NSA Ghidra 命令注入漏洞

NSA Ghidra is an open source reverse engineering tool from the National Security Agency NSA. A security vulnerability exists in NSA Ghidra versions 10.2.2 and earlier, which stems from its Ghidra/RuntimeScripts/Linux/support/launch.sh file passing user-supplied input to eval, which when called wi...

PT-2023-9421 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.2.0-rc1-dirty 11 Description: The vulnerability is related to a NULL pointer dereference in the Linux kernel's drm/msm component, specifically when the Adreno GPU is working in headless mode. This can cause an...

Ubuntu: Security Advisory (USN-5770-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

UBUNTU-CVE-2022-39334

Nextcloud also ships a CLI utility called nextcloudcmd which is sometimes used for automated scripting and headless servers. Versions of nextcloudcmd prior to 3.6.1 would incorrectly trust invalid TLS certificates, which may enable a Man-in-the-middle attack that exposes sensitive data or...

AlmaLinux 9 : qemu-kvm (ALSA-2022:5263)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:5263 advisory. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C...

PT-2022-24863 · Saleor · Saleor

Name of the Vulnerable Software and Affected Versions: Saleor versions prior to 3.1.24 Saleor versions prior to 3.2.14 Saleor versions prior to 3.3.26 Saleor versions prior to 3.4.24 Saleor versions prior to 3.5.23 Saleor versions prior to 3.6.18 Saleor versions prior to 3.7.17 Description: The...

Blender 代码问题漏洞

Blender is a professional free and open source 3D computer graphics software. A code issue exists in Blender where an error is displayed instead of a crash when rendering with "headless builds"...

Rank Math SEO < 1.0.95.1 - Unauthenticated SSRF

The plugin does not properly restrict access to some .htaccess blocked REST endpoints when the headless settings is enabled, which could allow unauthenticated attackers to perform SSRF attacks...

Malicious code in headless-obyte (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 23a746248cdd3fa9fc000729a31a09edc3476b4ad4cbdec19c121fb0ca07fb77 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3583 Malicious code in headless-obyte (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 23a746248cdd3fa9fc000729a31a09edc3476b4ad4cbdec19c121fb0ca07fb77 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview headless-obyte is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package wa...

New YTStealer Malware Aims to Hijack Accounts of YouTube Content Creators

Cybersecurity researchers have documented a new information-stealing malware that targets YouTube content creators by plundering their authentication cookies. Dubbed "YTStealer" by Intezer, the malicious tool is likely believed to be sold as a service on the dark web, with it distributed using fa...

Remote Code Injection

Overview convert-svg-core is a package that supports converting SVG into another format using headless Chromium. Affected versions of this package are vulnerable to Remote Code Injection via sending an SVG file containing the payload. PoC: js const convert = require'convert-svg-to-png'; const...

Github saleor安全漏洞

Github saleor is a headless GraphQL commerce platform that delivers a super-fast, dynamic, personalized shopping experience. Beautiful online store, anywhere, on any device. A security vulnerability exists in saleor versions prior to 3.1.2 that stems from incorrect authorization in the applicatio...

SUSE: Security Advisory (SUSE-SU-2022:0784-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-25985

In Factor App Framework & Headless CMS v1.0.4 to v1.8.30, improperly invalidate a user’s session even after the user logs out of the application. In addition, user sessions are stored in the browser’s local storage, which by default does not have an expiration time. This makes it possible for an...

CVE-2021-25985

In Factor App Framework & Headless CMS v1.0.4 to v1.8.30, improperly invalidate a user’s session even after the user logs out of the application. In addition, user sessions are stored in the browser’s local storage, which by default does not have an expiration time. This makes it possible for an...

CVE-2021-25983

In Factor App Framework & Headless CMS forum plugin, versions v1.3.8 to v1.8.30, are vulnerable to reflected Cross-Site Scripting XSS at the “tags” and “category” parameters in the URL. An unauthenticated attacker can execute malicious JavaScript code and steal the session cookies...

Cross site scripting

In Factor App Framework & Headless CMS forum plugin, versions 1.3.5 to 1.8.30, are vulnerable to reflected Cross-Site Scripting XSS at the “search” parameter in the URL. An unauthenticated attacker can execute malicious JavaScript code and steal the session cookies...

Cross site scripting

In Factor App Framework & Headless CMS v1.0.4 to v1.8.30, improperly invalidate a user’s session even after the user logs out of the application. In addition, user sessions are stored in the browser’s local storage, which by default does not have an expiration time. This makes it possible for an...