unauthenticated Local File Inclusion

Impact A plugin public script can be used to read content of system files. Patches Upgrade to version 1.0.2. Workarounds b/deploy/index.php file can be deleted if deploy feature is not used...

WooCommerce PDF Invoices & Packing Slips < 2.16.0 - Reflected Cross-Site Scripting

The plugin doesn't escape a parameter on its setting page, making it possible for attackers to conduct reflected cross-site scripting attacks. https://example.com/wp-admin/admin.php?page=wpowcpdfoptionspage&preview=xxxxx%22+accesskey%3DX+onclick%3Dalert%281%29+test%3D%22...

Recipes 代码问题漏洞

Recipes is an application for managing recipes, planning meals, creating shopping lists, and more! A code issue vulnerability exists in Recipes versions 0.9.1 through 1.2.5 that stems from the Import Recipe feature being vulnerable to a server request forgery attack. When an attacker enters a...

PT-2022-3323 · Metamask +2 · Metamask +2

Name of the Vulnerable Software and Affected Versions: MetaMask versions prior to 10.11.3 Description: The issue is related to the storage of confidential information in unencrypted form, allowing an attacker to access a user's secret recovery phrase. This is due to the use of an input field for ...

Security feature bypass

DISPUTED Grafana 8.4.3 allows unauthenticated access via for example a /dashboard/snapshot/?orgId=0 URI. NOTE: the vendor considers this a UI bug, not a vulnerability...

Cisco Unified IP Phones Security Feature Issue Vulnerability

Cisco Unified IP Phones is a series of IP phones from Cisco, U.S.A. A security feature issue vulnerability exists in Cisco Unified IP Phones, which stems from the failure to properly generate keys during the manufacturing process resulting in the installation of duplicate manufacturing keys on...

A Microsoft Office 365 Feature Could Help Ransomware Hackers Hold Cloud Files Hostage

A "dangerous piece of functionality" has been discovered in Microsoft 365 suite that could be potentially abused by a malicious actor to mount attacks on cloud infrastructure and ransom files stored on SharePoint and OneDrive. The cloud ransomware attack makes it possible to launch file-encryptin...

CVE-2022-30164

Kerberos AppContainer Security Feature Bypass Vulnerability...

CVE-2022-30164

Technical details for CVE-2022-30164 (affected software, root cause, impact, or fixes) are not provided in the connected documents. Public info appears limited to general references; monitor official advisories for updates.

CVE-2022-30164 Kerberos AppContainer Security Feature Bypass Vulnerability

...

REDCap 跨站脚本漏洞

REDCap is a data collection and management web application. A security vulnerability exists in REDCap version 12.0.11, which stems from a stored cross-site scripting XSS issue in Messenger/messengerajax.php. An authenticated, remote attacker can exploit this vulnerability to inject arbitrary...

Siemens SINEMA Remote Connect Server has an unspecified vulnerability (CNVD-2022-45223)

SINEMA Remote Connect is a remote network management platform that makes it easy to manage tunneled connections VPNs between headquarters, service technicians, and installed machines or plants.A security vulnerability in Siemens SINEMA Remote Connect Server stems from the fact that the affected...