Malicious code in usaa-messaging (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fd012b535136d3f4c9da2e2f1df5e910eab7ba2508205a6db84dbf34e5ededd7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6845 Malicious code in usaa-messaging (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fd012b535136d3f4c9da2e2f1df5e910eab7ba2508205a6db84dbf34e5ededd7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Authorization Bypass

github.com/edgexfoundry/edgex-go and github.com/edgexfoundry/device-sdk-go are vulnerable to authorization bypass. The vulnerability exists in BootstrapHandler function in messaging.go because it doesn't remove MessageBus Options data from configuration after creating a message client which allow...

Security update for chromium (important)

openSUSE Security Update: Security update for chromium Announcement ID: openSUSE-SU-2022:10005-1 Rating: important References: 1199893 Cross-References: CVE-2022-1853 CVE-2022-1854 CVE-2022-1855 CVE-2022-1856 CVE-2022-1857 CVE-2022-1858 CVE-2022-1859 CVE-2022-1860 CVE-2022-1861 CVE-2022-1862...

Security update for chromium (critical)

openSUSE Security Update: Security update for chromium Announcement ID: openSUSE-SU-2022:10009-1 Rating: critical References: 1199893 1200139 1200423 Cross-References: CVE-2022-1853 CVE-2022-1854 CVE-2022-1855 CVE-2022-1856 CVE-2022-1857 CVE-2022-1858 CVE-2022-1859 CVE-2022-1860 CVE-2022-1861...

CVE-2022-25167

Apache Flume versions 1.4.0 through 1.9.0 are vulnerable to a remote code execution RCE attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI to allow only the use of the java...

Apache Flume 安全漏洞

Apache Flume is a distributed, reliable and available service from the Apache Foundation. A remote code execution vulnerability exists in Apache Flume, which stems from the configuration of a JMS source with a JNDI LDAP data source URI, and could be exploited by an attacker to cause a remote code...

The vulnerability of the messaging component in Microsoft Edge and Google Chrome browsers allows a hacker to execute arbitrary code.

The vulnerability of the messaging component in Microsoft Edge and Google Chrome relates to the use of memory after it is freed. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially created web page from a remote location...

CVE-2022-26491

An issue was discovered in Pidgin before 2.14.9. A remote attacker who can spoof DNS responses can redirect a client connection to a malicious server. The client will perform TLS certificate verification of the malicious domain name instead of the original XMPP service domain, allowing the attack...

CVE-2022-31013

Chat Server (Vartalap) vulnerability CVE-2022-31013 affects versions 2.3.2–2.6.0. Root cause is a token validation bug where this.authProvider.verifyAccessKey is treated as asynchronous without awaiting results, enabling authentication bypass. A patch exists in version 2.6.0. Public references ac...

Chromium: CVE-2022-1855 Use after free in Messaging

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Microsoft Edge (Chromium) < 102.0.1245.30 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 102.0.1245.30. It is, therefore, affected by multiple vulnerabilities as referenced in the May 31, 2022 advisory. - Microsoft Edge Chromium-based Elevation of Privilege Vulnerability. This CVE ID is unique from...

Use After Free

chromium is vulnerable to use-after-free. The vulnerability exists in messaging which allows an attacker to cause a heap corruption and leading to an application crash...

Updated chromium-browser-stable packages fix security vulnerability

The chromium-browser-stable package has been updated to the 102.0.5005.61 version, fixing many bugs and 32 CVE. Some of them are listed below: CVE-2022-1853: Use after free in Indexed DB. CVE-2022-1854: Use after free in ANGLE. CVE-2022-1855: Use after free in Messaging. CVE-2022-1856: Use after...

Google Chrome Messaging Component Memory Misreference Vulnerability

Google Chrome is a web browser from Google, an American company. A memory misreference vulnerability exists in the Messaging component of Google Chrome versions prior to 102.0.5005.61, which arises from a mix-up in the instructions responsible for freeing memory in the Messaging component program...

Moodle Client side denial of service via personal message

It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that messaging did not impose a character limit when sending messages, which could result in client-side browser denial of service for users receiving very large messages...

GHSA-C3J6-33R4-89Q3 Moodle Client side denial of service via personal message

It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that messaging did not impose a character limit when sending messages, which could result in client-side browser denial of service for users receiving very large messages...

GHSA-C3R5-VXJ6-62MC Jenkins Google Cloud Messaging Notification Plugin stores credentials in plain text

Jenkins Google Cloud Messaging Notification Plugin 1.0 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...

Jenkins Google Cloud Messaging Notification Plugin stores credentials in plain text

Jenkins Google Cloud Messaging Notification Plugin 1.0 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...

GHSA-WW45-X87C-WGFF Moodle all messaging conversations could be viewed

A flaw was found in Moodle before versions 3.7, 3.6.4. A web service fetching messages was not restricted to the current user's conversations...