MAL-2022-5202 Malicious code in pancake-info-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0443a608b4568e8dc8b0e39a3b58804dac2a63c570a30f7752c5ca6ba41ce8d2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pancake-info-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0443a608b4568e8dc8b0e39a3b58804dac2a63c570a30f7752c5ca6ba41ce8d2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

RHEL 8 : kernel-rt (RHSA-2022:5934)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:5934 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Securi...

PT-2022-4340 · Microsoft · Visual Studio Code

Name of the Vulnerable Software and Affected Versions: Visual Studio Code affected versions not specified Description: The issue is related to insufficient input validation in the Visual Studio Code editor. This can be exploited by a remote attacker to execute arbitrary code. Recommendations: At...

CVE-2022-33733

Sensitive information exposure in onCharacteristicRead in Charm by Samsung prior to version 1.2.3 allows attacker to get bluetooth connection information without permission...

xorg-x11-server: out-of-bounds access in ProcXkbSetDeviceInfo request handler of the Xkb extension

A flaw was found in the Xorg-x11-server. The specific flaw exists within the handling of ProcXkbSetDeviceInfo requests. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated buffer. This flaw allows an attacker...

CVE-2022-31612

NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer nvlddmkm.sys handler for DxgkDdiEscape, where a local user with basic capabilities can cause an out-of-bounds read, which may lead to a system crash or a leak of internal kernel information...

AMD CPU Information Disclosure Vulnerability (AMD-SB-1038, Hertzbleed)

The AMD CPU on the remote host might be prone to an information disclosure vulnerability dubbed Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

fmpl.catalog.aspencat.info Cross Site Scripting vulnerability OBB-2823492

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Messaging Apps Tapped as Platform for Cybercriminal Activity

Cybercriminals are tapping the built-in services of popular messaging apps like Telegram and Discord as ready-made platforms to help them perform their nefarious activity in persistent campaigns that threaten users, researchers have found. Threat actors are tapping the multi-feature nature of...

CVE-2022-36910

Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to reindex the database and to obtain information about jobs otherwise inaccessible to them...

DEBIAN-CVE-2022-1671

A NULL pointer dereference flaw was found in rxrpcpreparses in net/rxrpc/serverkey.c in the Linux kernel. This flaw allows a local attacker to crash the system or leak internal kernel information...

AZL-10400 CVE-2022-1671 affecting package kernel for versions less than 5.15.67.1-4

A NULL pointer dereference flaw was found in rxrpcpreparses in net/rxrpc/serverkey.c in the Linux kernel. This flaw allows a local attacker to crash the system or leak internal kernel information...

CVE-2022-35286

CVE-2022-35286 affects IBM Security Verify Information Queue (ISIQ) 10.0.2. The vulnerability is a cross-site request forgery (CSRF) in the web UI that could allow an attacker to perform malicious, unauthorized actions on behalf of a trusted user. The root cause relates to insufficient request ve...

SmokeLoader Infecting Targeted Systems with Amadey Info-Stealing Malware

An information-stealing malware called Amadey is being distributed by means of another backdoor called SmokeLoader. The attacks hinge on tricking users into downloading SmokeLoader that masquerades as software cracks, paving the way for the deployment of Amadey, researchers from the AhnLab Securi...

CVE-2022-35284

IBM Security Verify Information Queue 10.0.2 could disclose sensitive information due to a missing or insecure SameSite attribute for a sensitive cookie. IBM X-Force ID: 230811...

CVE-2022-35285

The CVE-2022-35285 entry concerns IBM Security Verify Information Queue (ISIQ) v10.0.2, where the Audit Events UI is vulnerable due to a SQL injection flaw that can be exploited to facilitate cross-site request forgery, enabling an attacker to perform unauthorized actions that the trusted user in...

CVE-2022-35284

IBM Security Verify Information Queue (ISIQ) 10.0.2 is vulnerable to information disclosure due to a missing/insecure SameSite attribute on a sensitive cookie. The issue affects ISIQ 10.0.2 and is addressed by upgrading to ISIQ 10.0.3 or newer. The lack of SameSite disables CSRF protections for t...

CVE-2022-35284

IBM Security Verify Information Queue 10.0.2 could disclose sensitive information due to a missing or insecure SameSite attribute for a sensitive cookie. IBM X-Force ID: 230811...

Racoon Stealer is Back — How to Protect Your Organization

The Racoon Stealer malware as a service platform gained notoriety several years ago for its ability to extract data that is stored within a Web browser. This data initially included passwords and cookies, which sometimes allow a recognized device to be authenticated without a password being...