MAL-2025-80 Malicious code in controller-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 34e748f33e1982598d357d378cb8b42a4361f9a056afdd2c66b16586e034fe41 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cokie-secret (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4bf6e44e11cb2ca8f7463f86029c79bfca1f5b6f1e333073ef26716d12f86a3c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-48859

An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following versions: QTS 5.1.9.2954 bui...

The vulnerability of the SAP NetWeaver AS Java software integration platform lies in the absence of authentication procedures, which allows attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of SAP NetWeaver AS Java software-based integration platforms is related to the absence of authentication procedures. Exploiting this vulnerability allows a malicious actor to remotely compromise the confidentiality and integrity of the protected information...

The vulnerability in web browsers Firefox ESR, Firefox, and the email client Thunderbird relates to deficiencies in access control, allowing attackers to compromise data integrity.

The vulnerabilities of Firefox ESR, Firefox, and the email client Thunderbird are related to deficiencies in access control. Exploiting these vulnerabilities can allow a malicious actor to compromise data integrity remotely...

K000148483: libssh vulnerabilities CVE-2019-14889 and CVE-2023-3603

Security Advisory Description CVE-2019-14889 A flaw was found with the libssh API function sshscpnew in versions before 0.9.3 and before 0.8.8. When the libssh SCP client connects to a server, the scp command, which includes a user-provided path, is executed on the server-side. In case the librar...

JDK: Array indexing integer overflow (8328544)

A flaw was found in OpenJDK. An integer overflow vulnerability in the HotSpot component during array indexing calculations can cause incorrect data elements to be selected. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted input to affected...

CVE-2024-47565

A vulnerability has been identified in SINEC Security Monitor All versions V4.9.0. The affected application does not properly validate that user input complies with a list of allowed values. This could allow an authenticated remote attacker to compromise the integrity of the configuration of the...

VulnCheck KEV: CVE-2023-22069

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic...

ROS-20241008-02

A vulnerability in the Portainer container management platform is related to an improperly used algorithm encryption algorithm in the AesEncrypt function. Exploitation of the vulnerability could allow an attacker acting remotely to compromise the confidentiality, integrity, and availability of...

PT-2024-39144 · Unknown · Alisonic Sibylla

Name of the Vulnerable Software and Affected Versions: Alisonic Sibylla affected versions not specified Description: The issue concerns SQL injection attacks, which could allow complete access to the database. Attackers can remotely compromise databases. There is no information provided about the...

PT-2024-10161

Name of the Vulnerable Software and Affected Versions QNAP QTS versions prior to 5.1.9.2954 build 20241120 QNAP QTS versions prior to 5.2.2.2950 build 20241114 QNAP QuTS hero versions prior to h5.1.9.2954 build 20241120 QNAP QuTS hero versions prior to h5.2.2.2952 build 20241116 Description An...

Malicious code in cap-client-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f18ed3c31f0a20e7a224256d46a896df654fcaf6e60ac3f4fac7639672b320f4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-5773 · Openbmc · Openbmc

Name of the Vulnerable Software and Affected Versions: OpenBMC versions affected versions not specified Description: The issue is related to a memory overflow problem in the slpd-lite daemon, which is a unicast SLP UDP server. This can be exploited by sending specially crafted SLP packets to the...

OESA-2024-1908 openjdk-11 security update

The OpenJDK runtime environment. Security Fixes: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0....

OpenJDK: Out-of-bounds access in 2D image handling (8324559)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: 2D. Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1;...

CVE-2024-38346

The CloudStack cluster service runs on unauthenticated port default 9090 that can be misused to run arbitrary commands on targeted hypervisors and CloudStack management server hosts. Some of these commands were found to have command injection vulnerabilities that can result in arbitrary code...

CVE-2024-27155

The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. The programs can be replaced by malicious programs by any local or remote attacker. As for the affected products/models/versions, see the reference URL...

CVE-2024-27155

Toshiba printers (notably e-STUDIO) are affected by CVE-2024-27155, a Local Privilege Escalation with remote code execution via insecure permissions. The root issue appears to be improper/insecure permissions that allow an attacker to replace programs and potentially gain high-privilege access wi...

CVE-2024-27151

The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. The programs can be replaced by malicious programs by any local or remote attacker. As for the affected products/models/versions, see the reference URL...