SICK FTMg 安全漏洞

The SICK FTMg is a flow sensor from SICK. A security vulnerability exists in SICK FTMg versions prior to 2.8, which stems from the fact that an unauthenticated user can access sensitive Web URLs via a GET request, which should be limited to maintenance users only. A malicious attacker could use...

Glassdoor: [CRITICAL] Full account takeover without user interaction on sign with Apple flow

An account takeover was detected with our sign-up with Apple flow where an email parameter was manipulated in the request flow to our servers. This scenario can only be performed on a previously unlinked apple ID account with Glassdoor. Changing the email in the request flow allowed the researche...

CVE-2022-32223

Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if the victim has the following dependencies on a Windows machine: OpenSSL has been installed and “C:\Program Files\Common Files\SSL\openssl.cnf”...

CVE-2022-32223

Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if the victim has the following dependencies on a Windows machine: OpenSSL has been installed and “C:\Program Files\Common Files\SSL\openssl.cnf”...

CVE-2022-0902

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal', Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in flow computer and remote controller products of ABB RMC-100 Standard, RMC-100-LITE, XIO, XFCG5 , XRCG5 , uFLOG5 , UDC...

Hybrid-Work Drives Hardware Security Strategies

Remote workforce, hybrid-cloud and Zero-Trust trends are pushing security teams to focus on hardware-assisted security strategies to better secure an evolving attack surface changed significantly by COVID. To address new challenges, hardware-assisted security is viewed as an effective and...

The vulnerability of the Python programming language-based UltraJSON package, which allows attackers to compromise data integrity

The vulnerability of the UltraJSON programming language package in Python is related to the implementation of an incorrect control flow. Exploiting this vulnerability allows a malicious actor to compromise data integrity from a remote location...

undertow: potential security issue in flow control over HTTP/2 may lead to DOS

A flaw was found in Undertow. A potential security issue in flow control handling by the browser over http/2 may potentially cause overhead or a denial of service in the server. The highest threat from this vulnerability is availability...

undertow: potential security issue in flow control over HTTP/2 may lead to DOS(incomplete fix for CVE-2021-3629)

A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server...

GSD-2022-1003719 netfilter: nf_tables: memleak flow rule from commit path

netfilter: nftables: memleak flow rule from commit path This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.198 by commit...

GSD-2022-1003524 netfilter: nf_tables: memleak flow rule from commit path

netfilter: nftables: memleak flow rule from commit path This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.122 by commit...

GSD-2022-1002609 netfilter: nf_tables: memleak flow rule from commit path

netfilter: nftables: memleak flow rule from commit path This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.4 by commit...

CNote updates the accounts after sending the funds, allowing for reentrancy

Lines of code Vulnerability details Having no reentrancy control and updating the records after external interactions allows for funds draining by reentrancy. Setting the severity to medium as this is conditional to transfer flow control introduction on future upgrades, but the impact is up to th...

MAL-2022-4603 Malicious code in minimum-flow-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 011d620beda8692dd780e1c593c87bc37c1b888ff9e017f9cfbb969f86469a52 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in minimum-flow-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 011d620beda8692dd780e1c593c87bc37c1b888ff9e017f9cfbb969f86469a52 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in schema-plugin-flow (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 70232e33e5a2e85b6f33884f9f06cd4749582a84331debd9bac517830afe5b72 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5963 Malicious code in schema-plugin-flow (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 70232e33e5a2e85b6f33884f9f06cd4749582a84331debd9bac517830afe5b72 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3822 Malicious code in ing-flow (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d1ee3d628a2196cfdf0a6026326cd1e238adedb2f7535c063eb7d561dedab682 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3823 Malicious code in ing-flow-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd817301581b6207aff141b16d371ee9f97412a4e4e26b5ca238208be07d1ec6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5372 Malicious code in plugin-syntax-flow (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 04e8baeb56984ab713bfa2788f7884ef46499c9b336153a61ffc4051c39c4dd4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...