CVE-2022-39264 nheko vulnerable to secret poisoning using MITM on secret requests by the homeserver

nheko is a desktop client for the Matrix communication application. All versions below 0.10.2 are vulnerable homeservers inserting malicious secrets, which could lead to man-in-the-middle attacks. Users can upgrade to version 0.10.2 to protect against this issue. As a workaround, one may apply th...

PT-2022-24854 · Nheko · Nheko

Name of the Vulnerable Software and Affected Versions: nheko versions prior to 0.10.2 Description: nheko is a desktop client for the Matrix communication application. The issue allows homeservers to insert malicious secrets, which could lead to man-in-the-middle attacks. Recommendations: For...

Malicious code in flashloan (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b318d8644a2e5f56d435a65d5df7d81c078bdf2f95b231006a90d5dc67bdb754 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6065 Malicious code in sfos-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d35db97fc7f564a72dbdff02e662109b9cd933adf377fbb61251d42f674589b5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 7h3n00b2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d447e0a0abdb9a120daee768c4715f5c6e7525abefa06b9e7868a19eda7b9e65 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Chipolo ONE 安全漏洞

Chipolo ONE is a key finder from Chipolo. Perfect for finding your keys, bags, backpacks in seconds. Chipolo ONE version 4.13.0 suffers from a security vulnerability that stems from the ability of a trusted owner to remotely share Chipolo access to another user who could be a potential attacker. ...

MAL-2022-39 Malicious code in 5to6-exports (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 341557457bb8c37a9fe35de09fad31d239bf12cb8d137417205690870f214cac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in com.meta.xr.sdk.empty (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5e176fd9c7eeccf86b6d27ce925141cb71fe32a6454ccd43e17ada8bfda1b25f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in com.meta.quest.sdk.empty (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 73c876e578f9f409715ef627126da30f42f3e299ba698aac7fa841709b83f18a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-32211

A SQL injection vulnerability exists in Rocket.Chat v3.18.6, v4.4.4 and v4.7.3 which can allow an attacker to retrieve a reset password token through or a 2fa secret...

Sql injection

A SQL injection vulnerability exists in Rocket.Chat v3.18.6, v4.4.4 and v4.7.3 which can allow an attacker to retrieve a reset password token through or a 2fa secret...

CVE-2022-32211

A SQL injection vulnerability exists in Rocket.Chat v3.18.6, v4.4.4 and v4.7.3 which can allow an attacker to retrieve a reset password token through or a 2fa secret...

CVE-2022-32211

A SQL injection vulnerability exists in Rocket.Chat v3.18.6, v4.4.4 and v4.7.3 which can allow an attacker to retrieve a reset password token through or a 2fa secret...

CVE-2022-32211

A SQL injection vulnerability exists in Rocket.Chat v3.18.6, v4.4.4 and v4.7.3 which can allow an attacker to retrieve a reset password token through or a 2fa secret...

Rancher API and cluster.management.cattle.io object vulnerable to plaintext storage and exposure of credentials

Impact An issue was discovered in Rancher versions up to and including 2.5.15 and 2.6.6 where sensitive fields, like passwords, API keys and Rancher's service account token used to provision clusters, were stored in plaintext directly on Kubernetes objects like Clusters, for example...

MAL-2022-220 Malicious code in @dydxprotocol/solo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 414b7a58031d755b2ab4f51d6bfc4bbaf5dad684161eab9b2d1062b8d4ce22df Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-39227

python-jwt is a module for generating and verifying JSON Web Tokens. Versions prior to 3.3.4 are subject to Authentication Bypass by Spoofing, resulting in identity spoofing, session hijacking or authentication bypass. An attacker who obtains a JWT can arbitrarily forge its contents without knowi...

Rocket.Chat SQL注入漏洞

Rocket.Chat, an open source team chat software, is vulnerable to SQL injection, which stems from the application's lack of validation of externally entered SQL statements. An attacker could exploit the vulnerability to retrieve a reset password token via 2fa secret or 2fa secret...

PT-2022-22662 · Node.Js +6 · Node.Js +6

Name of the Vulnerable Software and Affected Versions: Node.js version 18 Description: A weak randomness issue exists in the WebCrypto keygen due to a change with EntropySource in SecretKeyGenTraits::DoKeyGen in src/crypto/crypto keygen.cc. There are two main problems: 1. The return value of...

PT-2022-21153 · Unknown · Rocket.Chat

Name of the Vulnerable Software and Affected Versions: Rocket.Chat versions prior to 3.18.6 Rocket.Chat versions prior to 4.4.4 Rocket.Chat versions prior to 4.7.3 Description: A SQL injection issue exists, allowing an attacker to retrieve a reset password token or a 2fa secret. Recommendations:...