Design/Logic Flaw

Use of insufficiently random values vulnerability exists in Vnet/IP communication module VI461 of YOKOGAWA Wide Area Communication Router WAC Router AW810D, which may allow a remote attacker to cause denial-of-service DoS condition by sending a specially crafted packet...

WordPress plugin: Code issue involving the Import Any XML or CSV File function

WordPress is a blogging platform developed using the PHP language. WordPress Import any XML or CSV File plugin versions prior to 3.6.8 are vulnerable to arbitrary file uploads, which originate from accepting all zip files and automatically extracting the zip file without validating the extracted...

CVE-2022-32284: Use of Insufficiently Random Values

Use of insufficiently random values vulnerability exists in Vnet/IP communication module VI461 of YOKOGAWA Wide Area Communication Router WAC Router AW810D, which may allow a remote attacker to cause denial-of-service DoS condition by sending a specially crafted packet...

GHSA-QM37-C4W6-H9V9 Missing Authorization in Jenkins XPath Configuration Viewer Plugin

XPath Configuration Viewer Plugin 1.1.1 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to access the XPath Configuration Viewer page. Given appropriate XPath expressions, this page grants access to job configuration XML data...

Yokogawa Wide Area Communication Router

1. EXECUTIVE SUMMARY CVSS v3 5.9 ATTENTION: Exploitable remotely Vendor: Yokogawa Equipment: Wide Area Communication Router WAC Router Vulnerability: Use of Insufficiently Random Values 2. RISK EVALUATION Successful exploitation of this vulnerability could cause the functions provided by the WAC...

PT-2022-31655

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to 5.15.46 Description A potential security issue exists where the md/bitmap does not set sb values if it cannot pass a sanity check. The actual impact and attack plausibility have not yet been proven. Recommendatio...

PT-2022-32039

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to 5.4.198 Description A potential security issue exists where the md/bitmap does not set sb values if it cannot pass a sanity check. The actual impact and attack plausibility have not yet been proven. Recommendatio...

CVE-2022-31104

Wasmtime is a standalone runtime for WebAssembly. In affected versions wasmtime's implementation of the SIMD proposal for WebAssembly on x8664 contained two distinct bugs in the instruction lowerings implemented in Cranelift. The aarch64 implementation of the simd proposal is not affected. The bu...

CVE-2022-31034

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v0.11.0 are vulnerable to a variety of attacks when an SSO login is initiated from the Argo CD CLI or UI. The vulnerabilities are due to the use of insufficiently random values in...

CVE-2022-31034: Use of Insufficiently Random Values

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v0.11.0 are vulnerable to a variety of attacks when an SSO login is initiated from the Argo CD CLI or UI. The vulnerabilities are due to the use of insufficiently random values in...

Yieldy._storeRebase() saves and emits wrong values.

Lines of code Vulnerability details Impact Yieldy.storeRebase saves and emits wrong values. I don't think the asset will be lost directly because of this but the rebase storage will have wrong values and it might affect the system later. Proof of Concept The previousCirculating must be a previous...

Information Disclosure

vdsm is vulnerable to information disclosure. The vulnerability exists due to a race condition allowing sensitive values in log files to be stored in clear text...

GHSA-MHP7-3393-PFQR Cross-site Scripting vulnerability in Jenkins

Since Jenkins 2.340, symbol-based icons unescape previously escaped values of tooltip parameters. This vulnerability is known to be exploitable by attackers with Job/Configure permission. Jenkins 2.356, LTS 2.332.4 and LTS 2.346.1 addresses this vulnerability. Symbol-based icons no longer unescap...

CVE-2022-34172

In Jenkins 2.340 through 2.355 both inclusive symbol-based icons unescape previously escaped values of 'tooltip' parameters, resulting in a cross-site scripting XSS vulnerability...

Malicious Package

Overview react-ldclient-default-values is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if...

Malicious Package

Overview epic-fortnite-shared-values is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if th...

CVE-2022-34295: Use of Insufficiently Random Values

totd before 1.5.3 does not properly randomize mesg IDs...

CVE-2022-31034

Several Single sign-on SSO vulnerabilities were found in ArgoCD when the login process is initiated via CLI or UI interfaces. The vulnerabilities are related to using insufficiently random value parameters during the login process. This flaw gives the attacker elevated privileges, including the...

Insecure entropy in Argo CD's PKCE/Oauth2/OIDC params

All versions of Argo CD starting with v0.11.0 is vulnerable to a variety of attacks when an SSO login is initiated from the Argo CD CLI or UI. The vulnerabilities are due to the use of insufficiently random values in parameters in Oauth2/OIDC login flows...

Malicious code in react-ldclient-default-values (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eef871476bf59366a51d76d7ffbf882877423325d7e20519ff251254fee606dd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...