net.liftweb:lift-couchdb_2.8.0 (2.3), net.liftweb:lift-facebook_2.8.0 (2.3) +15 more potentially affected by CVE-2013-3300 via net.liftweb:lift-webkit_2.8.0 (2.3)

net.liftweb:lift-webkit2.8.0 MAVEN version 2.3 is affected by a known vulnerability. The following packages have a transitive dependency on net.liftweb:lift-webkit2.8.0 and may be impacted: - net.liftweb:lift-couchdb2.8.0 2.3 - net.liftweb:lift-facebook2.8.0 2.3 - net.liftweb:lift-jpa2.8.0 2.3 -...

net.liftweb:lift-couchdb_2.8.0 (2.4-m4), net.liftweb:lift-facebook_2.8.0 (2.4-m4) +15 more potentially affected by CVE-2013-3300 via net.liftweb:lift-webkit_2.8.0 (2.4-m4)

net.liftweb:lift-webkit2.8.0 MAVEN version 2.4-m4 is affected by a known vulnerability. The following packages have a transitive dependency on net.liftweb:lift-webkit2.8.0 and may be impacted: - net.liftweb:lift-couchdb2.8.0 2.4-m4 - net.liftweb:lift-facebook2.8.0 2.4-m4 - net.liftweb:lift-jpa2.8...

net.liftweb:lift-couchdb_2.8.0 (2.4-rc1), net.liftweb:lift-facebook_2.8.0 (2.4-rc1) +15 more potentially affected by CVE-2013-3300 via net.liftweb:lift-webkit_2.8.0 (2.4-rc1)

net.liftweb:lift-webkit2.8.0 MAVEN version 2.4-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on net.liftweb:lift-webkit2.8.0 and may be impacted: - net.liftweb:lift-couchdb2.8.0 2.4-rc1 - net.liftweb:lift-facebook2.8.0 2.4-rc1 -...

net.liftweb:lift-facebook_2.9.0-1 (2.4-m1), net.liftweb:lift-jpa_2.9.0-1 (2.4-m1) +14 more potentially affected by CVE-2013-3300 via net.liftweb:lift-webkit_2.9.0-1 (2.4-m1)

net.liftweb:lift-webkit2.9.0-1 MAVEN version 2.4-m1 is affected by a known vulnerability. The following packages have a transitive dependency on net.liftweb:lift-webkit2.9.0-1 and may be impacted: - net.liftweb:lift-facebook2.9.0-1 2.4-m1 - net.liftweb:lift-jpa2.9.0-1 2.4-m1 -...

net.liftweb:lift-facebook_2.9.0-1 (2.4-m3), net.liftweb:lift-jpa_2.9.0-1 (2.4-m3) +14 more potentially affected by CVE-2013-3300 via net.liftweb:lift-webkit_2.9.0-1 (2.4-m3)

net.liftweb:lift-webkit2.9.0-1 MAVEN version 2.4-m3 is affected by a known vulnerability. The following packages have a transitive dependency on net.liftweb:lift-webkit2.9.0-1 and may be impacted: - net.liftweb:lift-facebook2.9.0-1 2.4-m3 - net.liftweb:lift-jpa2.9.0-1 2.4-m3 -...

net.liftweb:lift-facebook_2.9.0 (2.4-m1), net.liftweb:lift-jpa_2.9.0 (2.4-m1) +14 more potentially affected by CVE-2013-3300 via net.liftweb:lift-webkit_2.9.0 (2.4-m1)

net.liftweb:lift-webkit2.9.0 MAVEN version 2.4-m1 is affected by a known vulnerability. The following packages have a transitive dependency on net.liftweb:lift-webkit2.9.0 and may be impacted: - net.liftweb:lift-facebook2.9.0 2.4-m1 - net.liftweb:lift-jpa2.9.0 2.4-m1 - net.liftweb:lift-ldap2.9.0...

Cisco Enterprise NFV Infrastructure Software Arbitrary Command Execution

The vulnerability of the Cisco Enterprise NFV Infrastructure Software NFVIS software registration process is related to lack of access control. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands by installing a virtual machine with created metadata...

Malicious code in @epc-infra/region-only-policy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 03aeca5ad9dc6bebb0249d07c948fc2913ba7b25fdc41cea4a5c78c8bf672958 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in com.unity.render-pipelines.high-definition-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c67f837ca8ea83c83003168af81c90f02e07a73994e832484930baf383acb5b9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Ransom.Conti MVID-2022-0602 Code Execution

Discovery / credits: Malvuln John Page aka hyp3rlinx c 2022 Original source: https://malvuln.com/advisory/7ba20fce7ac259f6062f73290c2e28cf.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Ransom.Conti Vulnerability: Code Execution Description: Conti looks for and executes DLLs ...

Xtend Cross-Site Scripting Vulnerability

Xtend is a general-purpose high-level programming language for the Eclipse Foundation's Java Virtual Machine. Xtend Voice Logger version 1.0 has a security vulnerability that stems from a cross-site scripting vulnerability in the error page. An attacker can use the vulnerability to execute...

Ransom.Conti MVID-2022-0603 Code Execution

Discovery / credits: Malvuln John Page aka hyp3rlinx c 2022 Original source: https://malvuln.com/advisory/6748dfe8e64dea2fc4c14691f7e766c6.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Ransom.Conti Vulnerability: Code Execution Description: Conti looks for and executes DLLs ...

GHSA-CCMR-QJ26-845G Improper Restriction of XML External Entity Reference in Elasticsearch

Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's findfilestructure API. If a policy allowing external network access has been added to Elasticsearch's Java Security Manager then an attacker could send a specially crafted request capable of leaking content ...

Improper Restriction of XML External Entity Reference in Elasticsearch

Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's findfilestructure API. If a policy allowing external network access has been added to Elasticsearch's Java Security Manager then an attacker could send a specially crafted request capable of leaking content ...

express-cart unrestricted file upload vulnerability

Unrestricted file upload RCE in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine...

GHSA-4W62-CQ5R-5MMQ express-cart unrestricted file upload vulnerability

Unrestricted file upload RCE in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine...

Elasticsearch subject to cross site scripting

X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting XSS vulnerability. If an attacker is able to inject data into an index that has a ML job running against it, then when another user views the results of the ML job it could allow the attacker to obtain sensitive...

GHSA-MJPC-QX7H-R8C9 Elasticsearch subject to cross site scripting

X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting XSS vulnerability. If an attacker is able to inject data into an index that has a ML job running against it, then when another user views the results of the ML job it could allow the attacker to obtain sensitive...

GHSA-WRGW-V987-5QMW Jenkins CloudShare Docker-Machine Plugin stores credentials in plain text

Jenkins CloudShare Docker-Machine Plugin stores credentials unencrypted in its global configuration file com.cloudshare.jenkins.CloudShareConfiguration.xml on the Jenkins controller. These credentials can be viewed by users with access to the Jenkins controller file system...

Jenkins CloudShare Docker-Machine Plugin stores credentials in plain text

Jenkins CloudShare Docker-Machine Plugin stores credentials unencrypted in its global configuration file com.cloudshare.jenkins.CloudShareConfiguration.xml on the Jenkins controller. These credentials can be viewed by users with access to the Jenkins controller file system...