PT-2022-4033 · Jenkins · Jenkins Compuware Xpediter Code Coverage Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Compuware Xpediter Code Coverage Plugin versions 1.0.7 and earlier Description: The issue is related to a missing permission check in the plugin, which can be exploited by attackers with Overall/Read permission to enumerate hosts and...

PT-2022-4034 · Bmc +2 · Jenkins Bmc Ami Devx Code Pipeline Operations Plugin +2

Name of the Vulnerable Software and Affected Versions: Jenkins Compuware ISPW Operations Plugin versions 1.0.8 and earlier Jenkins BMC AMI DevX Code Pipeline Operations Plugin versions 1.0.8 and earlier Description: A missing permission check in the plugin allows attackers with Overall/Read...

Malicious code in route-sonar (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e7e8e14e7b5534cc30736a69538701a587fe3db0ac921df08e55a9c1e571fc7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wm-accounts-auth-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1cdd1cfc8b0646198270138deb5824d92d72858377c39f84124570e1273629a9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

LiveTargetsFinder - Generates Lists Of Live Hosts And URLs For Targeting, Automating The Usage Of MassDNS, Masscan And Nmap To Filter Out Unreachable Hosts And Gather Service Information

Generates lists of live hosts and URLs for targeting, automating the usage of Massdns, Masscan and nmap to filter out unreachable hosts Given an input file of domain names, this script will automate the usage of MassDNS to filter out unresolvable hosts, and then pass the results on to Masscan to...

Malicious code in api-routes-rest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aa098cf98014efb5822c9283caad8c78740b5592ec51aad691cb5e225282bf59 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in search-gov-website (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 451bca5bdb635f0f47d70d754081dd0ca0a128b60a2c3fb3821b252695738d9b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in analytics.usa.gov (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e1a33363f19a2f8802327fdc87bafbb52ff7966afefd35a4a378d19651da0132 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in unibet_package (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a67ef96997f8e34d3306d86175222a89ce7b7d44c3441e251ded4788a537b8c2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ui-shop (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e1502a52ae156bfc3c6970836d113ad8acd802d037fd01ab787c85d5de0acce0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

U.S. Dept Of Defense: Directory Traversal at █████

Hi DoD! I found directory traversal vulnerability at ████. I didn't find available title for this issue that's why I selected remote file inclusion. Host: ██████ Vulnerability: Directory Traversal in Windows Server Tool Used: BurpSuite Parameter: ==path== HTTP GET Request ==GET...

Malicious code in anytoken-locked (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d0d2501597c91e0da0b6ab825a858938832f5b1789265e6207566b46353f9a47 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

U.S. Dept Of Defense: Reflected cross site scripting in https://███████

It was observed that the application is vulnerable to cross-site scripting XSS. XSS is a type of attack that involves running a malicious scripts on a victim’s browser. request.txt attacked poc attached Impact Cookie Stealing - A malicious user can steal cookies and use them to gain access to the...

Malicious code in gfg-gpe-utilities (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c76ef99ca9c484e4dfe8e481e4310b165046491b4c7a8fd6018dfd811a9891e0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in xedvhtkmspgzwkfy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 644c38d7b6843900633faebc336899b94036dc273306a016e98254d43aacf0ff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in axevqmjtkunplhir (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 90a20a9a4e4da14643700f8e95b9baff2c76dc3d0c7c0647cb303ad7173feffe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in xlhepkvdnjmyaruo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2f920bc68ac34c5a4c99e43227ed59de157c425a8c3be40dd7e67e0fcf2a5e74 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in xhnedzawcukgpfjv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a39821ab671a48b431878eb07bed325ec12db5a013141dcb24c567dd7047a610 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

JBOSS EAP/AS 6.x Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'JBOSS EAP/AS Remoting Unified Invoker RCE', 'Description' = %q An unauthenticated attacker with network access to the JBOSS EAP/AS 'Joao Matos ',...

Malicious code in fcskuqoiemhdkwra (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1498f59826547fe0fbb0bd767a6163bf369eb13b432a09194edae0728a588957 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...