CVE-2022-39217

some-natalie/ghas-to-csv GitHub Advanced Security to CSV is a GitHub action which scrapes the GitHub Advanced Security API and shoves it into a CSV. In affected versions this GitHub Action creates a CSV file without sanitizing the output of the APIs. If an alert is dismissed or any other custom...

Code injection

some-natalie/ghas-to-csv GitHub Advanced Security to CSV is a GitHub action which scrapes the GitHub Advanced Security API and shoves it into a CSV. In affected versions this GitHub Action creates a CSV file without sanitizing the output of the APIs. If an alert is dismissed or any other custom...

CVE-2022-39217

CVE-2022-39217 affects the GitHub Action some-natalie/ghas-to-csv (GitHub Advanced Security to CSV). The action creates a CSV from the GitHub Advanced Security API without sanitizing API output, enabling potential execution of arbitrary code if a dismissible alert or custom field contains executa...

CVE-2022-39217 Improper Neutralization of Formula Elements in a CSV File in ghas-to-csv

some-natalie/ghas-to-csv GitHub Advanced Security to CSV is a GitHub action which scrapes the GitHub Advanced Security API and shoves it into a CSV. In affected versions this GitHub Action creates a CSV file without sanitizing the output of the APIs. If an alert is dismissed or any other custom...

CVE-2022-39217 Improper Neutralization of Formula Elements in a CSV File in ghas-to-csv

some-natalie/ghas-to-csv GitHub Advanced Security to CSV is a GitHub action which scrapes the GitHub Advanced Security API and shoves it into a CSV. In affected versions this GitHub Action creates a CSV file without sanitizing the output of the APIs. If an alert is dismissed or any other custom...

GHSA-634P-93H9-92VH ghas-to-csv vulnerable to Improper Neutralization of Formula Elements in a CSV File

Impact This GitHub Action creates a CSV file without sanitizing the output of the APIs. If an alert is dismissed or any other custom field contains executable code / formulas, it might be run when an endpoint opens that CSV file in a spreadsheet program. The data flow looks like this 👇🏻 mermaid...

ghas-to-csv vulnerable to Improper Neutralization of Formula Elements in a CSV File

Impact This GitHub Action creates a CSV file without sanitizing the output of the APIs. If an alert is dismissed or any other custom field contains executable code / formulas, it might be run when an endpoint opens that CSV file in a spreadsheet program. The data flow looks like this 👇🏻 mermaid...

GHSA-8H89-34W2-JPFM XWiki Platform Old Core vulnerable to Authentication Bypass Using the Login Action

Impact All rights checks that would normally prevent a user from viewing a document on a wiki can be bypassed using the login action and directly specified templates. This exposes title, content and comments of any document and properties of objects class and property name must be known, though...

Code injection

Garage Management System v1.0 is vulnerable to Arbitrary code execution via ip/garage/phpaction/editProductImage.php?id=1...

CVE-2022-38877

Garage Management System v1.0 is vulnerable to Arbitrary code execution via ip/garage/phpaction/editProductImage.php?id=1...

CVE-2022-25690

Information disclosure in WLAN due to improper validation of array index while parsing crafted ANQP action frames in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile,...

CVE-2022-25690

Information disclosure in WLAN due to improper validation of array index while parsing crafted ANQP action frames in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile,...

CVE-2022-40658

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NIKON NIS-Elements Viewer 1.2100.1483.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists...

CVE-2022-40660

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NIKON NIS-Elements Viewer 1.2100.1483.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists...

CVE-2022-40649

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsi...

CVE-2022-40643

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsi...

Bento4 代码问题漏洞

Bento4 is an open source C++ library for reading and writing MP4 files. A security vulnerability exists in Bento4 version 1.6.0-639, which stems from a null pointer dereference in its AP4EsDescriptor::WriteFields and AP4Expandable::Write components when calling the Core/Ap4Descriptor.h component'...

PT-2022-25500 · Bento4 · Bento4

Name of the Vulnerable Software and Affected Versions: Bento4 versions 1.6.0-639 and earlier Description: An issue was discovered that leads to a NULL pointer dereference in AP4 DescriptorListWriter::Action in Core/Ap4Descriptor.h. This issue is called from AP4 EsDescriptor::WriteFields and AP4...

MAL-2022-2127 Malicious code in commons-ebay (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7fca6c21af828f60fe97221a1964dd96fdfa94550187dd44fb09f7201f4d34f9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5111 Malicious code in optimizer-plugin-inc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 07b2794871339a2d8424d71ca9e8e0514ee68eda9532a9b9877de950becac68a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...