[SECURITY] Fedora 36 Update: gotags-1.4.1-8.fc36

ctags-compatible tag generator for Go...

[SECURITY] Fedora 36 Update: golang-github-martinhoefling-goxkcdpwgen-0.1.0-2.fc36

xkcd style password generator library and cli tool...

[SECURITY] Fedora 36 Update: golang-github-grpc-ecosystem-gateway-2-2.7.3-4.fc36

GRPC to JSON proxy generator following the gRPC HTTP spec...

[SECURITY] Fedora 36 Update: golang-github-dave-jennifer-1.4.1-5.fc36

Jennifer is a code generator for Go...

[SECURITY] Fedora 36 Update: act-1.6.0-6.fc36

The Automatic Component Toolkit ACT is a code generator that takes an instance of an Interface Description Language file and generates a thin C89-API, implementation stubs and language bindings of your desired software component...

The vulnerability of Cisco Unified IP Phones’ microprogramming software lies in errors in the code for generating pseudo-random numbers. This allows attackers to impersonate another user’s phone.

The vulnerability of Cisco Unified IP Phones’ microprogrammed software is related to errors in the code of the pseudorandom number generator. Exploiting this vulnerability can allow an attacker to impersonate another user’s phone...

rng-tools bug fix and enhancement update

An update is available for rng-tools. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The rng-tools packages contain random number generator user-space utilities...

CVE-2022-31034 Insecure entropy in argo-cd

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v0.11.0 are vulnerable to a variety of attacks when an SSO login is initiated from the Argo CD CLI or UI. The vulnerabilities are due to the use of insufficiently random values in...

WordPress Page Generator plugin <= 1.6.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Sachin Bahl eSec Forte Technologies Pvt Ltd in WordPress Page Generator plugin versions = 1.6.4. Solution Update the WordPress Page Generator plugin to the latest available version at least 1.6.5...

Page Generator Plugin < 1.6.6 - Arbitrary Keywords Deletion/Duplication via CSRF

The plugin does not have CSRF check in place when deleting and duplicating keywords, which could allow attackers to make a logged in admin delete and duplicate arbitrary keywords via CSRF attacks https://example.com/wp-admin/admin.php?page=page-generator-keywords&cmd=delete&id=3...

Page Generator Plugin < 1.6.5 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. Got to Page Generator - Keywords - Add Keyword and put the following payload in the "Terms" field then...

WordPress Page Generator plugin <= 1.6.5 - Arbitrary Keywords Deletion/Duplication via Cross-Site Request Forgery (CSRF) vulnerability

Arbitrary Keywords Deletion/Duplication via Cross-Site Request Forgery CSRF vulnerability discovered by WPScanTeam in WordPress Page Generator plugin versions = 1.6.5. Solution Update the WordPress Page Generator plugin to the latest available version at least 1.6.6...

Page Generator Plugin < 1.6.6 - Arbitrary Keywords Deletion/Duplication via CSRF

The plugin does not have CSRF check in place when deleting and duplicating keywords, which could allow attackers to make a logged in admin delete and duplicate arbitrary keywords via CSRF attacks PoC https://example.com/wp-admin/admin.php?page=page-generator-keywords=delete=3...

Malicious Package

Overview multisig-wallet-generator is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

Malicious Package

Overview dash-generator-test-component-standard is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only...

Malicious Package

Overview generator-connection is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

Malicious code in dash-generator-test-component-standard (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 589f8997367b0fcf74898b358292237c8ec3c807c1785b8564ba195b6ac5d2af Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Data Tables Generator by Supsystic < 1.10.20 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some of its Table settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed for example in multisite setup Create/edit a table, go to its settings, enabled...

WordPress Data Tables Generator by Supsystic plugin <= 1.10.19 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by iohex in WordPress Data Tables Generator by Supsystic plugin versions = 1.10.19. Solution Update the WordPress Data Tables Generator by Supsystic plugin to the latest available version at least 1.10.20...

MAL-2022-5732 Malicious code in refocus-sample-generator-template-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 631548c717c3bbe8a8db0c1da07900bc6e8e906501e5ceb3a4c850a7f33351b2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...