MAL-2022-837 Malicious code in activity-dropdown-legacy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 43b9b4388972bffdedfd3062dcd343e7b202606cdcddff2b5de1bf497b20d10d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

com.credibledoc:log-labelizer (>=1.0.40 <=1.0.51), com.github.gustavodsf:javers-persistence-mongo (>=5.15.0 <=5.16.0) +61 more potentially affected by CVE-2021-20328 via org.mongodb:mongodb-driver-legacy (>=4.1.0 <=4.1.1)

org.mongodb:mongodb-driver-legacy MAVEN version =4.1.0, =1.0.40, =5.15.0, =5.15.0, =5.15.0, =1.5, =1.5, =1.5, =1.5, =1.2.2, =1.2.2, =1.2.3 - dev.morphia.morphia:core =1.6.1 - dev.morphia.morphia:entityscanner-plug =1.6.1 - dev.morphia.morphia:guice-plug =1.6.1 - dev.morphia.morphia:logging-slf4j...

org.mongojack:mongojack (=2.10.1), org.openprovenance.prov:prov-service-translation (>=2.0.4 <=2.2.1) +6 more potentially affected by CVE-2021-20328 via org.mongodb:mongodb-driver-legacy (=3.11.0)

org.mongodb:mongodb-driver-legacy MAVEN version =3.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.mongodb:mongodb-driver-legacy and may be impacted: - org.mongojack:mongojack =2.10.1 - org.openprovenance.prov:prov-service-translation =2.0.4,...

com.airbus-cyber-security.graylog:graylog-plugin-aggregation-count (>=4.0.0 <=4.1.1), com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (>=4.0.0 <=4.5.0) +38 more potentially affected by CVE-2021-20328 via org.mongodb:mongodb-driver-legacy (>=3.12.0 <=3.12.7)

org.mongodb:mongodb-driver-legacy MAVEN version =3.12.0, =4.0.0, =4.0.0, =4.0.0, =4.0.1, =4.4.1 - com.github.rinoto.mongo:migramongo-core =1.4 - com.github.rinoto.mongo:migramongo-reflections =1.4 - com.github.rinoto.mongo:migramongo-spring =1.4 - com.github.rinoto.mongo:migramongo-spring-web =1....

com.imsweb:staging-algorithm-cs (=02.05.50.6), com.imsweb:staging-algorithm-eod-public (=2.0.7) +36 more potentially affected by CVE-2021-20328 via org.mongodb:mongodb-driver-legacy (>=4.0.0 <=4.0.5)

org.mongodb:mongodb-driver-legacy MAVEN version =4.0.0, =5.0.5, =5.0.0, =4.0.0, =4.0.0, =1.6.0, =1.6.0, =1.6.0, =1.6.0, =2.0.0, =2.1.7 and more Source cves: CVE-2021-20328 Source advisory: OSV:GHSA-RGHW-6PX2-FGWC...

com.coditory.sherlock:sherlock-mongo-sync (=0.4.3), com.hazelcast.jet.contrib:mongodb (=0.2) +22 more potentially affected by CVE-2021-20328 via org.mongodb:mongodb-driver-sync (>=3.11.0 <=3.11.2)

org.mongodb:mongodb-driver-sync MAVEN version =3.11.0, =0.0.1, =2.1.18, =2.1.18, =2.1.18, =2.0.0, =2.0.0, =2.0.0, =5.0.20.RC, =1.6.1, =3.11.0, =3.11.2 - org.mongojack:mongojack =2.10.1 and more Source cves: CVE-2021-20328 Source advisory: OSV:GHSA-RGHW-6PX2-FGWC...

GHSA-C7JJ-VFMR-J9MJ Moodle command execution vulnerability exists in the default legacy spellchecker plugin

A command execution vulnerability exists in the default legacy spellchecker plugin in a few Moodle multiple specific versions. A specially crafted series of HTTP requests can lead to command execution. An attacker must have administrator privileges to exploit this vulnerabilities...

Moodle command execution vulnerability exists in the default legacy spellchecker plugin

A command execution vulnerability exists in the default legacy spellchecker plugin in a few Moodle multiple specific versions. A specially crafted series of HTTP requests can lead to command execution. An attacker must have administrator privileges to exploit this vulnerabilities...

GHSA-54P5-GXQ6-J98G eZ Publish Kernel and Legacy Unrestricted Upload of File with Dangerous Type

eZ Publish Kernel before 5.4.14.1, 6.x before 6.13.6.2, and 7.x before 7.5.6.2 and eZ Publish Legacy before 5.4.14.1, 2017 before 2017.12.7.2, and 2019 before 2019.03.4.2 allow remote attackers to execute arbitrary code by uploading PHP code, unless the vhost configuration permits only app.php...

Security Bulletin: SLOTH - Weak MD5 Signature Hash vulnerability may affect DS8000

Summary SLOTH - Weak MD5 Signature Hash vulnerability may affect DS8000 CVE-2015-7575 Vulnerability Details CVEID: CVE-2015-7575 DESCRIPTION: The TLS protocol could allow weaker than expected security caused by a collision attack when using the MD5 hash function for signing a ServerKeyExchange...

GHSA-VCR8-H8QP-QJ8H Cross-Site Request Forgery in Jenkins

Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did not expire and could be used to bypass CSRF protection for the anonymous user...

OPC UA Legacy Java Stack Denial of Service Vulnerability

OPC UA Legacy Java Stack is a legacy support for the Java version of OPC UA from the OPC Foundation in the U.S. A denial of service vulnerability exists in OPC UA Legacy Java Stack version 2022-04-01, which stems from improper handling of a large number of message requests, and could be exploited...

CVE-2022-30551

OPC UA Legacy Java Stack 2022-04-01 allows a remote attacker to cause a server to stop processing messages by sending crafted messages that exhaust available resources...

CVE-2022-30551

OPC UA Legacy Java Stack 2022-04-01 allows a remote attacker to cause a server to stop processing messages by sending crafted messages that exhaust available resources...

CVE-2022-30551

OPC UA Legacy Java Stack 2022-04-01 allows a remote attacker to cause a server to stop processing messages by sending crafted messages that exhaust available resources...

CVE-2022-30551

CVE-2022-30551 affects OPC UA Legacy Java Stack (version 2022-04-01). A remote attacker can send crafted OPC UA messages that exhaust server resources, causing the server to stop processing messages (DoS). The related records (Red Hat, CNVD, NVD, ZDI) describe the same denial-of-service impact an...

CVE-2022-30551

OPC UA Legacy Java Stack 2022-04-01 allows a remote attacker to cause a server to stop processing messages by sending crafted messages that exhaust available resources...

OPC UA Legacy Java Stack 资源管理错误漏洞

OPC UA Legacy Java Stack is a legacy support for the Java version of OPC UA from the OPC Foundation in the U.S. A denial of service vulnerability exists in OPC UA Legacy Java Stack version 2022-04-01, which stems from improper handling of a large number of message requests, and could be exploited...

Google TensorFlow输入验证错误漏洞

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. An input validation error vulnerability exists in TensorFlow versions prior to 2.9.0, 2.8.1, 2.7.2, and 2.6.4, which stems from the fact that tf.rawops.UnsortedSegmentJoin does not fully validat...

The vulnerability of the reverse-trigger function of the System Management Interrupt (SMI) driver for Legacy BIOS notebook computers of Lenovo allows a hacker to execute arbitrary code with elevated privileges.

The vulnerability of the reverse-trigger function of the System Management Interrupt SMI driver for Legacy BIOS notebook computers of Lenovo is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker to execute arbitrary code with elevated privileges...