PT-2024-27075 · Unknown · Getsetprop

Name of the Vulnerable Software and Affected Versions: getsetprop version 1.1.0 Description: A Prototype Pollution issue allows an attacker to execute arbitrary code via global.accessor. Recommendations: For getsetprop version 1.1.0, consider disabling access to the global.accessor until a patch ...

CVE-2024-36583

A Prototype Pollution issue in byondreal accessor = 1.0.0 allows an attacker to execute arbitrary code via @byondreal/accessor/index...

CVE-2024-36575

CVE-2024-36575 affects getsetprop 1.1.0, with a prototype pollution flaw that can allow an attacker to execute arbitrary code via global.accessor. NVD/NVD-related entries cite code execution, while Veracode notes pollution via proto /constructor.prototype that could disrupt logic and lead to remo...

CVE-2024-36583

The CVE-2024-36583 entry describes a Prototype Pollution vulnerability in the byondreal accessor package, affecting version 1.0.0 and earlier. The issue arises from improper key handling in @byondreal/accessor/index that can allow an attacker to modify object prototypes and potentially execute ar...

Velociraptor 0.7.2 Release: Digging Deeper than Ever with EWF Support, Dynamic DNS and More

By Dr. Mike Cohen and Carlos Canto Rapid7 is very excited to announce that version 0.7.2 of Velociraptor is now fully available for download. In this post we’ll discuss some of the interesting new features. EWF Support Velociraptor has introduced the ability to analyze dead disk images in the pas...

Velociraptor 0.7.0 Release: Dig Deeper With Enhanced Client Search, Server Improvements and Expanded VQL Library

Carlos Canto contributed to this article. Rapid7 is thrilled to announce version 0.7.0 of Velociraptor is now LIVE and available for download. The focus of this release was on improving user efficiency while also expanding and strengthening the library of VQL plug-ins and artifacts. Let’s take a...

CVE-2023-37466 vm2 Sandbox Escape vulnerability

vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19, Promise handler sanitization can be bypassed with the @@species accessor property...

CVE-2023-37466 vm2 Sandbox Escape vulnerability

vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19, Promise handler sanitization can be bypassed with the @@species accessor property...

vm2 代码注入漏洞

vm2 is an advanced virtual machine/sandbox for Node.js by individual developer Patrik Simek in the Czech Republic. to run untrusted code using whitelisted Node built-in modules. A code injection vulnerability exists in vm2 3.9.19 and earlier versions, which stems from the ability to bypass handle...

PT-2023-16878 · Unknown · Insightcloudsec

Name of the Vulnerable Software and Affected Versions: InsightCloudSec versions prior to 23.2.1 Description: An authenticated attacker can leverage an exposed resource.db accessor method to smuggle Python method calls via a Jinja template, which can lead to code execution. This issue was resolved...

Vault Fails to Verify if Approle SecretID Belongs to Role During a Destroy Operation

Summary When using the Vault and Vault Enterprise Vault approle auth method, any authenticated user with access to the /auth/approle/role/:rolename/secret-id-accessor/destroy endpoint can destroy the secret ID of any other role by providing the secret ID accessor. This vulnerability, CVE-2023-249...

SUSE CVE-2019-13298

ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/pixel-accessor.h in SetPixelViaPixelInfo because of a MagickCore/enhance.c error...

CVE-2022-0284

A heap-based-buffer-over-read flaw was found in ImageMagick's GetPixelAlpha function of 'pixel-accessor.h'. This vulnerability is triggered when an attacker passes a specially crafted Tagged Image File Format TIFF image to convert it into a PICON file format. This issue can potentially lead to a...

CVE-2022-0284

CVE-2022-0284 describes a heap-based buffer over-read in ImageMagick's GetPixelAlpha() within pixel-accessor.h. When a specially crafted TIFF is converted to PICON, it can lead to denial of service and information disclosure. The provided documents corroborate the existence of this vulnerability ...

MAL-2022-1448 Malicious code in backbone-typescripts-accessor-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3840c75337cd1b91f11c859547a44c49050af6f3caf764fac6335dd47ab75829 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in backbone-typescripts-accessor-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3840c75337cd1b91f11c859547a44c49050af6f3caf764fac6335dd47ab75829 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in grunt-backbone-typescript-accessor-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 115b154824bd13959e78a37c9aedd1573687c0ae5c3e7cc352e68c9a751984c3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3471 Malicious code in grunt-backbone-typescript-accessor-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 115b154824bd13959e78a37c9aedd1573687c0ae5c3e7cc352e68c9a751984c3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2021-41802

HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ID sharing a mount accessor with another user to acquire this other user’s policies by merging their identities. Fixed in Vault and Vault Enterprise 1.7.5 and 1.8.4...

CVE-2021-41802

HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ID sharing a mount accessor with another user to acquire this other user’s policies by merging their identities. Fixed in Vault and Vault Enterprise 1.7.5 and 1.8.4...