Malicious code in web3tool-rpc-methods (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e90705834b05e292cabf72529d908456c4f3768af2b34604147b5ac6ec38363 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Use-After-Free

firefox is vulnerable to Use-After-Free. An attacker could exploit this vulnerability by tricking a user into visiting a malicious website or by opening a malicious attachment. If the user is using a vulnerable version of Firefox, the attacker could execute arbitrary code on the user's system. Th...

Mozilla Releases Security Updates for Multiple Products

Mozilla has released security updates to address vulnerabilities for Firefox 116, Firefox ESR 115.1, Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14. An attacker could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrato...

CVE-2023-29449

JavaScript preprocessing, webhooks and global scripts can cause uncontrolled CPU, memory, and disk I/O utilization. Preprocessing/webhook/global script configuration and testing are only available to Administrative roles Admin and Superadmin. Administrative privileges should be typically granted ...

Mozilla Releases Security Update for Firefox and Firefox ESR

Mozilla has released a security update to address a vulnerability in Firefox and Firefox ESR. An attacker could exploit this vulnerability to take control of an affected system. CISA encourages users and administrators to review Mozilla Security Advisory MFSA 2023-26link is external and apply the...

kernel: stack overflow in do_proc_dointvec and proc_skip_spaces

A stack overflow flaw was found in the Linux kernel's SYSCTL subsystem in how a user changes certain kernel parameters and variables. This flaw allows a local user to crash or potentially escalate their privileges on the system...

Command injection

Dell NetWorker 19.6.1.2, contains an OS command injection Vulnerability in the NetWorker client. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS, with the privileges of the...

PT-2023-20147

Name of the Vulnerable Software and Affected Versions Dell NetWorker version 19.6.1.2 Description The issue is an OS command injection vulnerability in the NetWorker client, allowing a remote unauthenticated attacker to execute arbitrary OS commands on the application's underlying OS with the...

CVE-2022-0010 QCS 800xA Vulnerability identified in system log files

Insertion of Sensitive Information into Log File vulnerability in ABB QCS 800xA, ABB QCS AC450, ABB Platform Engineering Tools. An attacker, who already has local access to the QCS nodes, could successfully obtain the password for a system user account. Using this information, the attacker could...

kernel: tcp: Fix data-races around sysctl_tcp_l3mdev_accept.

In the Linux kernel, the following vulnerability has been resolved: tcp: Fix data-races around sysctltcpl3mdevaccept. While reading sysctltcpl3mdevaccept, it can be changed concurrently. Thus, we need to add READONCE to its readers...

kernel: stack overflow in do_proc_dointvec and proc_skip_spaces

A stack overflow flaw was found in the Linux kernel's SYSCTL subsystem in how a user changes certain kernel parameters and variables. This flaw allows a local user to crash or potentially escalate their privileges on the system...

MSC-2023-11193

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Remote reverse shell – this package enables acces...

MSC-2022-4918

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Remote reverse shell – this package enables acces...

MSC-2022-4129

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Remote reverse shell – this package enables acces...

MSC-2022-3907

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Remote reverse shell – this package enables acces...

MSC-2022-2687

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Remote reverse shell – this package enables acces...

MSC-2022-0121

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Remote reverse shell – this package enables acces...

kernel: stack overflow in do_proc_dointvec and proc_skip_spaces

A stack overflow flaw was found in the Linux kernel's SYSCTL subsystem in how a user changes certain kernel parameters and variables. This flaw allows a local user to crash or potentially escalate their privileges on the system...

ML lifecycle management platform Code Execution

The vulnerability of the ML lifecycle management platform is related to an incorrect restriction on the path name to the restricted catalog. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information, execute arbitrary code, or gain full contr...

HGiga PowerStation information leakage vulnerability

HGiga PowerStation is a network load balancing system from HGiga Technology HGiga, a Chinese company. An information disclosure vulnerability exists in HGiga PowerStation versions prior to x64.6.2.165, which stems from the presence of an information disclosure. An attacker can exploit this...