UBUNTU-CVE-2022-4304

A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages fo...

Malicious code in bolt-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6e0e9750641b5f610dba33e939ceb6e12c2ed20c08c5974a909f7cdfc113f515 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-22746

CKAN is an open-source DMS data management system for powering data hubs and data portals. When creating a new container based on one of the Docker images listed below, the same secret key was being used by default. If the users didn't set a custom value via environment variables in the .env file...

Design/Logic Flaw

CKAN is an open-source DMS data management system for powering data hubs and data portals. When creating a new container based on one of the Docker images listed below, the same secret key was being used by default. If the users didn't set a custom value via environment variables in the .env file...

CVE-2023-22746 CKAN is vulnerable to session secret shared across instances using Docker images

CKAN is an open-source DMS data management system for powering data hubs and data portals. When creating a new container based on one of the Docker images listed below, the same secret key was being used by default. If the users didn't set a custom value via environment variables in the .env file...

CVE-2023-22746 CKAN is vulnerable to session secret shared across instances using Docker images

CKAN is an open-source DMS data management system for powering data hubs and data portals. When creating a new container based on one of the Docker images listed below, the same secret key was being used by default. If the users didn't set a custom value via environment variables in the .env file...

CVE-2023-22746

CVE-2023-22746 affects CKAN Docker-based deployments where a default, shared secret key is used across multiple instances unless overridden in the container’s .env. The vulnerability allows forging authentication requests between CKAN instances when the default secret key is not customized. Affec...

CVE-2023-22746 CKAN is vulnerable to session secret shared across instances using Docker images

CKAN is an open-source DMS data management system for powering data hubs and data portals. When creating a new container based on one of the Docker images listed below, the same secret key was being used by default. If the users didn't set a custom value via environment variables in the .env file...

Congress Has a Lo-Fi Plan to Fix the Classified Documents Mess

As unsecured docs pile up, a bipartisan group of lawmakers is itching to overhaul the nation’s secret secret-sharing operation...

CVE-2022-2546

The All-in-One WP Migration WordPress plugin before 7.63 uses the wrong content type, and does not properly escape the response from the ai1wmexport AJAX action, allowing an attacker to craft a request that when submitted by any visitor will inject arbitrary html or javascript into the response...

Design/Logic Flaw

The All-in-One WP Migration WordPress plugin before 7.63 uses the wrong content type, and does not properly escape the response from the ai1wmexport AJAX action, allowing an attacker to craft a request that when submitted by any visitor will inject arbitrary html or javascript into the response...

CVE-2022-2546 All-in-One WP Migration < 7.63 - Unauthenticated Reflected XSS

The All-in-One WP Migration WordPress plugin before 7.63 uses the wrong content type, and does not properly escape the response from the ai1wmexport AJAX action, allowing an attacker to craft a request that when submitted by any visitor will inject arbitrary html or javascript into the response...

CVE-2022-2546 All-in-One WP Migration < 7.63 - Unauthenticated Reflected XSS

The All-in-One WP Migration WordPress plugin before 7.63 uses the wrong content type, and does not properly escape the response from the ai1wmexport AJAX action, allowing an attacker to craft a request that when submitted by any visitor will inject arbitrary html or javascript into the response...

Exploit for Improper Input Validation in Cisco Ios

Cisco-Smart-Exploit Cisco SmartInstall Exploit CVE-2018-0171...

Malicious code in tiaa-web-ui-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6307bc57608579648ccf1b24d5afbcd0d7f3c15e8c8da97a2a0d1a6a6e059fa9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in yandex-cfg-env (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 84d83751dd94336617da93fa09ccd8505ecd47f4cbc9ef2dc4d9ea70068c82dc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-986 Malicious code in yandex-logger-sentry (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f4c81d36303d3e14463172a01a3d04fd2b8b0456c22bc8fcbc4df9fc4c27ac65 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-779 Malicious code in skip-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1bd0d1ba40fe0bcfb78cdaa557309ff0a4c113dc2bedd58f36622850efeacf3f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in postcss-file-match (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 416239cd07c736ee9cda1661d413016b66a35ccd99054f13c8fb5b81fefa02dd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in node-http-uatraits (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 79f641b192ea9d09801f965d0b2e909f40fbc483a2f115e45feafed0376029a1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...