Authorization

UmbracoIdentityExtensions is an Umbraco add-on package that enables easy extensibility points for ASP.Net Identity integration. In affected versions client secrets are not required which may expose some endpoints to untrusted actors. Since Umbraco is not a single-page application, the implicit fl...

CVE-2023-32312 Client secret not mandatory in UmbracoIdentityExtensions

UmbracoIdentityExtensions is an Umbraco add-on package that enables easy extensibility points for ASP.Net Identity integration. In affected versions client secrets are not required which may expose some endpoints to untrusted actors. Since Umbraco is not a single-page application, the implicit fl...

CVE-2023-32312 Client secret not mandatory in UmbracoIdentityExtensions

UmbracoIdentityExtensions is an Umbraco add-on package that enables easy extensibility points for ASP.Net Identity integration. In affected versions client secrets are not required which may expose some endpoints to untrusted actors. Since Umbraco is not a single-page application, the implicit fl...

CVE-2023-33283

Marval MSM through 14.19.0.12476 uses a static encryption key for secrets. An attacker that gains access to encrypted secrets can decrypt them by using this key...

CKAN < 2.8.12 Shared Session Secret

The version of CKAN installed can be impacted by a shared session secret if the application is based on one of the CKAN Docker images and if the users didn't set a custom value via an environment variable. Note that the scanner has not tested for these issues but has instead relied only on the...

Snowden Ten Years Later

In 2013 and 2014, I wrote extensively about new revelations regarding NSA surveillance based on the documents provided by Edward Snowden. But I had a more personal involvement as well. I wrote the essay below in September 2013. The New Yorker agreed to publish it, but the Guardian asked me not to...

Malicious code in fc-switch (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 799f38ee085f9c2d790bf9c9e78379f22e3ad2e3de94ff31011bec69ee78196d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-366 Malicious code in fc-session-state (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ce915f34780e87423580299a1d37897334a16ce4f4031b78bcf4c630cab69513 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fc-phone-number (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ec30fba8ba38ae5e354c219234fb4dd78d71537718394caf3d584e896c5b0a42 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fc-text-input (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a77cf260f432244dc8401fd56c9cf495d88b68182872ddc07d47825a16220276 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fc-cookie (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8b548ad4e233914b6c26e1f1359281f882c9841c6814bb8dae7e2a46b44e04f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-353 Malicious code in fc-keep-alive (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 367d61b371f78d311258a9310bdaf603198ee29c664779d5fc9777c75b51e4ab Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in theme-next (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7162ab25878f8f496bd39b46209cf74bee0f29b34253a0f1cca5d6a48ba830bb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-P976-H52C-26P6 Rancher vulnerable to Privilege Escalation via manipulation of Secrets

Impact A vulnerability has been identified which enables Standard users or above to elevate their permissions to Administrator in the local cluster. The local cluster means the cluster where Rancher is installed. It is named local inside the list of clusters in the Rancher UI. Standard users coul...

Malicious code in fc-amount (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware deda6264abf52468856de6a91a887594ca7b427f7093f2486999d3323f096408 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-331 Malicious code in fc-amount (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware deda6264abf52468856de6a91a887594ca7b427f7093f2486999d3323f096408 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-362 Malicious code in fc-persoonlijke-pas (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ddadd77308256ef0411fae17ee4490cc470cd0234b284b8fe4b240e203586da4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-487 Malicious code in gs-ux-uitoolkit-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0dbdccc4e360bbef0735ca5842ace88de6506955240b3025d1d9cfcf613fa845 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE CVE-2023-22647

An Improper Privilege Management vulnerability in SUSE Rancher allowed standard users to leverage their existing permissions to manipulate Kubernetes secrets in the local cluster, resulting in the secret being deleted, but their read-level permissions to the secret being preserved. When this...

Privilege escalation

An Improper Privilege Management vulnerability in SUSE Rancher allowed standard users to leverage their existing permissions to manipulate Kubernetes secrets in the local cluster, resulting in the secret being deleted, but their read-level permissions to the secret being preserved. When this...