Malicious code in por-indexer-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8e0b29500113fe000aa5b8317e12d0a16c8d2dba3f44cbf591b02445c514dd92 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5417 Malicious code in por-indexer-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8e0b29500113fe000aa5b8317e12d0a16c8d2dba3f44cbf591b02445c514dd92 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

org.craftercms:crafter-deployer (=3.0.0), org.craftercms:crafter-engine (=3.0.0) +1 more potentially affected by CVE-2017-15683 via org.craftercms:crafter-core (=3.0.0)

org.craftercms:crafter-core MAVEN version =3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.craftercms:crafter-core and may be impacted: - org.craftercms:crafter-deployer =3.0.0 - org.craftercms:crafter-engine =3.0.0 -...

org.craftercms:crafter-deployer (=3.0.0), org.craftercms:crafter-engine (=3.0.0) +1 more potentially affected by CVE-2017-15680 via org.craftercms:crafter-core (=3.0.0)

org.craftercms:crafter-core MAVEN version =3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.craftercms:crafter-core and may be impacted: - org.craftercms:crafter-deployer =3.0.0 - org.craftercms:crafter-engine =3.0.0 -...

org.craftercms:crafter-deployer (=3.0.0), org.craftercms:crafter-engine (=3.0.0) +1 more potentially affected by CVE-2017-15682 via org.craftercms:crafter-core (=3.0.0)

org.craftercms:crafter-core MAVEN version =3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.craftercms:crafter-core and may be impacted: - org.craftercms:crafter-deployer =3.0.0 - org.craftercms:crafter-engine =3.0.0 -...

CVE-2021-31559

A crafted request bypasses S2S TCP Token authentication writing arbitrary events to an index in Splunk Enterprise Indexer 8.1 versions before 8.1.5 and 8.2 versions before 8.2.1. The vulnerability impacts Indexers configured to use TCPTokens. It does not impact Universal Forwarders...

CVE-2021-31559

A crafted request bypasses S2S TCP Token authentication writing arbitrary events to an index in Splunk Enterprise Indexer 8.1 versions before 8.1.5 and 8.2 versions before 8.2.1. The vulnerability impacts Indexers configured to use TCPTokens. It does not impact Universal Forwarders...

Cross site request forgery (csrf)

A crafted request bypasses S2S TCP Token authentication writing arbitrary events to an index in Splunk Enterprise Indexer 8.1 versions before 8.1.5 and 8.2 versions before 8.2.1. The vulnerability impacts Indexers configured to use TCPTokens. It does not impact Universal Forwarders...

CVE-2021-31559

Splunk Enterprise Indexer authentication bypass (CVE-2021-31559) affects 8.1.x before 8.1.5 and 8.2.x before 8.2.1 for Indexers using TCPTokens; a crafted request bypasses S2S TCP Token authentication and can write arbitrary events to an index, while Universal Forwarders are unaffected. Connected...

CVE-2021-31559 S2S TcpToken authentication bypass

A crafted request bypasses S2S TCP Token authentication writing arbitrary events to an index in Splunk Enterprise Indexer 8.1 versions before 8.1.5 and 8.2 versions before 8.2.1. The vulnerability impacts Indexers configured to use TCPTokens. It does not impact Universal Forwarders...

PT-2022-10035 · Splunk · Splunk Enterprise Indexer

Name of the Vulnerable Software and Affected Versions: Splunk Enterprise Indexer versions 8.1 through 8.1.4 Splunk Enterprise Indexer versions 8.2 through 8.2.0 Description: A crafted request can bypass S2S TCP Token authentication, allowing arbitrary events to be written to an index. This issue...

Splunk Enterprise 授权问题漏洞

Splunk is a suite of data collection and analysis software from Splunk, Inc. in the United States. The software is primarily used to collect, index, and analyze and the data it generates, including data generated by all IT systems and infrastructures physical, virtual machines, and cloud. A...

Indexed Search Engine for TYPO3 Command Execution via Metacharacter Injection

The Indexed Search Engine indexedsearch system extension in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 allows remote attackers to execute arbitrary commands via a crafted filename containing shell metacharacters, which is not properly handled by the command-line index...

GHSA-74W6-WW7W-45J9 Indexed Search Engine for TYPO3 Command Execution via Metacharacter Injection

The Indexed Search Engine indexedsearch system extension in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 allows remote attackers to execute arbitrary commands via a crafted filename containing shell metacharacters, which is not properly handled by the command-line index...

CVE-2021-3422 Indexer denial-of-service via malformed S2S request

The lack of validation of a key-value field in the Splunk-to-Splunk protocol results in a denial-of-service in Splunk Enterprise instances configured to index Universal Forwarder traffic. The vulnerability impacts Splunk Enterprise versions before 7.3.9, 8.0 versions before 8.0.9, and 8.1 version...

March 22, 2022—KB5011551 (OS Build 17763.2746) Preview

None None...

March 22, 2022—KB5011558 (OS Build 20348.617) Preview

None None...

October 19, 2021—KB5006744 (OS Build 17763.2268) Preview

None None...

CVE-2021-25643

An issue was discovered in Couchbase Server 5.x and 6.x before 6.5.2 and 6.6.x before 6.6.2. Internal users with administrator privileges, @cbq-engine-cbauth and @index-cbauth, leak credentials in cleartext in the indexer.log file when they make a /listCreateTokens, /listRebalanceTokens, or...

CVE-2021-25643

An issue was discovered in Couchbase Server 5.x and 6.x before 6.5.2 and 6.6.x before 6.6.2. Internal users with administrator privileges, @cbq-engine-cbauth and @index-cbauth, leak credentials in cleartext in the indexer.log file when they make a /listCreateTokens, /listRebalanceTokens, or...