Security Bulletin: Multiple security vulnerabilities found in open source code that is shipped with IBM Security Verify Access

Summary Source code scanning has found several open source vulnerabilites in the IBM Security Verify Access product. Verify Access has updated the packages as required. Vulnerability Details CVEID: CVE-2018-20574 DESCRIPTION: yaml-cpp is vulnerable to a denial of service, caused by an error in th...

Security Bulletin: Multiple security vulnerabilities fixed in IBM Security Verify Access Appliance (CVE-2022-23308, CVE-2021-23840, CVE-2021-23841, CVE-2021-3712)

Summary Multiple security vulnerabilities found in IBM Security Verify Access Appliance have been fixed. Vulnerability Details CVEID: CVE-2022-23308 DESCRIPTION: libxml2 is vulnerable to a denial of service, caused by a use-after-free in the ID and IDREF attributes. A remote attacker could exploi...

Security Bulletin: Multiple security vulnerabilities fixed in IBM Security Verify Access Appliance (CVE-2022-22465, CVE-2022-22463, CVE-2022-22464)

Summary Multiple security vulnerabilities found in IBM Security Verify Access Appliance have been fixed. Vulnerability Details CVEID: CVE-2022-22465 DESCRIPTION: IBM Security Access Manager Appliance could allow a local user to obtain elevated privileges due to improper access permissions. CVSS...

Security Bulletin: A Cross Site Scripting vulnerability was fixed in the IBM Security Verify Access Product.

Summary The IBM Security Verify Access product has fixed a cross-site scripting vulnerability which would allow users to embed arbirtrary JavaScript code in the Web UI. Vulnerability Details CVEID:CVE-2022-22370 DESCRIPTION: IBM Security Verify Access is vulnerable to cross-site scripting. This...

CVE-2022-22370

IBM Security Verify Access 10.0.0.0, 10.0.1.0, 10.0.2.0, and 10.0.3.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

Security Bulletin: Security vulnerability has been identified in IBM DB2 used by IBM Security Verify Governance, Identity Manager virtual appliance component

Summary Information about security vulnerability affecting IBM DB2 has been published in a security bulletin. Vulnerability Details CVEID:CVE-2021-44280 DESCRIPTION: Attendance Management System is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements to the...

Malicious code in free-fortnite-skins-verify (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7a36b3677b70a09c6c24c79463b185e1111dc67b9cddd4dace6b9fc0efabc246 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3171 Malicious code in free-fortnite-skins-verify (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7a36b3677b70a09c6c24c79463b185e1111dc67b9cddd4dace6b9fc0efabc246 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3196 Malicious code in free-robux-no-human-verify (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8fb5fc98b17a7be27523d37f71595e23c5ce2a38002f49d328bf67bb877211cb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security update for atheme (important)

openSUSE Security Update: Security update for atheme Announcement ID: openSUSE-SU-2022:10018-1 Rating: important References: 1174075 1195989 Cross-References: CVE-2022-24976 CVSS scores: CVE-2022-24976 NVD : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Affected Products: openSUSE Backports...

SMB-Session-Spoofing - Tool To Create A Fake SMB Session

Welcome! This is a utility that can be compiled with Visual Studio 2019 or newer. The goal of this program is to create a fake SMB Session. The primary purpose of this is to serve as a method to lure attackers into accessing a honey-device. This program comes with no warranty or guarantees. Progr...

OS Command Injection

lifion-verify-deps is vulnerable to OS command injection. An attacker can inject and execute malicious commands through the getLatestVersions and getLatestTag functions of index.js by providing a maliciously crafted dependency name to the package.json...

OS Command Injection in lifion-verify-deps

lifion-verify-dependencies through 1.1.0 is vulnerable to OS command injection via a crafted dependency name on the scanned project's package.json file...

GHSA-RPHM-C8GW-3R38 OS Command Injection in lifion-verify-deps

lifion-verify-dependencies through 1.1.0 is vulnerable to OS command injection via a crafted dependency name on the scanned project's package.json file...

CVE-2021-33473

An argument injection vulnerability in Dragonfly Ruby Gem v1.3.0 allows attackers to read and write arbitrary files when the verifyurl option is disabled. This vulnerability is exploited via a crafted URL...

CVE-2021-33473

An argument injection vulnerability in Dragonfly Ruby Gem v1.3.0 allows attackers to read and write arbitrary files when the verifyurl option is disabled. This vulnerability is exploited via a crafted URL...

CVE-2021-34078

lifion-verify-dependencies through 1.1.0 is vulnerable to OS command injection via a crafted dependency name on the scanned project's package.json file...

CVE-2021-34078

lifion-verify-dependencies through 1.1.0 is vulnerable to OS command injection via a crafted dependency name on the scanned project's package.json file...

lifion-verify-dependencies 操作系统命令注入漏洞

lifion-verify-dependencies is lifion's way of checking that the installed NPM module is the latest version currently available. A security vulnerability exists in lifion-verify-dependencies version 1.1.0, which can be exploited by an attacker to execute remote code...

CVE-2021-34078

CVE-2021-34078 affects lifion-verify-dependencies up to version 1.1.0, enabling an OS command injection via a crafted dependency name in a project’s package.json. Multiple connected sources (Red Hat, Veracode, GitHub advisories, CVE/CVE lists) corroborate the vulnerability and its impact (high se...