MAL-2022-4418 Malicious code in luajit-stdlib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 45b78e7ade789bb8def418f760cb87a5ee7cc0bf5135ba824d6de5872ef369e2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in httsper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c091a7b57d9d262ce6c8a106b8d1171290f1501a9274efbdd93fcae75d3c3b18 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2022-16358 · Keylime · Keylime

Name of the Vulnerable Software and Affected Versions: Keylime versions prior to 6.3.0 Description: A flaw in the Keylime agent's logic for checking secure mounts can be exploited, allowing secrets to be leaked to other processes on the host. This occurs because previously created unprivileged...

CVE-2022-40262 The arbitrary write vulnerability in S3Resume2Pei leads to arbitrary code execution during PEI phase.

A potential attacker can execute an arbitrary code at the time of the PEI phase and influence the subsequent boot stages. This can lead to the mitigations bypassing, physical memory contents disclosure, discovery of any secrets from any Virtual Machines VMs and bypassing memory isolation and...

MAL-2022-81 Malicious code in @arkadium/eagle-user-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c7a1219186b72612034e596232352022cd3f3e5eca9f1f4bd2e4787909d4aa9f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in monitor-inc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5c011b2b9d9594136fc39f460cd41b7b6bc2d83f0e4d683f1e396184ff66b222 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in commons-inc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 862814d566867240e7ce2abb5bd5070f301f288285ce73b803bfb14a4b158e20 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in internallib_v820 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 862c222c8749942e79856c17145cc8b6da375a284505f9a63bf506589786612c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ssomicroservicefrontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7dc6def78df6060dabd36175409b0285d188b387f0f76fb10b352c6feac85647 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

secret-garden-hair-beauty-gmbh.scope-recruiting.de Cross Site Scripting vulnerability OBB-2915867

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Malicious code in builtin-pages-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3be644f30528e61fadc22a9526bbd5dc5460dedd27a297fe25b70ede89657a38 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2022-5045 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.13.0 and earlier Description: The issue is related to a Violation of Secure Design Principles that could allow an attacker to bypass the security feature of the encryption mechanism in the backend. This...

MAL-2022-6611 Malicious code in top-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 925e9f2303139444698b5ac3fac5f3a737aab5ddd9426c2b09f609a2601fc610 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in www-error (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 63255cc7f08c677ca63aab0e06d6558460cff165f28f1bab1fae6cdcafe28ab4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Biden Cybersecurity Executive Order: Ex-USSS Reflects

Ed Cabrera, former CISO of the US Secret Service and current Chief Cybersecurity Officer for Trend Micro, reflects on the effectiveness of Biden’s executive order and what organizations of all sizes can learn from it...

MAL-2022-3 Malicious code in --legacy-peer-deps (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9016f41e70e542399b68b5d9e362563751dedbff976a3bd66808702c420f35f9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-P2JG-Q8HW-P7GC Barbican authorization flaw before v14.0.0

An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or delete metadata from any secret regardless of ownership. This flaw allows an attacker on the network to modify or delete protected data,...

Barbican authorization flaw before v14.0.0

An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or delete metadata from any secret regardless of ownership. This flaw allows an attacker on the network to modify or delete protected data,...

CVE-2022-36065 GrowthBook account creation and file upload vulnerability in self-hosted configurations

GrowthBook is an open-source platform for feature flagging and A/B testing. With some self-hosted configurations in versions prior to 2022-08-29, attackers can register new accounts and upload files to arbitrary directories within the container. If the attacker uploads a Python script to the righ...

CVE-2022-23451

An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or delete metadata from any secret regardless of ownership. This flaw allows an attacker on the network to modify or delete protected data,...