PYSEC-2022-43169

The Togglee package in PyPI version v0.0.8 was discovered to contain a code execution backdoor. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges...

CVE-2022-33001

The AAmiles package in PyPI v0.1.0 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges...

SUSE: Security Advisory (SUSE-SU-2022:2117-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Malicious code in kibana-buildkite-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 96b8915368d81f052cb059c635e8c9ac725f86e6f1369375961b9687be940b4e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-407 Malicious code in @maariv/fetlife-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 44152863a6191cb2b219d60ac5f87ffba9ed77691affb59704f78501bdbb0d1a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-25856

The package github.com/argoproj/argo-events/sensors/artifacts before 1.7.1 are vulnerable to Directory Traversal in the g GitArtifactReader.Read API in git.go. This could allow arbitrary file reads if the GitArtifactReader is provided a pathname containing a symbolic link or an implicit directory...

CVE-2022-25856 Directory Traversal

The package github.com/argoproj/argo-events/sensors/artifacts before 1.7.1 are vulnerable to Directory Traversal in the g GitArtifactReader.Read API in git.go. This could allow arbitrary file reads if the GitArtifactReader is provided a pathname containing a symbolic link or an implicit directory...

Huawei EulerOS: Security Advisory for flac (EulerOS-SA-2022-1838)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-24429

The package convert-svg-core before 0.6.3 are vulnerable to Arbitrary Code Injection when using a specially crafted SVG file. An attacker can read arbitrary files from the file system and then show the file content as a converted PNG file...

SUSE: Security Advisory (SUSE-SU-2022:2030-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Design/Logic Flaw

The package metacalc before 0.0.2 are vulnerable to Arbitrary Code Execution when it exposes JavaScript's Math class to the v8 context. As the Math class is exposed to user-land, it can be used to get access to JavaScript's Function constructor...

CVE-2021-3618 affecting package nginx for versions less than 1.20.2-2

CVE-2021-3618 affecting package nginx for versions less than 1.20.2-2. A patched version of the package is available...

16pixels (>=0.1.10, <=0.1.12), @3dlook/camera (>=2.1.0, <=2.2.0) +1120 more potentially affected by CVE-2022-29244 via npm (>=7.9.0, <=8.8.0)

npm NPM version =7.9.0, =0.1.10, =2.1.0, =5.0.5, =2.0.0, =1.0.0, =1.0.0-beta.2, =2.3.0, =1.0.0, =0.8.0, =1.2.0, =1.0.0, =1.0.0, =1.0.0, =3.0.0, =3.0.2 and more Source cves: CVE-2022-29244 Source advisory: OSV:GHSA-HJ9C-8JMM-8C52...

PT-2022-20466 · Bleve +1 · Bleve +1

Name of the Vulnerable Software and Affected Versions: Bleve affected versions not specified Description: The issue concerns the bleve/http package, which is used for demonstration purposes and lacks authentication, authorization, and validation of user inputs. This allows attackers to exploit a...

USN-5446-1: dpkg vulnerability

Max Justicz discovered that dpkg incorrectly handled unpacking certain source packages. If a user or an automated system were tricked into unpacking a specially crafted source package, a remote attacker could modify files outside the target unpack directory, leading to a denial of service or...

qlib Deserialization of Untrusted Data vulnerability

This affects all versions of package qlib. The workflow function in cli part of qlib was using an unsafe YAML load function...

Fedora: Security Advisory for golang-github-prometheus-tsdb (FEDORA-2022-08ae2dd481)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2021-23592

The package topthink/framework before 6.0.12 are vulnerable to Deserialization of Untrusted Data due to insecure unserialize method in the Driver class...

Huawei EulerOS: Security Advisory for openjpeg2 (EulerOS-SA-2022-1634)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-21227

The package sqlite3 before 5.0.3 are vulnerable to Denial of Service DoS which will invoke the toString function of the passed parameter. If passed an invalid Function object it will throw and crash the V8 engine...