CVE-2023-37896

CVE-2023-37896 concerns a path traversal/sandbox sanitization flaw in the Go SDK path/file loading for Nuclei templates, not affecting the CLI. The issue occurred when relative paths were not converted to absolute paths before sandbox checks, permitting access to arbitrary filesystem files when u...

CVE-2023-37896 Nuclei Path Traversal vulnerability

Nuclei is a vulnerability scanner. Prior to version 2.9.9, a security issue in the Nuclei project affected users utilizing Nuclei as Go code SDK running custom templates. This issue did not affect CLI users. The problem was related to sanitization issues with payload loading in sandbox mode. Ther...

SUSE CVE-2022-40609

IBM SDK, Java Technology Edition 7.1.5.18 and 8.0.8.0 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By sending specially-crafted data, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-For...

Cosmos: RCE and DoS in Cosmovisor

Vulnerability description not provided...

CVE-2022-40609

IBM SDK, Java Technology Edition 7.1.5.18 and 8.0.8.0 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By sending specially-crafted data, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-For...

CVE-2022-40609

IBM SDK, Java Technology Edition 7.1.5.18 and 8.0.8.0 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By sending specially-crafted data, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-For...

CVE-2022-40609

CVE-2022-40609 describes an unsafe deserialization flaw in IBM SDK, Java Technology Edition 7.1.5.18 and 8.0.8.0 , enabling a remote attacker to execute arbitrary code through specially crafted data. The IBM bulletin cites an IBM X-Force base likely high severity (base score 8.1, CVSS 3.x) and no...

Security Bulletin: The IBM® Engineering Lifecycle Engineering products using IBM Java versions 8.0.7.0 - 8.0.7.11 are vulnerable to crypto attacks. (CVE-2023-30441)

Summary IBM Java versions 8.0.7.0 - 8.0.7.1 has a combination of two flaws in the JSSE component and IBMJCEPlus security provider expose some IBM Java releases to various cryptographic attacks when acting as a TLS server. Following IBM® Engineering Lifecycle Engineering products are vulnerable to...

CVE-2022-40609

A flaw was found in IBM SDK, Java Technology Edition, which could allow a remote attacker to execute arbitrary code on the system caused by an unsafe deserialization flaw. An attacker could exploit this vulnerability by sending specially-crafted data to execute arbitrary code on the system...

Security Bulletin: CVE-2022-40609 affects IBM® SDK, Java™ Technology Edition

Summary CVE-2022-40609 affects the Object Request Broker ORB in IBM SDK, Java Technology Edition. An update has been released to address the vulnerability. Vulnerability Details CVEID:CVE-2022-40609 DESCRIPTION: IBM SDK, Java Technology Edition could allow a remote attacker to execute arbitrary...

MAL-2023-1027 Malicious code in @ozon-maps/map-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dbfd1be2f4f9a09e5f0ba2fbef81062825b5959a48a8e035d3bc1a1aeb527421 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in coinbase-wallet-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1892cfeefb3909aa3aed58c0112f2bc9fcb0a762f2242e57c991846a6b8bc875 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1030 Malicious code in coinbase-wallet-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1892cfeefb3909aa3aed58c0112f2bc9fcb0a762f2242e57c991846a6b8bc875 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

kyc3-sdk (>=0.1.0, <=0.1.1) potentially affected by unknown CVE via ethersjs (0.0.1-security)

ethersjs NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on ethersjs and may be impacted: - kyc3-sdk =0.1.0, =0.1.1 Source cves: unknown CVE Source advisory: OSV:MAL-2023-315...

MAL-2023-1118 Malicious code in aws-sdk-js-v3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e64c49f08b91cb456113ae44bbd8efc8280a1c79aa45ca1bd0f019c4af6ad873 The OpenSSF Package Analysis project identified 'aws-sdk-js-v3' @ 1.3.7 npm as malicious. It is considered malicious because: - The package...

MAL-2023-511 Malicious code in hui-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f81760275602834d1c25fb34cf1add0b3fa5f8c21159848716f9d647cc9b6db5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in hui-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f81760275602834d1c25fb34cf1add0b3fa5f8c21159848716f9d647cc9b6db5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting

Description The Freemius SDK for WordPress does not adequately sanitize inputs or escape outputs, leading to Reflected Cross-Site Scripting. This directly affects over 1000 plugins and themes that use this SDK...

Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting

Description The Freemius SDK for WordPress does not adequately sanitize inputs or escape outputs, leading to Reflected Cross-Site Scripting. This directly affects over 1000 plugins and themes that use this SDK...

Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting

Description The Freemius SDK for WordPress does not adequately sanitize inputs or escape outputs, leading to Reflected Cross-Site Scripting. This directly affects over 1000 plugins and themes that use this SDK...