GHSA-H5VJ-F7R9-W564 Entropy Backdoor in text-qrcode

All versions of text-qrcode contain malicious code that overwrites the randomBytes method for the crypto module with a function that generates weak entropy. Instead of generating 32 bytes, the infected randomBytes will generate 3 bytes of entropy and hash them, resulting in a 32 byte value being...

Entropy Backdoor in text-qrcode

All versions of text-qrcode contain malicious code that overwrites the randomBytes method for the crypto module with a function that generates weak entropy. Instead of generating 32 bytes, the infected randomBytes will generate 3 bytes of entropy and hash them, resulting in a 32 byte value being...

GHSA-3CJV-4PHW-GVVV Malicious Package in getcookies

The getcookies module contained a backdoor that would allow for a remote attacker to execute arbitrary commands on the system running the malicious module. Recommendation This module should be uninstalled if found used within an application. In addition to removing the installed module, you will...

Malicious Package in getcookies

The getcookies module contained a backdoor that would allow for a remote attacker to execute arbitrary commands on the system running the malicious module. Recommendation This module should be uninstalled if found used within an application. In addition to removing the installed module, you will...

Servicing stack update for Windows 10, version 1903 and 1909: August 11, 2020

None None...

PT-2020-14505 · Samsung · Cameralyzer

Name of the Vulnerable Software and Affected Versions: Samsung mobile devices with P9.0 and Q10.0 software Description: An issue was discovered that allows attackers to write files to the SD card using Cameralyzer. This affects Samsung mobile devices with P9.0 and Q10.0 software. Recommendations:...

Shopify: Script Editor preview token still working with uninstalled application, even for unpublished script

Within the Script Editor application, it is possible to preview a script on the storefront and proceed to purchase. Once the user click on the preview link, it opens https://shop.myshopify.com/admin/scripts/preview?scriptid=scriptid which then generate a preview token to be used by the storefront...

Adobe Prompts Users to Uninstall Flash Player As EOL Date Looms

With Flash Player’s Dec. 31, 2020 kill date quickly approaching, Adobe said that it will start prompting users to uninstall the software in the coming months. The End of Life EOL timeline has been a long time coming. Adobe first announced in July 2017 that it will no longer update or distribute...

CVE-2020-13884

Citrix Workspace App before 1912 on Windows has Insecure Permissions and an Unquoted Path vulnerability which allows local users to gain privileges during the uninstallation of the application...

PT-2020-13158 · Australian Government · Aus. Gov. Covid Tracking App

Name of the Vulnerable Software and Affected Versions: Aus. Gov. COVID tracking app affected versions not specified Description: The issue allows an attacker to track a target device even after the app is uninstalled. Recommendations: At the moment, there is no information about a newer version...

FTPDMIN End of Life (EOL) Detection

The FTPDMIN version on the remote host has reached the end of life EOL and should not be used anymore. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

CVE-2020-12703

UliCMS before 2020.2 has XSS during PackageController uninstall...

CVE-2020-12703

UliCMS before 2020.2 has XSS during PackageController uninstall...

Design/Logic Flaw

UliCMS before 2020.2 has XSS during PackageController uninstall...

CVE-2020-12703

CVE-2020-12703 affects UliCMS prior to 2020.2, with a Cross-Site Scripting (XSS) vulnerability occurring during PackageController uninstall. Root cause cited across sources is lack of proper validation of client-side data within the web application. Impact is client-side code execution within aff...

GHSA-426H-24VJ-QWXF Command Injection in npm-programmatic

All versions of npm-programmatic are vulnerable to Command Injection. The package fails to sanitize input rules and passes it directly to an exec call on the install, uninstall and list functions . This may allow attackers to execute arbitrary code in the system if the package name passed to the...

Command Injection in npm-programmatic

All versions of npm-programmatic are vulnerable to Command Injection. The package fails to sanitize input rules and passes it directly to an exec call on the install, uninstall and list functions . This may allow attackers to execute arbitrary code in the system if the package name passed to the...

Description of Office Compatibility Pack Service Pack 2

Describes Office Compatibility Pack Service Pack 2 SP2.INTRODUCTIONMicrosoft Office Compatibility Pack Service Pack 2 SP2 gives customers the latest updates to the Office Compatibility Pack for the Microsoft Office Word 2007 file format, for the Microsoft Office Excel 2007 file format, and for th...

Description of the Office 2013 update: December 11, 2012

Description of the Office 2013 update: December 11, 2012 INTRODUCTION Microsoft has released an update for Microsoft Office 2013. This update contains improvements for certain Office images that contain text. Note This update applies to Office 2013 MSI installations only. This update does not app...

JVN#13467854: Toshiba Electronic Devices & Storage software registers unquoted service paths

Some of Toshiba Electronic Devices & Storage software registers Windows services with unquoted file paths CWE-428. Impact When a registered path contains spaces, and a malicious executable is placed on a certain path, it may be executed with the privilege of the Windows service. Solution The...