127 matches found
byondreal accessor security breach
byondreal accessor is a library by byondreal individual developers. A security vulnerability exists in byondreal accessor version 1.0.0 and earlier, which originates from a vulnerability that allows an attacker to execute arbitrary code via byondreal/accessor/index...
CVE-2024-36583
A Prototype Pollution issue in byondreal accessor = 1.0.0 allows an attacker to execute arbitrary code via @byondreal/accessor/index...
npm getsetprop Security Vulnerabilities
npm getsetprop is a library from the American company npm. A security vulnerability exists in npm getsetprop version 1.1.0, which originated from allowing an attacker to execute arbitrary code via global.accessor...
CVE-2024-36583
A Prototype Pollution issue in byondreal accessor = 1.0.0 allows an attacker to execute arbitrary code via @byondreal/accessor/index...
CVE-2024-36583: Improperly Controlled Modification of Object Prototype Attributes
A Prototype Pollution issue in byondreal accessor = 1.0.0 allows an attacker to execute arbitrary code via @byondreal/accessor/index...
CVE-2024-36583
The byondreal accessor library (version 1.0.0 and earlier ) is vulnerable to a Prototype Pollution issue within the @byondreal/accessor/index module. This vulnerability stems from improper key restrictions that prevent object prototype manipulation, which can allow an attacker to overwrite the ob...
CVE-2024-36575
The getsetprop library (version 1.1.0 ) is vulnerable to a Prototype Pollution issue. The root cause is improper restrictions on __proto__ or constructor.prototype properties. This flaw allows an attacker to manipulate application logic, which can lead to denial of service or remote code executio...
mvel:MvelFuzzer: Security exception in org.mvel2.util.ParseTools.parseWithExpressions
Detailed Report: https://oss-fuzz.com/testcase?key=6215452517793792 Project: mvel Fuzzing Engine: libFuzzer Fuzz Target: MvelFuzzer Job Type: libfuzzerasanmvel Platform Id: linux Crash Type: Security exception Crash Address: Crash State: org.mvel2.util.ParseTools.parseWithExpressions...
Velociraptor 0.7.2 Release: Digging Deeper than Ever with EWF Support, Dynamic DNS and More
By Dr. Mike Cohen and Carlos Canto Rapid7 is very excited to announce that version 0.7.2 of Velociraptor is now fully available for download. In this post we’ll discuss some of the interesting new features. EWF Support Velociraptor has introduced the ability to analyze dead disk images in the pas...
Velociraptor 0.7.0 Release: Dig Deeper With Enhanced Client Search, Server Improvements and Expanded VQL Library
Carlos Canto contributed to this article. Rapid7 is thrilled to announce version 0.7.0 of Velociraptor is now LIVE and available for download. The focus of this release was on improving user efficiency while also expanding and strengthening the library of VQL plug-ins and artifacts. Let’s take a...
CVE-2023-37466 vm2 Sandbox Escape vulnerability
vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19, Promise handler sanitization can be bypassed with the @@species accessor property...
CVE-2023-37466 vm2 Sandbox Escape vulnerability
vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19, Promise handler sanitization can be bypassed with the @@species accessor property...
vm2 代码注入漏洞
vm2 is an advanced virtual machine/sandbox for Node.js by individual developer Patrik Simek in the Czech Republic. to run untrusted code using whitelisted Node built-in modules. A code injection vulnerability exists in vm2 3.9.19 and earlier versions, which stems from the ability to bypass handle...
PT-2023-16878 · Unknown · Insightcloudsec
Name of the Vulnerable Software and Affected Versions: InsightCloudSec versions prior to 23.2.1 Description: An authenticated attacker can leverage an exposed resource.db accessor method to smuggle Python method calls via a Jinja template, which can lead to code execution. This issue was resolved...
Vault Fails to Verify if Approle SecretID Belongs to Role During a Destroy Operation
Summary When using the Vault and Vault Enterprise Vault approle auth method, any authenticated user with access to the /auth/approle/role/:rolename/secret-id-accessor/destroy endpoint can destroy the secret ID of any other role by providing the secret ID accessor. This vulnerability, CVE-2023-249...
SUSE CVE-2019-13298
ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/pixel-accessor.h in SetPixelViaPixelInfo because of a MagickCore/enhance.c error...
CVE-2022-0284
A heap-based-buffer-over-read flaw was found in ImageMagick's GetPixelAlpha function of 'pixel-accessor.h'. This vulnerability is triggered when an attacker passes a specially crafted Tagged Image File Format TIFF image to convert it into a PICON file format. This issue can potentially lead to a...
CVE-2022-0284
CVE-2022-0284 describes a heap-based buffer over-read in ImageMagick's GetPixelAlpha() within pixel-accessor.h. When a specially crafted TIFF is converted to PICON, it can lead to denial of service and information disclosure. The provided documents corroborate the existence of this vulnerability ...
Malicious code in backbone-typescripts-accessor-generator (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3840c75337cd1b91f11c859547a44c49050af6f3caf764fac6335dd47ab75829 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-1448 Malicious code in backbone-typescripts-accessor-generator (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3840c75337cd1b91f11c859547a44c49050af6f3caf764fac6335dd47ab75829 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...