Malicious code in harvest-strategy-arbitrum (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 25fc9c1c12e5d675118a2fac283b84b5f05476e9a35c4172ef1b3059da075e12 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in google.fhir.stu3.google (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fee906b0dce81401aecdf9ea95b8dd2508264e2d4a489793987c126c996c60ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Mageia: Security Advisory (MGASA-2024-0232)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Updated virtualbox & kmod-virtualbox packages fix security vulnerabilities

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 7.0.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise...

Malicious code in portfolio-organism-adp-wrapper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 41eb756462a90039b0df22968214c17f7b6bbf6a4aaf0db84da2266a6e33813d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in aws-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a30bda5bff5f57af1051023ce71acba6b09efbaa75367bd8a05831377244491c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Exploit for OS Command Injection in Php

PHP RCE PoC CVE-2024-4577: Argument Injection in PHP-CGI...

Exploit for OS Command Injection in Php

CVE-2024-4577 PoC Exploit...

SUSE CVE-2021-37939

It was discovered that Kibana's JIRA connector & IBM Resilient connector could be used to return HTTP response data on internal hosts, which may be intentionally hidden from public view. Using this vulnerability, a malicious user with the ability to create connectors, could utilize these connecto...

SUSE CVE-2023-4399

Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, Request security is a deny list that allows admins to configure Grafana in a way so that the instance doesn't call specific hosts. However, the restriction can be bypassed used punycode encoding of the...

Malicious code in calculator-avishek (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 483f32930a5b1005404615c7c7b5063cd48501972c1b0e0dd439f5ec4740b67b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

RHEL 7 : ansible (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - Ansible: Compromised remote hosts can lead to running commands on the Ansible controller CVE-2016-9587 - ...

ExtJS JavaScript framework used in TYPO3 vulnerable to Cross-site Scripting

Failing to properly validate the HTTP host-header TYPO3 CMS is susceptible to host spoofing. TYPO3 uses the HTTP host-header to generate absolute URLs in several places like 404 handling, https enforcement, password reset links and many more. Since the host header itself is provided by the client...

GHSA-MXJF-HC9V-XGV2 ExtJS JavaScript framework used in TYPO3 vulnerable to Cross-site Scripting

Failing to properly validate the HTTP host-header TYPO3 CMS is susceptible to host spoofing. TYPO3 uses the HTTP host-header to generate absolute URLs in several places like 404 handling, https enforcement, password reset links and many more. Since the host header itself is provided by the client...

USN-6799-1: Werkzeug vulnerability

It was discovered that the debugger in Werkzeug was not restricted to trusted hosts. A remote attacker could possibly use this issue to execute code on the host under certain circumstances...

USN-6799-1 python-werkzeug vulnerability

It was discovered that the debugger in Werkzeug was not restricted to trusted hosts. A remote attacker could possibly use this issue to execute code on the host under certain circumstances...

Subhunter - A Fast Subdomain Takeover Tool

Subdomain takeover is a common vulnerability that allows an attacker to gain control over a subdomain of a target domain and redirect users intended for an organization's domain to a website that performs malicious activities, such as phishing campaigns, stealing user cookies, etc. It occurs when...

c-ares: Out of bounds read in ares__read_line()

A vulnerability was found in c-ares where the aresreadline is used to parse local configuration files such as /etc/resolv.conf, /etc/nsswitch.conf, the HOSTALIASES file, and if using a c-ares version prior to 1.22.0, the /etc/hosts file. If the configuration files have an embedded NULL character ...

RHEL 7 : ansible (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - Ansible: Compromised remote hosts can lead to running commands on the Ansible controller CVE-2016-9587 - ...

CVE-2024-32980 Spin contains a potential network sandbox escape for specifically configured Spin applications

Spin is the developer tool for building and running serverless applications powered by WebAssembly. Prior to 2.4.3, some specifically configured Spin applications that use self requests without a specified URL authority can be induced to make requests to arbitrary hosts via the Host HTTP header...