CVE-2022-39287 Plaintext transmission of CSRF tokens in tiny-csrf

tiny-csrf is a Node.js cross site request forgery CSRF protection middleware. In versions prior to 1.1.0 cookies were not encrypted and thus CSRF tokens were transmitted in the clear. This issue has been addressed in commit 8eead6d and the patch with be included in version 1.1.0. Users are advise...

Oracle Primavera P6 Enterprise Project Portfolio Management (Jul 2022 CPU)

The versions of Primavera P6 Enterprise Project Portfolio Management installed on the remote host are affected by a vulnerability as referenced in the July 2022 CPU advisory. - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Centralized Third Party Jars...

Bifrost Licensing Issue Vulnerability

Bifrost is a middleware package that synchronizes MySQL MariaDB binary log data to other types of databases.Bifrost 1.8.6-release and earlier versions are vulnerable to authorization issues, which stem from its vulnerability to authentication bypass when using HTTP basic authentication, which can...

Nepxion Discovery Remote Code Execution Vulnerability

Nepxion Discovery is an enhanced middleware for service registration discovery for Spring Cloud. Nepxion Discovery 6.16.2 and earlier versions are vulnerable to a remote code execution vulnerability that stems from a lack of validation of input data in Discovery-commons and is susceptible to SpEL...

GHSA-P6FH-XC6R-G5HW Brokercap Bifrost subject to authentication bypass when using HTTP basic authentication

Bifrost is a middleware package which can synchronize MySQL/MariaDB binlog data to other types of databases. Versions 1.8.6-release and prior are vulnerable to authentication bypass when using HTTP basic authentication. This may allow group members who only have read permissions to write requests...

CVE-2022-39219

Bifrost is a middleware package which can synchronize MySQL/MariaDB binlog data to other types of databases. Versions 1.8.6-release and prior are vulnerable to authentication bypass when using HTTP basic authentication. This may allow group members who only have read permissions to write requests...

Authentication flaw

Bifrost is a middleware package which can synchronize MySQL/MariaDB binlog data to other types of databases. Versions 1.8.6-release and prior are vulnerable to authentication bypass when using HTTP basic authentication. This may allow group members who only have read permissions to write requests...

CVE-2022-39219 Bifrost users using basic authntication can bypass write permission limit

Bifrost is a middleware package which can synchronize MySQL/MariaDB binlog data to other types of databases. Versions 1.8.6-release and prior are vulnerable to authentication bypass when using HTTP basic authentication. This may allow group members who only have read permissions to write requests...

CVE-2022-39219

Summary: CVE-2022-39219 affects the Bifrost middleware (used to synchronize MySQL/MariaDB binlogs to other databases). Versions 1.8.6-release and earlier are vulnerable to an authentication bypass when HTTP basic authentication is used, potentially allowing a user with read permissions to perform...

Malicious Package

Overview middleware-sdk-s3 is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package...

Malicious Package

Overview middleware-bucket-endpoint is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if thi...

Exploit for Path Traversal in Oracle Weblogic_Server

Oracle-WebLogic-CVE-2022-21371 Oracle WebLogic Server Local F...

Oracle Business Intelligence Publisher (Jul 2022 CPU)

The version of Oracle Business Intelligence Publisher running on the remote host is 12.2.1.3.x prior to 12.2.1.3.220628, 12.2.1.4.x prior to 12.2.1.3.220628, It is, therefore, affected by multiple vulnerabilities as noted in the July 2022 Critical Patch Update advisory, including the following: -...

OmniAuth 安全漏洞

OmniAuth is an authentication system implemented using Rack middleware. A security vulnerability exists in OmniAuth versions prior to 2.0, which stems from lib/omniauth/failureendpoint.rb not escaping the messagekey value...

GLSA-202208-19 : aiohttp: Open redirect vulnerability

The remote host is affected by the vulnerability described in GLSA-202208-19 aiohttp: Open redirect vulnerability - aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In aiohttp before version 3.7.4 there is an open redirect vulnerability. A maliciously crafted link t...

Securing Azure middleware agents with new auto-patching capabilities

Wiz finds Azure customers remain unpatched from cloud middleware vulnerability and collaborates with Microsoft to introduce an auto-patching solution against cloud middleware security issues and make the cloud safer...

Revisiting OMI: Analysis of CVE-2022-29149, a privilege escalation vulnerability in Azure OMI

Affected organizations are required to update installed agents that use the OMI cloud middleware software...

GHSA-9X8M-2XPF-CRP3 Scrapy before 2.6.2 and 1.8.3 vulnerable to one proxy sending credentials to another

Impact When the built-in HTTP proxy downloader middleware processes a request with proxy metadata, and that proxy metadata includes proxy credentials, the built-in HTTP proxy downloader middleware sets the Proxy-Authentication header, but only if that header is not already set. There are...

Scrapy before 2.6.2 and 1.8.3 vulnerable to one proxy sending credentials to another

Impact When the built-in HTTP proxy downloader middleware processes a request with proxy metadata, and that proxy metadata includes proxy credentials, the built-in HTTP proxy downloader middleware sets the Proxy-Authentication header, but only if that header is not already set. There are...

py-Scrapy -- credentials leak vulnerability

When the built-in HTTP proxy downloader middleware processes a request with proxy metadata, and that proxy metadata includes proxy credentials, the built-in HTTP proxy downloader middleware sets the Proxy-Authentication header, but only if that header is not already set. There are third-party...