MAL-2022-7076 Malicious code in web-sdk-mono-repo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 979fb0281764bb321aa89f52ee521761dda7d8a4a2c9224ea1f6b55a77d3a066 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-990 Malicious code in analytika-analytika-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 54bf2b8a290dbe5880867f221dab3686ef122b82387aef888d8c1858a77c1890 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-X2PG-MJHR-2M5X Exposure of Sensitive Information to an Unauthorized Actor in semantic-release

Impact What kind of vulnerability is it? Who is impacted? Secrets that would normally be masked by semantic-release can be accidentally disclosed if they contain characters that are excluded from uri encoding by encodeURI. Occurrence is further limited to execution contexts where push access to t...

CVE-2022-1706

A vulnerability was found in Ignition where ignition configs are accessible from unprivileged containers in VMs running on VMware products. This issue is only relevant in user environments where the Ignition config contains secrets. The highest threat from this vulnerability is to data...

MAL-2022-6550 Malicious code in theremontada12 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f57f9f39528199f4988a41ac4bc6d51f57e7e50bc7eb77f9858b3ceebf0516fe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2022-20429 · Jenkins · Jenkins Storable Configs Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Storable Configs Plugin versions 1.0 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to have Jenkins parse a local XML file, such as archived artifacts, that uses external entities for...

MAL-2022-237 Malicious code in @epc-infra/aurora-stack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 90cf861bd2521b2e50dc30a7c5164cfd3c53a724597ffc85a923d730662346b5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-241 Malicious code in @epc-infra/region-only-policy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 03aeca5ad9dc6bebb0249d07c948fc2913ba7b25fdc41cea4a5c78c8bf672958 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2022-13893

Name of the Vulnerable Software and Affected Versions Metform WordPress plugin versions up to and including 2.1.3 Description The Metform WordPress plugin is vulnerable to sensitive information disclosure due to improper access control in the /core/forms/action.php file. This can be exploited by ...

STMicroelectronics STSAFE-J 数据伪造问题漏洞

The STMicroelectronics STSAFE-J is a highly secure solution from STMicroelectronics Switzerland. It acts as a security element by providing authentication, data management and encryption services to local or remote hosts. Security vulnerabilities exist in the STMicroelectronics STSAFE-J that coul...

PT-2022-10470 · Argo Cd · Argo Cd

Name of the Vulnerable Software and Affected Versions: argocd affected versions not specified Description: A flaw was found in argocd, allowing any unprivileged user to deploy argocd in their namespace. With the created ServiceAccount argocd-argocd-server, the unprivileged user can read all...

CVE-2022-25186

Jenkins HashiCorp Vault Plugin 3.8.0 and earlier implements functionality that allows agent processes to retrieve any Vault secrets for use on the agent, allowing attackers able to control agent processes to obtain Vault secrets for an attacker-specified path and key...

PT-2022-17126 · Hashicorp +1 · Jenkins Hashicorp Vault Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins HashiCorp Vault Plugin versions 3.8.0 and earlier Description: The issue allows agent processes to retrieve any Vault secrets for use on the agent. Attackers able to control agent processes can obtain Vault secrets for an...

PT-2022-16117 · Nimforum · Nimforum

Name of the Vulnerable Software and Affected Versions: Nimforum versions prior to 2.2.0 Description: The issue allows any forum user to create a new thread or post that includes a reference to a local file on the host operating system. Nimforum will render the file if possible. This can be done...

Opencast 安全漏洞

Opencast is a live video support software for large-scale automated video capture, management and distribution from the Opencast organization. Opencast suffers from a security vulnerability that stems from the fact that Opencast will open and include local files during ingestion. An attacker coul...

CVE-2021-43492

AlquistManager branch as of commit 280d99f43b11378212652e75f6f3159cde9c1d36 is affected by a directory traversal vulnerability. This attack can cause the disclosure of critical secrets stored anywhere on the system andcan significantly aid in getting remote code access...

CVE-2021-43496

Clustering master branch as of commit 53e663e259bcfc8cdecb56c0bb255bd70bfcaa70 is affected by a directory traversal vulnerability. This attack can cause the disclosure of critical secrets stored anywhere on the system and can significantly aid in getting remote code access...

Vault’s UI Cached User-Viewed Secrets Between Shared Browser Sessions

Summary The Vault UI erroneously cached and exposed user-viewed secrets between authenticated sessions in a single shared browser, if the browser window / tab was not refreshed or closed between logout and a subsequent login. This vulnerability, CVE-2021-38554, was fixed in Vault 1.8.0 and will b...

PT-2021-19621 · Suse · Rke2 +1

Name of the Vulnerable Software and Affected Versions: SUSE Rancher K3s versions v1.19.12+k3s1 through v1.21.2+k3s1 and prior versions RKE2 versions v1.19.12+rke2r1 through v1.21.2+rke2r1 and prior versions Description: A Missing Encryption of Sensitive Data issue allows any user with direct acce...

CVE-2021-32001

K3s in SUSE Rancher allows any user with direct access to the datastore, or a copy of a datastore backup, to extract the cluster's confidential keying material cluster certificate authority private keys, secrets encryption configuration passphrase, etc. and decrypt it, without having to know the...