Security Bulletin: Vulnerability in IBM WebSphere Liberty affects IBM InfoSphere Global Name Management (CVE-2022-34165)

Summary The IBM WebSphere Liberty used in IBM InfoSphere Global Name Management is vulnerable to HTTP header injection when processing web requests. This problem is addressed. Vulnerability Details CVEID:CVE-2022-34165 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 and IBM...

BlueHat 2023: Connecting the security research community with Microsoft

We’re excited to welcome more than 400 members of the security research community from around the world to Redmond, Washington for BlueHat 2023. Hosted by the Microsoft Security Response Center MSRC, BlueHat is where the security research community, and Microsoft security professionals, come...

BlueHat 2023: Connecting the security research community with Microsoft

We’re excited to welcome more than 400 members of the security research community from around the world to Redmond, Washington for BlueHat 2023. Hosted by the Microsoft Security Response Center MSRC, BlueHat is where the security research community, and Microsoft security professionals, come...

OSV-2023-48 Global-buffer-overflow in isvce_write_coeff4x4_cavlc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=55643 Crash type: Global-buffer-overflow READ 1 Crash state: isvcewritecoeff4x4cavlc isvceencoderesidue isvcewritepslicembcavlc...

PT-2023-35869 · Git +1 · Libavc

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type identified as Global-buffer-overflow READ 1. The crash state involves several functions: isvce write coeff4x4 cavlc,...

globalindustrialmachinery.com Cross Site Scripting vulnerability OBB-3178628

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-21191

A flaw was found in global-modules-path. This issue may allow command injection via getPath due to missing input sanitization or other checks and sandboxes being employed to the getPath function...

The Menace of TrickGate Packer-as-a-Service Spreading Malware Globally

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary TrickGate has bundled several of the most well-known top-distribution malware families, including Trickbot, Maze, Emotet, REvil, CoinMiner, Cobalt Strike, Formbook, Remcos, AgentTesla, and many others...

jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection

A Prototype Pollution vulnerability was found in jquery. Untrusted JSON passed to the extend function could lead to modifying objects up the prototype chain, including the global Object. A crafted JSON object passed to a vulnerable method could lead to denial of service or data injection, with...

jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection

A Prototype Pollution vulnerability was found in jquery. Untrusted JSON passed to the extend function could lead to modifying objects up the prototype chain, including the global Object. A crafted JSON object passed to a vulnerable method could lead to denial of service or data injection, with...

jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection

A Prototype Pollution vulnerability was found in jquery. Untrusted JSON passed to the extend function could lead to modifying objects up the prototype chain, including the global Object. A crafted JSON object passed to a vulnerable method could lead to denial of service or data injection, with...

Malicious code in karma-jasmine-i-global (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e549b03e79b04aa24627294bb5599da9fb989a712bfbe3a6048c97bed62778b4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-548 Malicious code in karma-jasmine-i-global (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e549b03e79b04aa24627294bb5599da9fb989a712bfbe3a6048c97bed62778b4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in yandex-global-state-controller (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c1a6c4dba2b3e3c39b4ce832c2744f991230aee48e1a68f51b1dc4fd47dffb8a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-984 Malicious code in yandex-global-state-controller (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c1a6c4dba2b3e3c39b4ce832c2744f991230aee48e1a68f51b1dc4fd47dffb8a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview yandex-global-state-controller is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if...

CVE-2022-48066

An issue in the component global.so of Totolink A830R V4.1.2cu.5182 allows attackers to bypass authentication via a crafted cookie...

It’s Data Privacy Day: Here’s how to protect your data and become your own privacy champion

News, Security It’s Data Privacy Day: Here’s how to protect your data and become your own privacy champion Share January 27th, 2023 Hello readers! January 28 is Data Privacy Day – an annual celebration of all things data protection and online privacy! It’s an opportunity for businesses and users ...

Cleartext Transmission of Sensitive Information in Jenkins JIRA Pipeline Steps Plugin

Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier transmits the private key in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure...

Plaintext Storage of a Password in Jenkins TestQuality Updater Plugin

Jenkins TestQuality Updater Plugin 1.3 and earlier stores the TestQuality Updater password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system...