Yank Note v3.52.1 (Electron) - Arbitrary Code Execution

Exploit Title: Yank Note v3.52.1 Electron - Arbitrary Code Execution Date: 2023-04-27 Exploit Author: 8bitsec CVE: CVE-2023-31874 Vendor Homepage: yank-note.com Software Link: https://github.com/purocean/yn Version: 3.52.1 Tested on: Ubuntu 22.04 | Mac OS 13 Release Date: 2023-04-27 Product &...

Amount of project token minted to beneficiary by JBXBuybackDelegate._mint function is not checked against an expected minimum number of project tokens to be minted to such beneficiary

Lines of code Vulnerability details Impact Calling the following JBPayoutRedemptionPaymentTerminal31.pay function executes fundingCycle, tokenCount, delegateAllocations, memo = store.recordPaymentFrompayer, bundledAmount, projectId, baseWeightCurrency, beneficiary, memo, metadata. File:...

Omron NJ/NX-series Machine Automation Controllers Use of Hard-Coded Credentials (CVE-2022-34151)

Use of hard-coded credentials vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, Automation software 'Sysmac...

Omron NJ/NX-series Machine Automation Controllers Authentication Bypass By Capture-Replay (CVE-2022-33208)

Authentication bypass by capture-replay vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, Automation software...

Delegate architecture forces users to set zero slippage

Lines of code Vulnerability details Delegate architecture forces users to set zero slippage The design of the delegate forces users to set a zero value for the minReturnedTokens parameter when calling pay in the terminal. Technical details In order to implement the swap functionality, the...

Malicious code in stripe-terminal-react-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e6a4f5507735b6704fa9b04425050a6609564e66e4ad031bbc07e7900ce5610 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Fedora: Security Advisory for kitty (FEDORA-2023-0418511dfe)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 37 Update: kitty-0.26.5-5.fc37

Offloads rendering to the GPU for lower system load and buttery smooth scrolling. Uses threaded rendering to minimize input latency. - Supports all modern terminal features: graphics images, unicode, true-col or, OpenType ligatures, mouse protocol, focus tracking, bracketed paste and several new...

The vulnerability of the set_sixel function in the graphics_sixel.c component of the XTerm terminal emulator allows a hacker to cause a system failure.

The vulnerability of the setsixel function in the graphicssixel.c component of the XTerm terminal emulator involves copying buffers without checking the input data. Exploiting this vulnerability allows a remote attacker to cause a service failure...

Schneider Electric EcoStruxure Operator Terminal Expert 代码注入漏洞

Schneider Electric EcoStruxure Operator Terminal Expert is a touch screen configuration software from Schneider Electric, France. This software branch is primarily used to create and edit touch applications. A code injection vulnerability exists in Schneider Electric EcoStruxure Operator Terminal...

Improper Input Validation

github.com/mutagen-io/mutagen is vulnerable to Improper Input Validation. The vulnerability exists because the mutagen command line and logging operations of the library do not properly sanitize control characters in the text, which allows an attacker to send malicious control characters through...

Authentication flaw

mage-ai is an open-source data pipeline tool for transforming and integrating data. Those who use Mage starting in version 0.8.34 and prior to 0.8.72 with user authentication enabled may be affected by a vulnerability. The terminal could be accessed by users who are not signed in or do not have...

CVE-2023-31143

CVE-2023-31143 affects Mage‑AI where, when using Mage with user authentication enabled, prior to version 0.8.72, unauthenticated users or users without editor permissions could access the terminal. Affected versions are 0.8.34 through 0.8.71; a fix is available in 0.8.72. Red Hat and OSV entries ...

CVE-2023-31143 Mage terminal user authentication not working properly

mage-ai is an open-source data pipeline tool for transforming and integrating data. Those who use Mage starting in version 0.8.34 and prior to 0.8.72 with user authentication enabled may be affected by a vulnerability. The terminal could be accessed by users who are not signed in or do not have...

mage-ai 访问控制错误漏洞

mage-ai is a modern replacement for Airflow in the Mage open source. An access control error vulnerability exists in mage-ai version 0.8.34, which stems from the fact that a user who is not logged in or does not have edit privileges can access the terminal...

CVE-2023-30844 Mutagen list and monitor operations do not neutralize control characters in text controlled by remote endpoints

Mutagen provides real-time file synchronization and flexible network forwarding for developers. Prior to versions 0.16.6 and 0.17.1 in mutagen and prior to version 0.17.1 in mutagen-compose, Mutagen list and monitor commands are susceptible to control characters that could be provided by remote...

CVE-2023-30844 Mutagen list and monitor operations do not neutralize control characters in text controlled by remote endpoints

Mutagen provides real-time file synchronization and flexible network forwarding for developers. Prior to versions 0.16.6 and 0.17.1 in mutagen and prior to version 0.17.1 in mutagen-compose, Mutagen list and monitor commands are susceptible to control characters that could be provided by remote...

Mutagen 安全漏洞

Mutagen is a new remote development tool that enables your existing local tools to work with code in remote environments such as cloud servers and containers. A security vulnerability exists in Mutagen versions prior to 0.16.6, 0.17.1, and mutagen-compose prior to 0.17.1, which stems from the...

GHSA-C6MM-2G84-V4M7 Mage-ai missing user authentication

Impact You may be impacted if you're using Mage with user authentication enabled. The terminal could be accessed by users who are not signed in or do not have editor permissions. Patches The vulnerability has been resolved in Mage version 0.8.72...

GHSA-JMP2-WC4P-WFH2 Mutagen list and monitor operations do not neutralize control characters in text controlled by remote endpoints

Impact Mutagen command line operations, as well as the log output from mutagen daemon run, are susceptible to control characters that could be provided by remote endpoints. This can cause terminal corruption, either intentional or unintentional, if these characters are present in error messages,...