PT-2023-15623 · Acuant · Acuant Acufill Sdk

Name of the Vulnerable Software and Affected Versions: Acuant AcuFill SDK versions prior to 10.22.02.03 Description: An issue was discovered in the Acuant AcuFill SDK. During installation, an executable file gets executed out of the C:WindowsTemp directory. A standard user can create the path fil...

CVE-2022-48223

Summary (CVE-2022-48223): A DLL hijacking race condition in Acuant AcuFill SDK (pre-10.22.02.03) during certificate repair via certutil.exe called by the installer. Causes insecure permissions on the executing directory, enabling potential unauthorized code execution or data compromise. Impact de...

CVE-2022-48224

An issue was discovered in Acuant AcuFill SDK before 10.22.02.03. It is installed with insecure permissions full write access within Program Files. Standard users can replace files within this directory that get executed with elevated privileges, leading to a complete arbitrary code execution...

CVE-2022-48224

The CVE-2022-48224 issue affects Acuant AcuFill SDK versions prior to 10.22.02.03. It involves insecure permissions in the Program Files directory, enabling standard users to replace files that execute with elevated privileges, which can lead to complete arbitrary code execution (privilege escala...

CVE-2022-48225

An issue was discovered in Acuant AcuFill SDK before 10.22.02.03. It is used to install drivers from several different vendors. The Gemalto Document Reader child installation process is vulnerable to DLL hijacking, because it attempts to execute with elevated privileges multiple non-existent DLLs...

The vulnerability of the JavaScript and TypeScript matrix-js-sdk development tools lies in the uncontrolled modification of prototype properties of objects, allowing attackers to trigger a service failure.

The vulnerability of the JavaScript and TypeScript matrix-js-sdk development tools is related to uncontrolled changes to prototype attributes of objects. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures by using specially created input data...

Security Bulletin: Multiple vulnerabilities in IBM® Java SDK affect IBM WebSphere Application Server and IBM WebSphere Application Server Liberty due to January 2023 CPU plus deferred CVE-2022-21426

Summary There are multiple vulnerabilities in the IBM® SDK, Java™ Technology Edition that is shipped with IBM WebSphere Application Server and IBM WebSphere Application Server Liberty. The CVEs listed in this document might affect some configurations of IBM WebSphere Application Server traditiona...

Malicious code in @12build/product-api-ts-axios-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 336e30b4abb921976acb4a16517a2a6f2ad668fafe7e41d16b63dbba221feaa4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-21 Malicious code in @12build/product-api-ts-axios-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 336e30b4abb921976acb4a16517a2a6f2ad668fafe7e41d16b63dbba221feaa4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @12build/segment-js-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 856e63ff9eebaf0c3443eeee789588cf844ca28e1810394d67c01e5f5a4aa601 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @12build/account-api-ts-axios-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cc5c5465a393a23f776128754b0543c03787f78e563b7142645453e912068ff6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Bulletin: Trusteer SDK for Mobile vulnerable to file upload (CVE-2022-42443)

Summary Security improvements were made to the Trusteer Mobile SDKs for iOS and Android. No code changes are required to take advantage of the improvements, but mobile application creators must rebuild using the latest SDK version and redeploy their mobile apps to take advantage of these...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to sensitive information exposure in AWS SDK for Go (CVE-2022-2582)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to sensitive information exposure in AWS SDK for Go caused by the sending of an unencrypted hash of the plaintext alongside the ciphertext as a metadata field. CVE-2022-2582. AWS SDK for Go is included as part o...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security restrictions bypass in Amazon AWS S3 Crypto SDK for GoLang (CVE-2020-8912)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security restrictions bypass in Amazon AWS S3 Crypto SDK for GoLang caused by a flaw in the in-band key negotiation. CVE-2020-8912. Amazon AWS S3 Crypto SDK for GoLang is included as part of the Base OS...

Security Bulletin: Multiple Vulnerabilities in IBM Java SDK affect IBM Cloud Pak System

Summary Multiple Vulnerabilities have been found in IBM Java SDK that is shipped with Cloud Pak System. IBM Cloud Pak System has addressed these vulnerabilities as per the IBM SDk July 2022 CPU update, that includes IBM SDK April and January 2022 CPU updates and additional CVEs. Vulnerability...

SUSE CVE-2023-28427

matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data...

Fedora 37 : thunderbird (2023-d093c0cd27)

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-d093c0cd27 advisory. Update to 102.9.1 ; https://www.mozilla.org/en-US/security/advisories/mfsa2023-12/ ; https://www.thunderbird.net/en-US/thunderbird/102.9.1/releasenotes/...

GHSA-MWQ8-FJPF-C2GR Prototype pollution in matrix-js-sdk (part 2)

Impact In certain configurations, data sent by remote servers containing special strings in key locations could cause modifications of the Object.prototype, disrupting matrix-js-sdk functionality, causing denial of service and potentially affecting program logic. This is part 2, where...

Slackware Linux 15.0 / current mozilla-thunderbird Vulnerability (SSA:2023-088-01)

The version of mozilla-thunderbird installed on the remote host is prior to 102.9.1. It is, therefore, affected by a vulnerability as referenced in the SSA:2023-088-01 advisory. - matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sen...

Prototype pollution in matrix-react-sdk

Impact In certain configurations, data sent by remote servers containing special strings in key locations could cause modifications of the Object.prototype, disrupting matrix-react-sdk functionality, causing denial of service and potentially affecting program logic. This is part 2, where...