Chromium: CVE-2022-2161 Use after free in WebApp Provider

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

The vulnerability of the network provider for Kubernetes based on OVN (Open Virtual Network) OVN-Kubernetes is related to insufficient input validation. This allows attackers to exploit the protected information or exert other unauthorized actions.

The vulnerability of the network provider for Kubernetes based on OVN Open Virtual Network involves insufficient input validation. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information or carry out other malicious actions...

DoS through large manifest files in Argo CD

Impact All versions of Argo CD starting with v0.7.0 are vulnerable to an uncontrolled memory consumption bug, allowing an authorized malicious user to crash the repo-server service. The repo-server is a critical component of Argo CD, so crashing the repo-server effectively denies core Argo CD...

Google Chrome 资源管理错误漏洞

Google Chrome is a web browser from Google, Inc. A security vulnerability exists in Google Chrome that originates from the reuse of the WebApp Provider after release...

Malicious code in multiplesegmentsprovider (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 48ce3cb677969016d45f44ec99b19a4cf03fbfddaa08f3f3cd56773134a344b5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @devcrypto/hdwallet-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb6c342f8e6a7cd8a466ebc7792b62d2d49e25941b6962a70b3f7032d9ace8b2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-201 Malicious code in @devcrypto/hdwallet-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb6c342f8e6a7cd8a466ebc7792b62d2d49e25941b6962a70b3f7032d9ace8b2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-326 Malicious code in @harrysforge/token-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dfd47954ee42f44c41fcbdf84b0e583b156ecbd9b04f6b280ad4fd16b1c355a4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @harrysforge/token-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dfd47954ee42f44c41fcbdf84b0e583b156ecbd9b04f6b280ad4fd16b1c355a4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6322 Malicious code in strapi-provider-upload-aws-s3-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f1d24b53a4fdd8c047f1239905fddd51ae8f1cb40bc6e5de7f014a3c4d9595aa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in strapi-provider-upload-aws-s3-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f1d24b53a4fdd8c047f1239905fddd51ae8f1cb40bc6e5de7f014a3c4d9595aa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in os-wallet-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 809a0f7159a18eb447e3b374144112c1066ceb931be5dd5231cb4532c4dfcdbc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5126 Malicious code in os-wallet-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 809a0f7159a18eb447e3b374144112c1066ceb931be5dd5231cb4532c4dfcdbc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in node-config-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6245de88dda255b54977801c4cb54ca206cf3e832670277220fba95bf3707455 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4881 Malicious code in node-config-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6245de88dda255b54977801c4cb54ca206cf3e832670277220fba95bf3707455 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-683 Malicious code in @uc-maps/provider-google.react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 96b2ee3e9a228c29b1fa9a48eab565e4eee93260225f30d535417f36ee2b48d6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

0xsodium (>=0.2.0 <=0.14.0), 1password-config (=0.0.1) +11415 more potentially affected by CVE-2022-32210 via undici (>=4.9.3 <=5.4.0)

undici NPM version =4.9.3, =0.2.0, =1.0.0, =0.2.0, =0.4.0, =0.1.0, =0.0.1, =1.0.21, =2.1.0, =2.1.0, =2.1.0, =2.1.1 and more Source cves: CVE-2022-32210 Source advisory: OSV:GHSA-PGW7-WX7W-2W33...

CVE-2022-33140

The optional ShellUserGroupProvider in Apache NiFi 1.10.0 to 1.16.2 and Apache NiFi Registry 0.6.0 to 1.16.2 does not neutralize arguments for group resolution commands, allowing injection of operating system commands on Linux and macOS platforms. The ShellUserGroupProvider is not included in the...

CVE-2022-20137

In onCreateContextMenu of NetworkProviderSettings.java, there is a possible way for non-owner users to change WiFi settings due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Produc...

Siemens Mendix SAML Module跨站脚本漏洞

The Mendix SAML Module allows authentication of users in cloud applications using SAML. The module can communicate with any identity provider that supports SAML 2.0 or Shibboleth. A cross-site scripting vulnerability exists in Siemens Mendix SAML Module, which can be exploited by attackers to...