Malicious code in test-audit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 748df8f06d1c1132320f9757b1361786793823e3dc2881ff8e6d6f8f33ac4606 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in audit-pricing (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 63494ded7d57fd765870370ad094bbbf96de1b2ea04e60358ef700792419245a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1171 Malicious code in audit-pricing (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 63494ded7d57fd765870370ad094bbbf96de1b2ea04e60358ef700792419245a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1864 Malicious code in cf-scraper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1d6e6033f1f1ea9b7653a997818b6c7703bbe7bfca9f0b2ecce0dea100f773c7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in bfx-ws2-api-audit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a4aa321103468bc42d52655217679df5a46958d2714780f7f4443659ed50d457 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in private-identity-audit-wasm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4b1bd9d874421f920c2d168c65c29f9f4cfd20aebdd77c6fdbfd8e4e0935a778 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5463 Malicious code in private-identity-audit-wasm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4b1bd9d874421f920c2d168c65c29f9f4cfd20aebdd77c6fdbfd8e4e0935a778 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in audit-logging (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 76f664ae26ee0d9606ef9d7901b65dc80da1f73baee088eeda8ab6025dabf096 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1170 Malicious code in audit-logging (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 76f664ae26ee0d9606ef9d7901b65dc80da1f73baee088eeda8ab6025dabf096 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Insecure path traversal in Git Trigger Source can lead to arbitrary file read

Impact A path traversal issue was found in the g GitArtifactReader.Read API. Read calls into g GitArtifactReader.readFromRepository that opens and reads the file that contains the trigger resource definition: go func g GitArtifactReader readFromRepositoryr git.Repository, dir string No checks are...

GHSA-5Q86-62XR-3R57 Uses of deprecated API can be used to cause DoS in user-facing endpoints

Impact Several HandleRoute endpoints make use of the deprecated ioutil.ReadAll. ioutil.ReadAll reads all the data into memory. As such, an attacker who sends a large request to the Argo Events server will be able to crash it and cause denial of service. Eventsources susceptible to an out-of-memor...

Uses of deprecated API can be used to cause DoS in user-facing endpoints

Impact Several HandleRoute endpoints make use of the deprecated ioutil.ReadAll. ioutil.ReadAll reads all the data into memory. As such, an attacker who sends a large request to the Argo Events server will be able to crash it and cause denial of service. Eventsources susceptible to an out-of-memor...

GHSA-3JCH-9QGP-4844 Generated code can read and write out of bounds in safe code

Code generated by flatbuffers' compiler is unsafe but not marked as such. See https://github.com/google/flatbuffers/issues/6627 for details. All users that use generated code by flatbuffers compiler are recommended to: 1. not expose flatbuffer generated code as part of their public APIs 2. audit...

Generated code can read and write out of bounds in safe code

Code generated by flatbuffers' compiler is unsafe but not marked as such. See https://github.com/google/flatbuffers/issues/6627 for details. All users that use generated code by flatbuffers compiler are recommended to: 1. not expose flatbuffer generated code as part of their public APIs 2. audit...

Tenable Network Security Nessus 输入验证错误漏洞

Tenable Network Security Nessus is an open source system vulnerability scanner from Tenable Network Security, USA. An input validation error vulnerability exists in Tenable Network Security Nessus Agent version 10.1.3 and earlier versions, which can be exploited by an authenticated attacker to re...

[R1] Nessus Agent Version 10.1.4 Fixes Multiple Vulnerabilities

R1 Nessus Agent Version 10.1.4 Fixes Multiple Vulnerabilities Arnie Cabral Wed, 06/15/2022 - 12:36 Custom audit files bring tremendous power and flexibility when assessing the configuration of your assets. Two separate vulnerabilities that utilize this custom Audit functionality were identified,...

Command Execution Vulnerability in the Operation and Maintenance Audit System of Beijing COSCO Kirin Technology Co. Ltd (CNVD-2022-53245)

COSCO KyLin Technology Co., Ltd. is a R&D-oriented software development company, the company's main products are COSCO KyLin Barrier Machine, KyLin SSL VPN, KyLin Dynamic Password System, KyLin Cloud Desktop and so on. Our main products are COSCO Kirin SSL VPN, Kirin Dynamic Password System, Kiri...

ALPINE-CVE-2022-26363

x86 pv: Insufficient care with non-coherent mappings This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. Xen maintains a type reference count for pages, in addition to a regular reference count. This scheme is used to...

Wolters Kluwer TeamMate Audit SQL Injection Vulnerability

Wolters Kluwer TeamMate Audit is a cloud-based audit management tool from Wolters Kluwer Netherlands. A SQL injection vulnerability exists in Wolters Kluwer TeamMate Audit version 28.0.19.0, which stems from a lack of filtering and escaping of SQL data in search forms. An attacker could use this...

GHSA-5FFW-GXPP-MXPF containerd CRI plugin: Host memory exhaustion through ExecSync

Impact A bug was found in containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the ExecSync API. This can cause containerd to consume all available memory on the computer, denying service to other...