Malicious code in testforconfusion (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0463d945d1cd3398ce2594034fd52775ac94fe411f1cc645f88f757522abfc1b The OpenSSF Package Analysis project identified 'testforconfusion' @ 1.1.0 npm as malicious. It is considered malicious because: - The package...

PT-2023-21989 · Unknown · Concrete Cms

Name of the Vulnerable Software and Affected Versions: Concrete CMS previously concrete5 versions prior to 9.1 Description: The issue concerns stored XSS in the RSS Displayer via the href attribute. This occurs because the link element input was not sanitized, allowing for potential exploitation...

PT-2023-21990 · Unknown · Concrete Cms

Name of the Vulnerable Software and Affected Versions: Concrete CMS previously concrete5 versions prior to 9.1 Description: The issue is related to the lack of a rate limit for password resets in Concrete CMS. This could potentially allow for brute-force attacks on user passwords. Recommendations...

PortlandLabs Concrete CMS 跨站脚本漏洞

PortlandLabs Concrete CMS is a team-oriented open source content management system from PortlandLabs, Inc. in the United States. A security vulnerability exists in PortlandLabs Concrete CMS versions prior to 9.1. An attacker could exploit this vulnerability to perform cross-site scripting attacks...

DEBIAN-CVE-2023-0458

A speculative pointer dereference problem exists in the Linux Kernel on the doprlimit function. The resource argument value is controlled and is used in pointer arithmetic for the 'rlim' variable and can be used to leak the contents. We recommend upgrading past version 6.1.8 or...

PT-2023-22615 · Cltphp · Cltphp

Name of the Vulnerable Software and Affected Versions: CLTPHP versions prior to 6.1 Description: The issue allows for Directory Traversal. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited...

PYSEC-2023-36

Cross-Site Request Forgery CSRF in GitHub repository modoboa/modoboa prior to 2.1.0...

Dell Display Manager 安全漏洞

Dell Display Manager is a Windows application from Dell, Inc. It is used to manage a monitor or a group of monitors. A security vulnerability exists in Dell Display Manager version 2.1.0 and prior versions. An attacker could exploit this vulnerability to execute arbitrary code...

UBUNTU-CVE-2023-21990

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 6.1.44 and Prior to 7.0.8. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox...

PYSEC-2023-34

Weak Password Requirements in GitHub repository modoboa/modoboa prior to 2.1.0...

Oracle Virtualization 安全漏洞

Oracle Virtualization is a suite of virtualization solutions from Oracle. The product is used to unify the management of the entire hardware and software architecture from applications to disk, enabling virtualization from the desktop to the data center. A security vulnerability exists in the Cor...

Oracle Virtualization 安全漏洞

Oracle Virtualization is a set of virtualization solutions from Oracle Corporation. The product is used to unify the management of the entire hardware and software architecture from applications to disks, enabling virtualization from the desktop to the data center.VM VirtualBox is one of the...

Vitess 安全漏洞

Vitess is a database clustering system for horizontally scaling MySQL from Vitess. A security vulnerability exists in Vitess versions prior to 16.0.1 that stems from an error message received by anyone attempting to view keyspaces from VTAdmin...

TiKV 安全漏洞

TiKV is an open source, distributed and transactional key-value database from TiKV Open Source. A security vulnerability exists in TiKV version 6.1.2, which can be exploited by a remote attacker to attempt to start a node beyond the context deadline, resulting in a denial of service...

CVE-2023-22235

InCopy versions 18.1 and earlier, 17.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

ShipStation 安全漏洞

ShipStation is an e-commerce retail order carrier processing and shipping software from ShipStation. A security vulnerability exists in ShipStation version 1.1 and prior versions that stems from unchecked access to an endpoint, allowing a remote attacker to insert arbitrary information into the...

LiveAction LiveSP 跨站脚本漏洞

LiveAction LiveSP is a network monitoring software for service providers from LiveAction. A security vulnerability exists in LiveAction LiveSP version v21.1.2. An attacker can exploit the vulnerability to execute arbitrary web script or HTML...

PT-2023-4016 · Ibm · Ibm Db2

Name of the Vulnerable Software and Affected Versions: IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server versions 10.5, 11.1, and 11.5 Description: The issue is related to insufficient input validation in the database management system, which can be exploited by a remote attacker to...

NVIDIA GPU Display Driver for Windows 安全漏洞

NVIDIA GPU Display Driver for Windows is a driver software from NVIDIA Corporation that is used for interactive support of graphics card display modules in Windows systems. A security vulnerability exists in NVIDIA GPU Display Driver that originates from not properly checking memory permissions,...

NVIDIA GPU Display Driver for Linux 缓冲区错误漏洞

NVIDIA GPU Display Driver for Linux is a driver from NVIDIA Corporation that is used for interactive support of graphics card display modules in Linux systems. A security vulnerability exists in NVIDIA GPU Display Driver that originates from the presence of an out-of-bounds write, which could lea...