MAL-2022-6454 Malicious code in template-snap-monorepo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 74c7cad047178724994451f1723e5dedc74cfef71207cdeb09ccd5208eb56a18 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6717 Malicious code in typescript-snap (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware af2e66667041679b6890195ca5cb7fe9d40e3b3b7d7b78e43ce2252236783e1a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ethers-js-snap (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0fed39a2c0c5817dd6ae76956a74c435c13481436cac3eb9d117857ad9be21af Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Configuration API in EdgeXFoundry 2.1.0 and earlier exposes message bus credentials to local unauthenticated users

Impact The /api/v2/config endpoint exposes message bus credentials to local unauthenticated users. In security-enabled mode, message bus credentials are supposed to be kept in the EdgeX secret store and require authentication to access. This vulnerability bypasses the access controls on message b...

CVE-2022-31745

If array shift operations are not used, the Garbage Collector may have become confused about valid objects. This vulnerability affects Firefox 101...

kyoukai (>=2.2.0, <=2.2.1), mezmorize (>=0.18.1, <=0.25.0) +2 more potentially affected by CVE-2022-29361 via werkzeug (0.13.0)

werkzeug PYPI version 0.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - kyoukai =2.2.0, =0.18.1, =0.49.2, =0.0.0.1, =0.0.3 Source cves: CVE-2022-29361 Source advisory: OSV:PYSEC-2022-203...

snapcraft Access Restriction Bypass

In some conditions, a snap package built by snapcraft includes the current directory in LDLIBRARYPATH, allowing a malicious snap to gain code execution within the context of another snap if both plug the home interface or similar. This issue affects snapcraft versions prior to 4.4.4, prior to...

Acronis Snap Deploy Elevation of Privilege Vulnerability (CNVD-2022-64257)

Acronis Snap Deploy, an Acronis platform for bulk deployment of system images, is vulnerable to an elevation of privilege vulnerability that stems from assigning too many privileges to child processes, which could be exploited by an attacker to cause a local elevation of privilege...

CVE-2022-30696

Local privilege escalation due to a DLL hijacking vulnerability. The following products are affected: Acronis Snap Deploy Windows before build 3640...

CVE-2022-30697

Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Snap Deploy Windows before build 3640...

CVE-2022-30695

Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected: Acronis Snap Deploy Windows before build 3640...

CVE-2022-30696

Local privilege escalation due to a DLL hijacking vulnerability. The following products are affected: Acronis Snap Deploy Windows before build 3640...

CVE-2022-30697

Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Snap Deploy Windows before build 3640...

CVE-2022-30695

Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected: Acronis Snap Deploy Windows before build 3640...

Privilege escalation

Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Snap Deploy Windows before build 3640...

Privilege escalation

Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected: Acronis Snap Deploy Windows before build 3640...

Privilege escalation

Local privilege escalation due to a DLL hijacking vulnerability. The following products are affected: Acronis Snap Deploy Windows before build 3640...

CVE-2022-30697 Local privilege escalation due to insecure folder permissions

Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Snap Deploy Windows before build 3640...

CVE-2022-30697

CVE-2022-30697 affects Acronis Snap Deploy for Windows before build 3640. Local privilege escalation due to insecure folder permissions on the host. CVSSv3.1 base score 7.8 (LOCAL, Privileges Required: LOW). No exploitation details are provided in the documents. Mitigation: upgrade to build 3640 ...

CVE-2022-30696

The CVE-2022-30696 issue affects Acronis Snap Deploy on Windows prior to build 3640. It is a DLL hijacking vulnerability that occurs when a process loads a DLL without specifying the absolute path, enabling local privilege escalation. The vulnerability is documented across multiple sources and is...