CVE-2022-31126 Unauthenticated Remote Code Execution in Roxy-wi

Roxy-wi is an open source web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A vulnerability in Roxy-wi allows a remote, unauthenticated attacker to code execution by sending a specially crafted HTTP request to /app/options.py file. This affects Roxy-wi versions before...

EUVD-2022-52756

Roxy-wi is an open source web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A vulnerability in Roxy-wi allows a remote, unauthenticated attacker to bypass authentication and access admin functionality by sending a specially crafted HTTP request. This affects Roxywi version...

Malicious Package

Overview dropbox-internal-sdk is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

CVE-2022-31068 Sensitive Data Exposure on Refused Inventory Files in GLPI

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions all GLPI instances with the native inventory used may leak sensitive information. The feature to get refused file is not authenticated...

CVE-2022-31057 Authenticated Stored XSS in Shopware Administration

Shopware is an open source e-commerce software made in Germany. Versions of Shopware 5 prior to version 5.7.12 are subject to an authenticated Stored XSS in Administration. Users are advised to upgrade. There are no known workarounds for this issue...

Malicious Package

Overview en-conduit-plugin-in-app-purchasing is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerab...

Malicious code in lwc-modules-foo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 46d862b5923de09847e190714fa9981eb4f6d65f46e1c7cddbf6f840663d8534 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7351 Malicious code in yhps (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 318bee0ce2d48822bd65011c120d5d4572bc064eeb3a8c013bda1eaf6ff7bbc1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in idnnnms-widget-auth-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c2d88993f3efd7188328e5518c6b2c91a51f857df272820e8a2c4fced28c1fcc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in datadog-serverless-macro (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ba2ee7b3443a0229199bf0f65989cd56d3cc784e7f184562cd9a3d74c8501f4e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in maps-theme (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 77941a159908349eb82d90ae8105f74c66d5bfaeb4879e9e0f96bffcdd1b4b9b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in zlpypfaaisdmzcc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3a9c44cbfb71d11359d53e52f5a6e5c124d8844c95b07a08339fb2facbe577e6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

UBUNTU-CVE-2014-125012

A vulnerability was found in FFmpeg 2.0. It has been classified as problematic. Affected is an unknown function of the file libavcodec/dxtroy.c. The manipulation leads to integer coercion error. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue...

UBUNTU-CVE-2014-125015

A vulnerability classified as critical has been found in FFmpeg 2.0. Affected is the function readvarblockdata. The manipulation leads to memory corruption. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue...

UBUNTU-CVE-2014-125002

A vulnerability was found in FFmpeg 2.0. It has been classified as problematic. Affected is the function dnxhdinitrc of the file libavcodec/dnxhdenc.c. The manipulation leads to memory corruption. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue...

UBUNTU-CVE-2014-125005

A vulnerability, which was classified as problematic, was found in FFmpeg 2.0. This affects the function decodevolheader of the file libavcodec/mpeg4videodec.c. The manipulation leads to memory corruption. It is possible to initiate the attack remotely. It is recommended to apply a patch to fix...

PT-2022-3231 · Unknown · Edgexfoundry

Name of the Vulnerable Software and Affected Versions: EdgeXFoundry versions prior to 2.1.1 Description: The /api/v2/config endpoint exposes message bus credentials to local unauthenticated users, bypassing access controls on message bus credentials when running in security-enabled mode. This...

Malicious code in ptmproc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1cabaacc4115ee94b13ad9119f1cfe48993495c7c68966977d13b123749035a7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-31051 Exposure of Sensitive Information to an Unauthorized Actor in semantic-release

semantic-release is an open source npm package for automated version management and package publishing. In affected versions secrets that would normally be masked by semantic-release can be accidentally disclosed if they contain characters that are excluded from uri encoding by encodeURI...

CVE-2022-29227 Use after free in Envoy

Envoy is a cloud-native high-performance edge/middle/service proxy. In versions prior to 1.22.1 if Envoy attempts to send an internal redirect of an HTTP request consisting of more than HTTP headers, there’s a lifetime bug which can be triggered. If while replaying the request Envoy sends a local...