GHSA-HJP8-2CM3-CC45 Cookie exposure in requestretry

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository fgribreau/node-request-retry prior to 7.0.0 via cookies being leaked to external sites...

Cookie exposure in requestretry

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository fgribreau/node-request-retry prior to 7.0.0 via cookies being leaked to external sites...

CVE-2022-0654

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository fgribreau/node-request-retry prior to 7.0.0...

CVE-2022-0654

CVE-2022-0654 affects node-request-retry in fgribreau/node-request-retry prior to 7.0.0. The vulnerability exposes sensitive information (cookies/credentials) to an unauthorized actor by leaking data to external sites during redirect-based requests, enabling potential credential abuse. Public ref...

OAuth consent phishing, in the wild

TL;DR An interesting incident response investigation showed exploitation of a recent OAuth related consent-phishing issue. We had been asked to investigate as the organisation had noticed some odd behaviours in the mailbox of one of the exec team. The mailbox was being queried using GraphAPI and...

This Week in Security News - February 18, 2022

SMS PVA services' use of infected Android phones reveals flaws in SMS verification, and 'Russian state-sponsored cyber actors' cited in hacks of U.S. defense contractors...

Looking Over the Nation-State Actors’ Shoulders

Looking over the nation-state actors’ shoulders: Even they have a difficult day sometimes By Trellix and Marc Elias · Febraury 17, 2022 Have you ever been curious about how nation-state actors operate and what their day-to-day work looks like? This blog reveals some of these details observed base...

CVE-2021-22041

VMware ESXi, Workstation, and Fusion contain a double-fetch vulnerability in the UHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host...

Missing Authorization in librenms/librenms

Missing Authorization in Packagist librenms/librenms prior to 22.2.0...

GHSA-254Q-RQMW-VX45 Missing Authorization in librenms/librenms

Missing Authorization in Packagist librenms/librenms prior to 22.2.0...

CVE-2022-23643 Side-channel attack in Sourcegraph Code Monitors

Sourcegraph is a code search and navigation engine. Sourcegraph versions 3.35 and 3.36 reintroduced a previously fixed side-channel vulnerabilitity in the Code Monitoring feature where strings in private source code could be guessed by an authenticated but unauthorized actor. This issue affects...

CVE-2022-23643 Side-channel attack in Sourcegraph Code Monitors

Sourcegraph is a code search and navigation engine. Sourcegraph versions 3.35 and 3.36 reintroduced a previously fixed side-channel vulnerabilitity in the Code Monitoring feature where strings in private source code could be guessed by an authenticated but unauthorized actor. This issue affects...

GHSA-QPV2-JXC7-3638 Exposure of Sensitive Information in snipe/snipe-it

Observable Discrepancy in Packagist snipe/snipe-it prior to v5.3.10...

Cross-site Scripting in pimcore

Cross-site Scripting in Packagist pimcore/pimcore prior to 10.3.1...

GHSA-H9VC-2P9G-63GP Cross-site Scripting in pimcore

Cross-site Scripting in Packagist pimcore/pimcore prior to 10.3.1...

Exposure of Sensitive Information to an Unauthorized Actor in ionicabizau/parse-url

Description First Assume this example var parseUrl = require"parse-url" parseUrl"http://[email protected]:[email protected]/path/name?foo=bar&bar=42some-hash" that return : protocols: "http" protocol: "http" port: null resource: "[email protected]" user: "" pathname:...

CVE-2022-23773

cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags...

Exposure of Sensitive Information to an Unauthorized Actor in fgribreau/node-request-retry

Exposure of Sensitive Information to an Unauthorized Actor in FGRibreau/node-request-retry Reported on Feb 10 2022 | Timothee Desurmont Vulnerability type: CWE-200 Bug Cookies are leaked to external sites. Description js request$mysite/redirect.php?url=$attacker/, options When fetching a Redirect...

GHSA-6566-9526-52V6 Exposure of Sensitive Information to an Unauthorized Actor in Concord

An issue was discovered in Walmart Labs Concord before 1.44.0. CORS Access-Control-Allow-Origin headers have a potentially unsafe dependency on Origin headers, and are not configurable. This allows remote attackers to discover host information, nodes, API metadata, and references to usernames via...

The vulnerability of the BIND DNS server, related to uncontrolled resource consumption, allows a hacker to cause a service failure.

The vulnerability of the BIND DNS server is related to uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures...