GHSA-4F63-89W9-3JJV vulnerabilities

Vulnerabilities for packages: openssl...

GHSA-4F63-89W9-3JJV vulnerabilities

Vulnerabilities for packages: openssl...

MyBB < 1.8.31 RCE Vulnerability (GHSA-hxhm-rq9f-7xj7)

MyBB is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mybb:mybb";...

CVE-2022-39284

CodeIgniter 4 prior to v4.2.7 has a cookie handling bug where setting secure or HttpOnly (Config\Cookie) is not reflected in set_cookie() or Response::setCookie(), causing cookie values to be exposed to scripts. The vulnerability is limited to non-session cookies and does not affect sessions. Aff...

GHSA-H4H5-3HR4-J3G2 vulnerabilities

Vulnerabilities for packages: emsdk, druid, hadoop-client-modules, trino, celeborn...

Discourse 2.9.0.beta5 - 2.9.0.beta9 DoS Vulnerability

Discourse is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:discourse:discourse"...

GHSA-JJJH-JJXP-WPFF vulnerabilities

Vulnerabilities for packages: scala, cassandra, cassandra-reaper, management-api-for-apache-cassandra-5.0...

GHSA-JJJH-JJXP-WPFF vulnerabilities

Vulnerabilities for packages: spark, management-api-for-apache-cassandra-5.0, scala, management-api-for-apache-cassandra-4.0, management-api-for-apache-cassandra-4.1, cassandra, cassandra-reaper...

Malicious code in console_colored (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d68a7c49d0336feb923134a2e5f0e088c23a9615a82c64276dd4ca1ea6fb53dc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2799 Malicious code in eslint-config-keep (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3dee34721faf47bce15773bdf42e2e7ee9f5cad8eae4aeed1b2a3812ab6be270 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-C429-5P7V-VGJP vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, opensearch-dashboards-fips...

GHSA-C429-5P7V-VGJP vulnerabilities

Vulnerabilities for packages: opensearch-dashboards...

Grafana 8.5.0 < 8.5.13, 9.0.0 < 9.0.9, 9.1.0 < 9.1.6 Privilege Escalation Vulnerability (GHSA-p978-56hq-r492)

Grafana is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:grafana:grafana"; if...

Grafana Privilege Escalation Vulnerability (GHSA-ff5c-938w-8c9q)

Grafana is prone to a privilege escalation vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you...

GHSA-6W4Q-23CF-J9JP parse-server's session object properties can be updated by foreign user if object ID is known

Impact A foreign user can write to the session object of another user if the session object ID is known. For example, a foreign user can assign the session object to their own user by writing to the user field and then read any custom fields of that session object. Note that assigning a session t...

Malicious code in discordjs-self-11 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd641445351530f4c4b5d778e7d019fd96bdbfa32458d966344a14f465cb421f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Nextcloud Server < 23.0.8, 24.x < 24.0.4 SSRF Vulnerability (GHSA-rmf9-w497-8cq8)

Nextcloud Server is prone to a server-side request forgery SSRF vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

XWiki 12.5 < 13.10.6, 14.0 < 14.4 XSS Vulnerability (GHSA-c5v8-2q4r-5w9v)

Xwiki is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki";...

XWiki < 13.10.6, 14.0 < 14.4 Code Injection Vulnerability (GHSA-2g5c-228j-p52x)

Xwiki is prone to a code injection vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki"; ifdescription...

GHSA-R7VQ-6425-J94W Python-TUF vulnerable to incorrect threshold signature computation for new root metadata

Impact The function verifyrootselfsigned, introduced in v0.14.0, and which verifies self-signatures in a new root metadata file, counted multiple signatures by any new root key towards the new threshold. That is, any single new root key could theoretically provide enough signatures to meet the...