MAL-2023-19 Malicious code in 61nlwr0f_bpi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8749d5e356aeb60a7eada139d59386b6a5d41ca503c9e3f90d8d8ef3c17f2d02 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Apache Airflow vulnerable to stored Cross-site Scripting

Task instance details page in the UI is vulnerable to stored cross-site scripting. This issue affects Apache Airflow before 2.6.0...

CVE-2023-29942

llvm-project commit a0138390 was discovered to contain a segmentation fault via the component mlir::Type::isamlir::LLVM::LLVMVoidType...

Information Disclosure

payload is vulnerable to Information Disclosure. An attacker can access hidden fields on readable collections they don't have authorization for via a brute force attack...

ASB-A-271788844

Bulletin has no description...

ASB-A-260149319

Bulletin has no description...

PUB-A-258053342

Bulletin has no description...

ASB-A-273401256

Bulletin has no description...

ASB-A-259984805

Bulletin has no description...

MAL-2023-1223 Malicious code in ladoputi-static (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1448356c200aec8d8b1197163159b7b15288c3629fc0a3ec2d33dd82c06725ac The OpenSSF Package Analysis project identified 'ladoputi-static' @ 99.99.99 npm as malicious. It is considered malicious because: - The package...

Google Gets Court Order to Take Down CryptBot That Infected Over 670,000 Computers

Google on Wednesday said it obtained a temporary court order in the U.S. to disrupt the distribution of a Windows-based information-stealing malware called CryptBot and "decelerate" its growth. The tech giant's Mike Trinh and Pierre-Marc Bureau said the efforts are part of steps it takes to "not...

Prototype Pollution in vConsole

vConsole was discovered to contain a prototype pollution due to incorrect key and value resolution in setOptions in core.ts...

Hidden fields can be leaked on readable collections in Payload

Details If a user has access to documents that contain hidden fields or fields they do not have access to, the user could reverse-engineer those values via brute force. Affected versions: 1.7.0 Workarounds If you are unable to update, you can write a beforeOperation hook to remove where queries...

Improper Authentication

calibreweb is vulnerable to Improper Authentication. The vulnerability exists in the login function of web.py file, which allows a remote attacker to takeover the account by bruteforcing due to improper restriction of excessive authentication attempts...

WordPress Membership Database Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Software Membership Database Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0514 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID ffa2783bb32d Credits Shreya Pohekar Require...

PT-2023-18564 · Alf.Io · Alf.Io

Name of the Vulnerable Software and Affected Versions: alfio-event/alf.io versions prior to 2.0-M4-2304 Description: The issue is related to the improper neutralization of formula elements in a CSV file. This problem affects the GitHub repository alfio-event/alf.io. Recommendations: For versions...

CVE-2023-2260 Authorization Bypass Through User-Controlled Key in alfio-event/alf.io

Authorization Bypass Through User-Controlled Key in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304...

Security Bulletin: Multiple vulnerabilities may affect IBM® SDK, Java™ Technology Edition

Summary This bulletin covers all applicable Java SE CVEs published by Oracle as part of their October 2022 Critical Patch Update. For more information please refer to Oracle's October 2022 CPU Advisory and the X-Force database entries referenced below. Vulnerability Details CVEID:CVE-2022-21628...

SUSE-SU-2023:1907-1 Security update for openssl

This update for openssl fixes the following issues: - CVE-2023-0465: Invalid certificate policies in leaf certificates were silently ignored bsc1209878. - CVE-2023-0466: Certificate policy check were not enabled bsc1209873...

Yatra < 2.1.15 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...