K41351250: BIG-IP Advanced WAF and BIG-IP ASM vulnerability CVE-2021-23031

Security Advisory Description An authenticated user may perform a privilege escalation on the BIG-IP Advanced WAF and ASM Configuration utility. CVE-2021-23031 Impact When this vulnerability is exploited, an authenticated attacker with access to the Configuration utility can execute arbitrary...

SUSE CVE-2018-1106

An authentication bypass flaw has been found in PackageKit before 1.1.10 that allows users without administrator privileges to install signed packages. A local attacker can use this vulnerability to install vulnerable packages to further compromise a system...

SUSE CVE-2022-45415

When downloading an HTML file, if the title of the page was formatted as a filename with a malicious extension, Firefox may have saved the file with that extension, leading to possible system compromise if the downloaded file was later ran. This vulnerability affects Firefox 107...

CVE-2023-25560

DataHub is an open-source metadata platform. The AuthServiceClient which is responsible for creation of new accounts, verifying credentials, resetting them or requesting access tokens, crafts multiple JSON strings using format strings with user-controlled data. This means that an attacker may be...

Authentication flaw

DataHub is an open-source metadata platform. The AuthServiceClient which is responsible for creation of new accounts, verifying credentials, resetting them or requesting access tokens, crafts multiple JSON strings using format strings with user-controlled data. This means that an attacker may be...

DataHub 安全漏洞

DataHub is datahub-project open source metadata platform for a modern data stack. DataHub suffers from a security vulnerability that stems from the presence of an authentication bypass, which is exploited by an attacker to create a system account, leading to a compromise of the entire system...

CVE-2023-25560

Summary of CVE-2023-25560 (DataHub) : The vulnerability affects DataHub’s AuthServiceClient, responsible for account creation, credential verification, reset, and token requests. It arises from crafting multiple JSON strings with user-controlled data via format strings, enabling an attacker to au...

CVE-2023-25560 JSON Injection in DataHub

DataHub is an open-source metadata platform. The AuthServiceClient which is responsible for creation of new accounts, verifying credentials, resetting them or requesting access tokens, crafts multiple JSON strings using format strings with user-controlled data. This means that an attacker may be...

CVE-2023-25560 JSON Injection in DataHub

DataHub is an open-source metadata platform. The AuthServiceClient which is responsible for creation of new accounts, verifying credentials, resetting them or requesting access tokens, crafts multiple JSON strings using format strings with user-controlled data. This means that an attacker may be...

CVE-2023-25560 JSON Injection in DataHub

DataHub is an open-source metadata platform. The AuthServiceClient which is responsible for creation of new accounts, verifying credentials, resetting them or requesting access tokens, crafts multiple JSON strings using format strings with user-controlled data. This means that an attacker may be...

PT-2023-20158

Name of the Vulnerable Software and Affected Versions DataHub affected versions not specified Description The issue concerns the AuthServiceClient in DataHub, which is responsible for managing accounts and authentication. It crafts JSON strings using format strings with user-controlled data,...

Malicious code in @superbet-group/betting.lib.payments (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e13a890da5a2b84f4c5c94e43e43e10ee158f2e3034a8e4458997ccbc5f5af51 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @superbet-group/web.lib.vue-utilities (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0177c1a71b6ddf84d3b320b15eb180edf94406c0f6a4f07ad0b4ca33fcbb52fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in usamaturk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 87d02f6bdc2aef87b1fe34c7c3d0e97fe812b9e1be74c7c06da4c0a05e276a45 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Exploit for Server-Side Request Forgery in F5 Big-Ip_Access_Policy_Manager

CVE-2021-22986 This vulnerability allows for unauthenticated...

Malicious code in thenamk3z (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b7136bd556e8bf67544b369c2583a529fc5c8dd8153920ecd46d37007562040e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @bingads-webui-campaign/facebook-import-page (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 21a5691da486b64faecd5c39157f18324639cdaf8a357094a80ef7088eb6c34c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dhf-horizon-synthesis (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d0e466c39876ba9752607bd8ccc4136123ba9cf5a279337f4e5930c07d203f8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ban-notifier (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aecea46554ceaa591315411d0d3e279f9dab01878d3136b5f7a3e6e44974bb94 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ftvi-meteo-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 90a10fd36b58b6b7186a2930294601dde7968f6ef78d443df46dc8a0854dba13 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...