MAL-2022-1291 Malicious code in azure-arm-storagesync-samples-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f1efed359b2d3c2ddec29f9ba9698a370e4af0ec65ebdd4a0f5a4c7d553b57ec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4190 Malicious code in klook-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5540e1613f2ea5571b22d8081b140c6e8296528143e91df97084ae8010fe2ecb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-594 Malicious code in @smartsteuer/solo-vue-heroicons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7a7f8d7c995f4d1317b54aeda33969524c95b75fde0eab05f441a75130a8a32a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2297 Malicious code in cxd-npm-releases (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 653b5a7e3454cc87a99ebf066a86cab23a1999ba37b0cb45700df4448ebeaeef Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Path Traversal

@backstage/plugin-techdocs-node is vulnerable to Path Traversal. The vulnerability exists in local.ts because of register entities not properly validated which allows to attacker to write malicious files in the system...

MAL-2022-7002 Malicious code in vuestic-admin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 39a046686c53378bb9efc79eca87d4c90700e4b3e1d8dacaf0f82186f03e0d3f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Securing the software supply chain, with Kim Lewandowski: Lock and Code S03E13

At the start of the global coronavirus pandemic, nearly everyone was forced to learn about the "supply chain." Immediate stockpiling by an alarmed and from a smaller share, opportunistic public led to an almost overnight disappearance of hand sanitizer, bottled water, toilet paper, and face masks...

CVE-2022-2111 Unrestricted Upload of File with Dangerous Type in inventree/inventree

Unrestricted Upload of File with Dangerous Type in GitHub repository inventree/inventree prior to 0.7.2...

Reading on uninitialized memory may cause UB ( `util::read_spv()` )

Affected versions of this crate passes an uninitialized buffer to a user-provided Read implementation. Arbitrary Read implementations can read from the uninitialized buffer memory exposure and also can return incorrect number of bytes written to the buffer. Reading from uninitialized memory...

CVE-2022-21123

Incomplete cleanup of multi-core shared buffers for some IntelR Processors may allow an authenticated user to potentially enable information disclosure via local access...

Remote Code Execution (RCE)

grub2 is vulnerable to remote code execution. The vulnerability exists due to an out-of-bounds write in the heap area allowing an attacker to inject maliciously crafted script into the system via a crafted 16-bit grayscale PNG image which allows an attacker to inject malicious codes...

OPENSUSE-SU-2022:10009-1 Security update for chromium

This update for chromium fixes the following issues: Chromium 102.0.5005.115 boo1200423 CVE-2022-2007: Use after free in WebGPU CVE-2022-2008: Out of bounds memory access in WebGL CVE-2022-2010: Out of bounds read in compositing CVE-2022-2011: Use after free in ANGLE Chromium 102.0.5001.61...

CVE-2022-2079 Cross-site Scripting (XSS) - Stored in nocodb/nocodb

Cross-site Scripting XSS - Stored in GitHub repository nocodb/nocodb prior to 0.91.7+...

NocoDB information disclosure vulnerability

In NocoDB prior to 0.91.7, the SMTP plugin doesn't have verification or validation. This allows attackers to make requests to internal servers and read the contents...

MGASA-2022-0226 Updated php-smarty packages fix security vulnerability

Template authors could inject php code by choosing a malicious block name or include file name. CVE-2022-29221...

RLSA-2022:4990 Important: cups security update

The Common UNIX Printing System CUPS provides a portable printing layer for Linux, UNIX, and similar operating systems. Security Fixes: cups: authorization bypass when using "local" authorization CVE-2022-26691 For more details about the security issues, including the impact, a CVSS score,...

MAL-2022-828 Malicious code in acronis-ui-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 431e7c9d70568e5dfdc18aeb99d4ffddb22487462dea0588b1b5d29feebf36c0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2021-41641

Deno =1.14.0 file sandbox does not handle symbolic links correctly. When running Deno with specific write access, the Deno.symlink method can be used to gain access to any directory...

MAL-2022-416 Malicious code in @manomano-toolbox/hub (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7ce330b8bf18cd09a6c497d52b9254f771600e32cee266dc414d683502e01e67 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Authorization Bypass Through User-Controlled Key in go-restful

Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0...