MAL-2022-6429 Malicious code in tcm-one-tree (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4b7f900ef8f753774bd695128ad350ff16b9f03c8c4d53ffea0f43dc61ae4c09 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2022-27946 · Jenkins · Jenkins Plot Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Plot Plugin versions 2.1.11 and earlier Description: The issue allows attackers who can control XML input files for the 'Plot build data' build step to have Jenkins parse a crafted file that uses external entities for extraction of...

Malicious code in icon-ionicon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aa19b67c8ff05aac2b44239a9c86194d95b309b5e531b0704b9e4883ecb52be4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3936 Malicious code in ionpackages (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9382fa773715062b398a7ecc33faf317132a1d55869770dfd1ea5295fe068399 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ionpackagesa (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c2498449d91210e7a1368b0b705157307aa6f00a84da63f3b58ea7155d7713f4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

ALPINE-CVE-2022-35255

A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource in SecretKeyGenTraits::DoKeyGen in src/crypto/cryptokeygen.cc. There are two problems with this: 1 It does not check the return value, it assumes EntropySource always succeeds, but it can a...

CVE-2022-3926

The WP OAuth Server OAuth Authentication WordPress plugin before 3.4.2 does not have CSRF check when regenerating secrets, which could allow attackers to make logged in admins regenerate the secret of an arbitrary client given they know the client ID...

CVE-2022-3926 WP OAuth Server < 3.4.2 - Client Secret Regeneration via CSRF

The WP OAuth Server OAuth Authentication WordPress plugin before 3.4.2 does not have CSRF check when regenerating secrets, which could allow attackers to make logged in admins regenerate the secret of an arbitrary client given they know the client ID...

CVE-2022-3926 WP OAuth Server < 3.4.2 - Client Secret Regeneration via CSRF

The WP OAuth Server OAuth Authentication WordPress plugin before 3.4.2 does not have CSRF check when regenerating secrets, which could allow attackers to make logged in admins regenerate the secret of an arbitrary client given they know the client ID...

Malicious code in cors-2.8.5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6d3ac76cc6d4732cf46e90544d65c4e016ecfe5b8fe92361e1586d61b16a6e26 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress plugin WP OAuth Server 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

PT-2022-24852 · WordPress · Wp Oauth Server

Name of the Vulnerable Software and Affected Versions: WP OAuth Server OAuth Authentication versions prior to 3.4.2 Description: The issue concerns a lack of CSRF check when regenerating secrets. This could allow attackers to make logged-in admins regenerate the secret of an arbitrary client, giv...

DJRCE

Django RCEDJRCE Simple django rce exploitation with leaked...

Hell’s Keychain: Supply-chain vulnerability in IBM Cloud Databases for PostgreSQL allows potential unauthorized database access

How IBM Cloud caught us exploring its infrastructure and how a hardcoded secret eventually led to build artifact access and manipulation...

GitLab CE/EE 安全漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. A security vulnerability exists in GitLab CE/EE, which stems from the fact tha...

GitLab CE/EE 安全漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery and other features. A security vulnerability exists in GitLab CE/EE, which stems from the leakage o...

FreeBSD : Gitlab -- Multiple Vulnerabilities (3cde510a-7135-11ed-a28b-bff032704f00)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 3cde510a-7135-11ed-a28b-bff032704f00 advisory. - Gitlab reports: DAST API scanner exposes Authorization headers in vulnerabilities Group IP...

DRUPAL-CONTRIB-2022-061

Social Flexible Group is an Open Social extension that allows users to create groups with many different configurations. In specific uncommon scenarios, where a platform doesn't have any flexible groups with the "Group members only secret" visibility, community groups are visible to anonymous use...

Malicious code in cnscode (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bb8a55ae861c4d11df82c8215fda301311a62edb32acb634fb08274cc4aab758 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3949 Malicious code in ipcode (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eb106e4f5f5d2d56192a137717db9c8725f3ec3c4ee2604a420c6e5056db9761 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...