AVEVA Edge APP File Insufficient UI Warning Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of APP...

Tech support scammers target Microsoft users with fake Office 365 USB sticks

Microsoft is a hot target for scammers and acts of fraud. For example, tech support scam websites cover themselves in Windows branding and messages. Phone scammers claim to be calling directly from Microsoft. If its not a Bill Gates themed lottery spam mail in your mailbox, its a fake Excel...

MAL-2022-4413 Malicious code in lrypeto (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2ff8c72de071472da288c85aac789ccbeb858361ff0629b85545bf336cb0323e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4790 Malicious code in nde4watch (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4a78c9846901d8f1b57e9fee1d506d43b913482b18e56118b09de90281a6f97b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4483 Malicious code in markdowvnit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7f5fcb8b92c01a2d46eb2ce0d518198542538922425915dffdb6b01d504206f3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

App Layering - Stuck Tasks or new tasks hang at "pending" or "stalled"

Tasks won't progress, appear as stalled. New tasks sit at "Pending" From maservice.log: 2021-01-11 09:10:25,575 WARN 20193 UnitOfWorkImplemen: Transaction is implicitly being rolled back at Uni.Appliance.PersistenceLayer.UnitOfWork.UnitOfWorkImplementation.Dispose 0x00025 in :0 at...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none...

A week in security (August 1 – 7)

Last week on Malwarebytes Labs: Have we lost the fight for data privacy? Lock and Code S03E16 Wrestling star Mick Foley’s Twitter compromised, selling PS5 consoles Millions of Arris routers are vulnerable to path traversal attacks When a sextortion victim fights back How to protect yourself and...

Emergency Alert System Flaws Could Let Attackers Transmit Fake Messages

The U.S. Department of Homeland Security DHS has warned of critical security vulnerabilities in Emergency Alert System EAS encoder/decoder devices. If left unpatched, the issues could allow an adversary to issue fraudulent emergency alerts over TV, radio, and cable networks. The August 1 advisory...

OPENSUSE-SU-2022:10075-1 Security update for python-jupyterlab

This update for python-jupyterlab fixes the following issues: Update to 2.2.10: Remove form tags' action attribute during sanitizing, to prevent an XSS CVE-2021-32797 boo1196663 Header ‘Content-Type’ should not be overwritten Do not use token parameters in websocket urls Properly handle errors in...

Malicious code in npm-dependency-submission-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d5ad151e37604b229dbad34a65d41f3ddfeb26db05249d3b5216635b725b7527 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-31186

NextAuth.js is a complete open source authentication solution for Next.js applications. An information disclosure vulnerability in next-auth before v4.10.2 and v3.29.9 allows an attacker with log access privilege to obtain excessive information such as an identity provider's secret in the log whi...

Information disclosure

NextAuth.js is a complete open source authentication solution for Next.js applications. An information disclosure vulnerability in next-auth before v4.10.2 and v3.29.9 allows an attacker with log access privilege to obtain excessive information such as an identity provider's secret in the log whi...

CVE-2022-31186 Leakage of excessive information into log in next-auth

NextAuth.js is a complete open source authentication solution for Next.js applications. An information disclosure vulnerability in next-auth before v4.10.2 and v3.29.9 allows an attacker with log access privilege to obtain excessive information such as an identity provider's secret in the log whi...

CVE-2022-31186 Leakage of excessive information into log in next-auth

NextAuth.js is a complete open source authentication solution for Next.js applications. An information disclosure vulnerability in next-auth before v4.10.2 and v3.29.9 allows an attacker with log access privilege to obtain excessive information such as an identity provider's secret in the log whi...

GSD-2022-1004930 dm raid: fix KASAN warning in raid5_add_disks

dm raid: fix KASAN warning in raid5adddisks This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.322 by commit...

GSD-2022-1004803 dmaengine: pl330: Fix lockdep warning about non-static key

dmaengine: pl330: Fix lockdep warning about non-static key This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.252 by commit...

GSD-2022-1004714 dmaengine: pl330: Fix lockdep warning about non-static key

dmaengine: pl330: Fix lockdep warning about non-static key This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.205 by commit...

GSD-2022-1004612 dm raid: fix KASAN warning in raid5_add_disks

dm raid: fix KASAN warning in raid5adddisks This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.129 by commit...

GSD-2022-1004589 dmaengine: pl330: Fix lockdep warning about non-static key

dmaengine: pl330: Fix lockdep warning about non-static key This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.130 by commit...