[SECURITY] Fedora 36 Update: mqttcli-0.2.3-3.fc36

mqttcli provides two programs pub and sub that allow command-line access to an MQTT broker. sub subscribes to a topic and prints messages received to standard output. pub publishes the provided message to the provided topic. Both programs accept flags that can be provided as a config file...

Security Bulletin: A Remote Attack Vulnerability in Apache Log4j affects IBM Engineering Lifecycle Optimization - Publishing

Summary There is a Vulnerability in Apache Log4j CVE-2021-44228 which is used by "IBM Engineering Lifecycle Optimization - Publishing PUB" and "Rational Publishing Engine RPE." Vulnerability Details CVEID:CVE-2021-44228 DESCRIPTION: Apache Log4j could allow a remote attacker to execute arbitrary...

philspubandeatery.com Cross Site Scripting vulnerability OBB-2753115

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

[SECURITY] Fedora 36 Update: mqttcli-0.2.3-2.fc36

mqttcli provides two programs pub and sub that allow command-line access to an MQTT broker. sub subscribes to a topic and prints messages received to standard output. pub publishes the provided message to the provided topic. Both programs accept flags that can be provided as a config file...

MAL-2022-4906 Malicious code in nodejs-gcloud-pubsub-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 40eb63d0a4ed52650bf16d9a4d3a4cc2a9e305ba71dadfa7f7276be2f36ab743 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Arbitrary File Upload

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Arbitrary File Upload via improper validation of uploaded files in the pub/media directory. An attacker with admin privileges can execute arbitrary code on the server by...

GHSA-MX5M-J5XR-JG8C Magento vulnerable to file upload attack

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an improper input validation vulnerability. An attacker with admin privileges could upload a specially crafted file in the 'pub/media directory could lead to remote code execution...

Magento vulnerable to file upload attack

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an improper input validation vulnerability. An attacker with admin privileges could upload a specially crafted file in the 'pub/media directory could lead to remote code execution...

PT-2022-37722

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an improper input validation vulnerability. An attacker with admin privileges could upload a specially crafted file in the 'pub/media directory could lead to remote code execution...

[SECURITY] Fedora 34 Update: redis-6.2.7-1.fc34

Redis is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing se...

PUB-A-204012850

Bulletin has no description...

Mastodon 安全漏洞

Mastodon is an open source social network server based on ActivityPub. Mastodon suffers from a security vulnerability that stems from incorrect access control, as it does not compress incoming signed JSON-LD activities...

CVE-2021-22568

When using the dart pub publish command to publish a package to a third-party package server, the request would be authenticated with an oauth2 accesstoken that is valid for publishing on pub.dev. Using these obtained credentials, an attacker can impersonate the user on pub.dev. We recommend...

CVE-2021-22568

When using the dart pub publish command to publish a package to a third-party package server, the request would be authenticated with an oauth2 accesstoken that is valid for publishing on pub.dev. Using these obtained credentials, an attacker can impersonate the user on pub.dev. We recommend...

CVE-2021-22568

When using the dart pub publish command to publish a package to a third-party package server, the request would be authenticated with an oauth2 accesstoken that is valid for publishing on pub.dev. Using these obtained credentials, an attacker can impersonate the user on pub.dev. We recommend...

Design/Logic Flaw

When using the dart pub publish command to publish a package to a third-party package server, the request would be authenticated with an oauth2 accesstoken that is valid for publishing on pub.dev. Using these obtained credentials, an attacker can impersonate the user on pub.dev. We recommend...

CVE-2021-22568

When using the dart pub publish command to publish a package to a third-party package server, the request would be authenticated with an oauth2 accesstoken that is valid for publishing on pub.dev. Using these obtained credentials, an attacker can impersonate the user on pub.dev. We recommend...

PT-2021-15145

Name of the Vulnerable Software and Affected Versions Dart SDK versions prior to 2.15.0 Description The issue arises when using the dart pub publish command to publish a package to a third-party package server. The request is authenticated with an oauth2 access token that is valid for publishing ...

CVE-2021-22568: Exposure of Resource to Wrong Sphere

When using the dart pub publish command to publish a package to a third-party package server, the request would be authenticated with an oauth2 accesstoken that is valid for publishing on pub.dev. Using these obtained credentials, an attacker can impersonate the user on pub.dev. We recommend...

Dart 信任管理问题漏洞

Dart is an open source programming language. The Dart SDK has a security vulnerability in that when a package is published to a third-party package server using the dart pub publish command, the request is authenticated using the oauth2 accesstoken, which is valid for publishing on pub.dev. Using...