MAL-2022-1636 Malicious code in body-complex (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ef48c53ad39055a3692dbe528815988861df665507cc31c52dad47e5f746b3e3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Double Public Key Signing Function Oracle Attack on `ed25519-dalek`

Versions of ed25519-dalek prior to v2.0 model private and public keys as separate types which can be assembled into a Keypair, and also provide APIs for serializing and deserializing 64-byte private/public keypairs. Such APIs and serializations are inherently unsafe as the public key is one of th...

PT-2022-11738 · Totolink · Totolink Ex1200T

Name of the Vulnerable Software and Affected Versions: TOTOLINK EX1200T version 4.1.2cu.5215 Description: The issue allows an attacker to obtain sensitive information, such as wifikey, without authorization through the getSysStatusCfg function. Recommendations: For TOTOLINK EX1200T version...

FlightRadar24 安全漏洞

FlightRadar24 is a global flight tracking service from the US company FlightRadar24. Real-time information is available for thousands of airplanes around the world. A security vulnerability exists in FlightRadar24 for Android versions v8.9.0, v8.10.0, v8.10.2, v8.10.3, and v8.10.4, which can be...

GHSA-6WCR-WCQM-3MFH Django settings leak in date template filter

The getformat function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRETKEY...

F5 BIG-IP多款产品 安全漏洞

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing, etc. Several F5 BIG-IP products have security vulnerabilities that can be exploited by attackers to access certificate and key files from remote...

Security Bulletin: IBM InfoSphere Master Data Management is vulnerable to multiple OpenSSL vulnerabilities (CVE-2017-3738, CVE-2017-3737, CVE-2017-3736)

Summary IBM InfoSphere Master Data Management is vulnerable to multiple OpenSSL vulnerabilities that could cause the application to crash, an attacker to obtain information about the private key, or cause a denial of service. Vulnerability Details CVEID: CVE-2017-3738 DESCRIPTION: OpenSSL could...

Security Bulletin: IBM InfoSphere Master Data Management is vulnerable to multiple OpenSSL vulnerabilities (CVE-2016-7055, CVE-2017-3730, CVE-2017-3731, CVE-2017-3732)

Summary IBM InfoSphere Master Data Management is vulnerable to multiple OpenSSL vulnerabilities that could cause the application to crash, an attacker to obtain information about the private key, or cause a denial of service. Vulnerability Details CVEID: CVE-2017-3730 DESCRIPTION: OpenSSL is...

Convert2RHEL 信息泄露漏洞

Convert2RHEL is a tool. Automatically convert Oracle/CentOS/Scientific/Rocky/Alma Linux to Red Hat Enterprise Linux. Convert2RHEL suffers from a security vulnerability that stems from the application of the --activationkey option when used with convert2rhel, where the activation key is subsequent...

CVE-2022-26252

aaPanel v6.8.21 was discovered to be vulnerable to directory traversal. This vulnerability allows attackers to obtain the root user private SSH keyidrsa...

bouncycastle: Timing issue within the EC math library

A flaw was found in bouncycastle. A timing issue within the EC math library can expose information about the private key when an attacker is able to observe timing information for the generation of multiple deterministic ECDSA signatures...

VulnCheck KEV: CVE-2021-44207

Acclaim Systems USAHERDS contains a hard-coded credentials vulnerability that could allow an attacker to achieve remote code execution on the system that runs the application. The MachineKey must be obtained via a separate vulnerability or other channel...

CVE-2022-25244

Vault Enterprise clusters using the tokenization transform feature can expose the tokenization key through the tokenization key configuration endpoint to authorized operators with read permissions on this endpoint. Fixed in Vault Enterprise 1.9.4, 1.8.9 and 1.7.10...

PT-2022-17175 · Hashicorp · Vault Enterprise

Name of the Vulnerable Software and Affected Versions: Vault Enterprise versions prior to 1.7.10 Vault Enterprise versions prior to 1.8.9 Vault Enterprise versions prior to 1.9.4 Description: The issue affects Vault Enterprise clusters that use the tokenization transform feature, potentially...

Vault Enterprise’s Tokenization Transform Configuration Endpoint May Expose Transform Key

Summary Vault Enterprise “Vault” clusters using the tokenization transform feature can expose the tokenization key through the tokenization key configuration endpoint to authorized operators with read permissions on this endpoint. This vulnerability, CVE-2022-25244, was fixed in Vault Enterprise...

CVE-2022-24327

In JetBrains Hub before 2021.1.13890, integration with JetBrains Account exposed an API key with excessive permissions...

CVE-2022-24327

In JetBrains Hub before 2021.1.13890, integration with JetBrains Account exposed an API key with excessive permissions...

Bosch Amc2 信任管理问题漏洞

Bosch Amc2 is an access modular controller from Bosch, Germany. The Bosch AMC2 is vulnerable to a trust management issue vulnerability that arises from an attacker being able to retrieve a key from the firmware to decrypt network traffic between the AMC2 and the host system. As a result, an...

Renesas Electronics Renesas RX65和RX65N 安全漏洞

The Renesas Electronics Renesas Rx65 and Renesas Rx65N are both a mainstream Rx microcontroller from Renesas Electronics, Japan. The Renesas Electronics Renesas RX65 and RX65N devices have a security vulnerability that allows an attacker to extract a security ID key from the device via a VCC faul...

PortlandLabs Concrete Cms 代码问题漏洞

PortlandLabs Concrete Cms is an open source team-oriented content management system from PortlandLabs, Inc. PortlandLabs Concrete CMS is vulnerable to a code issue that could be exploited by attackers to obtain a Cloud IAAS AWS IAM key...