CVE-2022-31061

CVE-2022-31061 corresponds to a SQL injection vulnerability in GLPI. Connected sources describe affected versions as GLPI prior to 10.0.13 with the issue in login/search related functionality. The recommended remediation is to upgrade to version 10.0.13 or later; some entries also suggest restric...

CVE-2022-31068

CVE-2022-31068 affects GLPI installations that use the native inventory, where all such instances may leak sensitive information due to an unauthenticated access path. The issue is addressed in GLPI version 10.0.2; all affected users are advised to upgrade to 10.0.2 or newer. The provided documen...

CVE-2022-31056

GLPI prior to 10.0.2 is affected by a SQL injection in the actor field across Help forms (Ticket/Change/Problem). The underlying issue is lack of validation of external input in those actor fields, enabling potentially unauthorized SQL commands. The vulnerability is fixed in GLPI version 10.0.2; ...

PT-2022-11343 · Unknown · Gpac Mp4Box

Name of the Vulnerable Software and Affected Versions: GPAC MP4Box version 1.1.0 Description: The issue is related to a Null pointer reference in the gf filter pid get packet function, located in src/filter core/filter pid.c at line 5394. This can cause a denial of service DOS. Recommendations: F...

CVE-2022-31056 SQL injection with _actor parameter in GLPI

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions all assistance forms Ticket/Change/Problem permit sql injection on the actor fields. This issue has been resolved in version 10.0.2 and...

CVE-2022-31082

GLPI and its glpi-inventory-plugin are affected by CVE-2022-31082 due to a SQL injection via package deployment tasks. The issue affects versions prior to 1.0.2 and is fixed in 1.0.2; upgrade is advised. As a workaround for users unable to upgrade, delete front/deploypackage.public.php if the dep...

What Are Shadow IDs, and How Are They Crucial in 2022?

Just before last Christmas, in a first-of-a-kind case, JPMorgan was fined $200M for employees using non-sanctioned applications for communicating about financial strategy. No mention of insider trading, naked shorting, or any malevolence. Just employees circumventing regulation using, well, Shado...

it-takes-two.de Cross Site Scripting vulnerability OBB-2685914

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

A Man of Action: Meet Callum Carney

Hidden Talents : He was a competitive swimmer for many years. Instrument of Choice : His fingers were made for the keyboard, but he used to play the trumpet. 5 pieces of entertainment for the rest of his life : The Office, World War Z, The Matrix, Breaking Bad, The Thick of It...

A Man of Action: Meet Callum Carney

Hidden Talents : He was a competitive swimmer for many years. Instrument of Choice : His fingers were made for the keyboard, but he used to play the trumpet. 5 pieces of entertainment for the rest of his life : The Office, World War Z, The Matrix, Breaking Bad, The Thick of It...

Splunk Resource Permission Assignment Error Vulnerability

Splunk is a suite of data collection and analysis software from Splunk, Inc. The software is primarily used to collect, index, and analyze the data it generates, including data generated by all IT systems and infrastructure physical, virtual machines, and cloud.A resource privilege assignment err...

Malicious Package

Overview it-roche is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

Gamification of Ethical Hacking and Hacking Esports

While ethical hacking is by no means a new or groundbreaking practice, the scale at which organizations and individuals are undertaking such initiatives continues to intensify, especially considering recent events such as the log4j vulnerability. Traditionally, ethical hacking is undertaken by...

Network Pentesting Checklist

By Owais Sultan Network pentesting is a frequently used and successful method of recognizing security issues in a companys IT infrastructure.… This is a post from HackRead.com Read the original post: Network Pentesting Checklist...

it-reborn.com Cross Site Scripting vulnerability OBB-2659892

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Malicious code in dana-desktop (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d46c05645540bd70b2756a13f1eb8fb1a6accb62e126da3e65445be64abc41b5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @sberid/qrcode (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware abb3a4cff320a460ac88aad847b8be90f16775a95b635b0641e82f8b3b0f263c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in occl_core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 59e532fda5c623f9fe59ab74543c46d0c4e8113f64aadc07e833577fbc499732 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in docs.hackerone.com (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 55f713df58a172156dfd981bc77f72e1ade7d9d447a4e764dfe3f54eefa53050 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in frontend-melidata (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9d3ce58d835f3077e35b0224fe0eeb938c7583537cf830eebff9d328c1558a97 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...